Extend Host User Creation to support a static set of users

gravitational / teleport

The easiest, and most secure way to access and protect all of your infrastructure.

https://goteleport.com

GNU Affero General Public License v3.0

17.61k stars 1.76k forks source link

Extend Host User Creation to support a static set of users #42712

Closed rosstimothy closed 1 month ago

rosstimothy commented 5 months ago

What would you like Teleport to do?

Support creating out of band users with pre-set UID, GID and sudo entitlements.

What problem does this solve?

Host user creation is lazy and only creates users at time of login. There are some use cases which require that a static set of predefined users always exist.

rosstimothy commented 3 months ago

[x] Add proto #44610
[x] Implement backend storage service #44778
[x] Implement gRPC service #45292
[x] Add resource to cache #45573
[x] Implement tctl support #46093
[x] Watch for and apply users in the agent #46365
[x] Add audit events #46246
[x] Add test coverage for lib/srv.StaticHostUserHandler #47051
[x] Documentation https://github.com/gravitational/teleport/pull/46650
[x] Add Terraform Provider support #46826
[x] Update RFD #47066

rosstimothy commented 2 months ago

Test Plan

[x] Creating user from resource
- [x] login doesn't exist on host -> create the user
- [x] login exists on host, not managed by Teleport -> do nothing
- [x] login exists on host, insecure-drop -> do nothing
- [x] login exists on host, keep -> do nothing
[x] More than one matcher in an SHU matches a node -> log a warning and do nothing
[x] Deleting SHU resource doesn't remove the user/home directory/sudo entitlements
[x] Automatic Host User Creation
- [x] keep mode doesn't update/overwrite a static user
- [x] drop mode doesn't update/overwrite/delete a static user