sshuttle cannot be used with tsh

[devicenull]

https://github.com/sshuttle/sshuttle/issues/599

This client app expects the standard ssh behavior of a -- indicating the end of an argument list, preventing anything past it from being interpreted by the client as arguments.

This can be found in the openssh source here: https://github.com/openssh/openssh-portable/blob/ca98d3f8c64cfc51af81e1b01c36a919d5947ec2/ssh.c#L1062

Currently, if I try to use this with tsh, I get a weird bash error.

Expected behavior:

Using a -- in the command line should be supported

Current behavior:

$ tsh ssh root@test -- ls
/bin/bash: --: invalid option
Usage:  /bin/bash [GNU long option] [option] ...
        /bin/bash [GNU long option] [option] script-file ...
GNU long options:
        --debug
        --debugger
        --dump-po-strings
        --dump-strings
        --help
        --init-file
        --login
        --noediting
        --noprofile
        --norc
        --posix
        --pretty-print
        --rcfile
        --restricted
        --verbose
        --version
Shell options:
        -ilrsD or -c command or -O shopt_option         (invocation only)
        -abefhkmnptuvxBCHP or -o option
ERROR: Process exited with status 2

Bug details:

• Teleport version Teleport v11.0.1 git:v11.0.1-0-g4746a0a go1.19.2 Proxy version: 11.0.1

I didn't provide debug logs here since I don't think they're really going to be relevant

[StephenTan-TW]

Yes - please can we fix this. I've implemented a hack in sshuttle where I just remove the "--" which I feel is the wrong thing to do

[sinh-tran-ts]

Add config ssh tsh config >> ~/.ssh/config Example Add end of line:

Host gcp-cloud-*
    Port 3022
    ProxyCommand "/usr/local/bin/tsh" proxy ssh --cluster=teleport.local --proxy=teleport.local:443 %r@%h:%p
Host gcp-cloud-compute01
   User centos
Host gcp-cloud-compute02
   User centos

Run ssh sshuttle -e "ssh" -l 0.0.0.0 -vr gcp-cloud-compute01 10.x.x.0/24

[StephenTan-TW]

Add config ssh tsh config >> ~/.ssh/config Example Add end of line:

Host gcp-cloud-*
    Port 3022
    ProxyCommand "/usr/local/bin/tsh" proxy ssh --cluster=teleport.local --proxy=teleport.local:443 %r@%h:%p
Host gcp-cloud-compute01
   User centos
Host gcp-cloud-compute02
   User centos

Run ssh sshuttle -e "ssh" -l 0.0.0.0 -vr gcp-cloud-compute01 10.x.x.0/24

Oh, interesting - will try that - thank you

[ns-sjorgedeaguiar]

@devicenull @webvictim hey guys, I'm willing to work on this issue. However I was looking for some advice on the feasibility and shortcomings. Also is this a fix you’re willing to accept? Thanks

edit: I've opened sshuttle/sshuttle#974 as well to try to address on their end, but it would be great if tsh handled the delimiters.

[ns-sjorgedeaguiar]

Also this seems to be a dup of #16589

[webvictim]

@ns-sjorgedeaguiar I agree it'd be nice if tsh handled delimiters. We would likely accept a PR which fixes this issue in tsh ssh itself, as long as it adds comprehensive test coverage to make sure this doesn't affect other use cases and prevent future regressions.

[devicenull]

@devicenull @webvictim hey guys, I'm willing to work on this issue. However I was looking for some advice on the feasibility and shortcomings. Also is this a fix you’re willing to accept? Thanks

edit: I've opened sshuttle/sshuttle#974 as well to try to address on their end, but it would be great if tsh handled the delimiters.

I no longer work at a place that uses teleport.