Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Teleport emits the wrong session ID for session.leave events #9574

Closed
zmb3 opened this issue Dec 27, 2021 · 0 comments · Fixed by #9575
Closed

Teleport emits the wrong session ID for session.leave events #9574

zmb3 opened this issue Dec 27, 2021 · 0 comments · Fixed by #9575

Comments

@zmb3
Copy link
Collaborator

zmb3 commented Dec 27, 2021

Description

What happened:

When a user leaves an SSH session, the session.leave event incorrectly uses the user's "party" ID as the session ID.

What you expected to happen:

The session ID in the session.leave event should match the session ID in the session.start and session.end events.

image

Reproduction Steps

As minimally and precisely as possible, describe step-by-step how to reproduce the problem.

  1. Start an SSH session via the web UI or tsh
  2. End the session
  3. Observe the audit log

Note: this but does not occur for BPF sessions - they use the correct session ID.

I'm running off a recent commit but this bug looks to have been introduced many years ago in 876e04a.

@zmb3 zmb3 self-assigned this Dec 27, 2021
zmb3 added a commit that referenced this issue Dec 27, 2021
zmb3 added a commit that referenced this issue Dec 28, 2021
zmb3 added a commit that referenced this issue Dec 28, 2021
zmb3 added a commit that referenced this issue Jan 5, 2022
zmb3 added a commit that referenced this issue Jan 5, 2022
zmb3 added a commit that referenced this issue Jan 5, 2022
zmb3 added a commit that referenced this issue Jan 5, 2022
zmb3 added a commit that referenced this issue Jan 6, 2022
r0mant pushed a commit that referenced this issue Jan 7, 2022
* Tweak LDAPS troubleshooting docs

Make it clear that an LDAP connection reset can be due to attempting
to connect on port 389 (which is what our original instructions advised)

* Update example username desktop service to single quotes

* Update rdp-rs (#9344)

This includes gravitational/rdp-rs#5 which will show a better
error message for protocol negotiation failures.

Also bump the libc dependency while we're at it.
All other crates are still up to date.

* Allow locking a desktop

Prior to this change, desktop access only respected locks
on users or roles. This introduces a desktop as a lock target,
preventing new connections and terminating existing connections
to a locked desktop.

Note: when a lock is created, connection attempts will fail
with the generic "websocket connection failed" error.
This will be addressed with #8584.

Updates #8742

* Update locking guide to include Windows Desktops

* Emit the correct session ID for SessionLeave events

Fixes #9574

* Adds the windows_desktop_service section to the meta teleport.yaml (#9573)

* fixes mdx comment style (#9599)

* fixes mdx comment style. leaves a test of the previous comment style in there to see how it got past CI

* removing bad comment

* Disable RDP client on ARM 32 bit (#9667)

Disable RDP client on ARM to remove libatomic dependency on Linux.

* Update e ref

Co-authored-by: Steven Martin <[email protected]>
Co-authored-by: Isaiah Becker-Mayer <[email protected]>
Co-authored-by: Jakub Nyckowski <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant