gravitational / teleport

The easiest, and most secure way to access and protect all of your infrastructure.
https://goteleport.com
GNU Affero General Public License v3.0
17.59k stars 1.76k forks source link

Failed SSH when host name has upper-case using tsh generated config files #38747

Closed dotkrnl closed 7 months ago

dotkrnl commented 8 months ago

This case is related to #15951 but is regarding the host name instead of the user name. It seems to be more critical in my two cents since it invalidates the config file generated by tsh config and should be considered a bug.

Expected behavior:

  1. When a host name in Teleport has upper case, the users should be able to login to the server via ssh with the config file generated with tsh config.
  2. To achieve so, the host name in tsh, especially in tsh proxy ssh, should be case-insensitive. This is because OpenSSH assumes the host name to be case-insensitive and converts %h to lower case.

Current behavior:

  1. tsh config generates a ProxyCommand that uses %r@%h:%p in tsh proxy ssh.
  2. OpenSSH converts the user input of the host name into lower cases, and gives tsh proxy ssh a lower-case %h.
  3. tsh proxy ssh complains about the host being non-exist in the system.
  4. The user fails to login to the server with ssh using the config file generated by tsh config.

Bug details:

Teleport version

v14.2.0 on Cloud, not sure if affecting self-hosted version as well.

Recreation steps

  1. Set the host name on the server to have upper case characters.
  2. Use the script generated on the Teleport portal to add the server.
  3. Use tsh config to generate a SSH configure file.
  4. Use ssh with the config file to connect to the server with upper case character.
  5. ssh fails: Direct dialing to nodes not found in the inventory is not supported.

Debug logs N/A

zmb3 commented 8 months ago

Looks like a duplicate of #7980 and/or #16457

dotkrnl commented 8 months ago

Solution in #7980 looks promising. If Teleport decides to keep the case-sensitive behavior, it would be good to replace %h with %n in the generated config.

zmb3 commented 7 months ago

Closing this as a duplicate.