gravitational / teleport

The easiest, and most secure way to access and protect all of your infrastructure.
https://goteleport.com
GNU Affero General Public License v3.0
17.37k stars 1.74k forks source link

tsh ssh hangs and doesn't return error on openssh connection failure #25968

Open stevenGravy opened 1 year ago

stevenGravy commented 1 year ago

Expected behavior:

Some type of error message or failure as with regular ssh connections on tsh ssh.

The web ui shows this which is cryptic but does return an error on connection attempts.

image

Current behavior:

If a non-existent user is attempted on a OpenSSH server then tsh will hang in the CLI without an error or timeout.

Bug details:

  1. Configure a OpenSSH server to allow connections
  2. Confirm a successful connection with a existing user
  3. Attempt to connect with a user that doesn't exist
    
    $ tsh ssh steven@nodexyz

If the user does a control C they will see this error message.
```bash
^CERROR: ssh: unexpected packet in response to channel open: <nil>

You will see this in the server logs

2023-05-10T01:39:22Z [NODE:FORW] ERRO Unable to create remote connection: ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain trace.fields:map[dst-addr:172.1.24.123:22 src-addr:14.16.14.16:51705] forward/sshserver.go:585
webvictim commented 1 month ago

I saw this error today too when using the wrong login (ec2-user):

gus@apollo:~ % tsh ssh ec2-user@ip-172-31-8-63
If browser window does not open automatically, open it by clicking on the link:
 http://127.0.0.1:55679/8099eb42-52e7-41f3-b653-0e224fdc33f5
ERROR: ssh: unexpected packet in response to channel open: <nil>

It also forces tsh to re-authenticate, which is jarring.

The same error is shown in the web UI, which is not very descriptive or helpful for the end-user:

Screenshot 2024-08-06 at 16 51 46

Using the correct login (ubuntu) works instantly:

gus@apollo:~ % tsh ssh ubuntu@ip-172-31-8-63
Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 6.5.0-1022-aws x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

  System information as of Tue Aug  6 19:52:39 UTC 2024

  System load:  0.07275390625     Processes:             102
  Usage of /:   54.0% of 7.57GB   Users logged in:       1
  Memory usage: 26%               IPv4 address for eth0: 172.31.8.63
  Swap usage:   0%

 * Ubuntu Pro delivers the most comprehensive open source security and
   compliance features.

   https://ubuntu.com/aws/pro

Expanded Security Maintenance for Applications is not enabled.

31 updates can be applied immediately.
To see these additional updates run: apt list --upgradable

Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status

*** System restart required ***
Last login: Tue Aug  6 19:51:55 2024 from 172.31.30.140
ubuntu@ip-172-31-8-63:~$
logout
the connection was closed on the remote side at  06 Aug 24 16:52 ADT
gus@apollo:~ %