strideynet
commented
9 months ago There's two issues here:
- The cert presented by the proxy is signed by the root host CA. However, the known_hosts file does not permit the root host CA for *.leaf
- The cert presented by the proxy has the wrong cluster name in the principle (e.g noah-v15-agentless.root.tele.ottr.sh instead of noah-v15-agentless.leaf.tele.ottr.sh). This means that even if you modify the known_hosts, the certificate is still rejected,
// shouldDialAndForward returns whether a connection should be proxied
// and forwarded or not.
func shouldDialAndForward(params reversetunnelclient.DialParams, recConfig types.SessionRecordingConfig) bool {
// connection is already being tunneled, do not forward
if params.FromPeerProxy {
return false
}
// the node is an agentless node, the connection must be forwarded
if params.TargetServer != nil && params.TargetServer.IsOpenSSHNode() {
return true
}
// proxy session recording mode is being used and an SSH session
// is being requested, the connection must be forwarded
if params.ConnType == types.NodeTunnel && services.IsRecordAtProxy(recConfig.GetMode()) {
return true
}
return false
}It looks like this would potentially impact leaf nodes when proxy recording mode is enabled as well.
Expected behavior: When connecting to an agentless node in a leaf cluster, no TOFU dialogue is presented
Current behavior:
Bug details:
This was previously discussed as a follow on from https://github.com/gravitational/teleport/issues/31281