Direct-tcpip

[russjones]

Problem

When using the recording proxy can establish a direct-tcpip connection to another node and then directly communicate with it bypassing session logging. Teleport should support an option to disable direct-tcpip.

[klizhentas]

Per OpenSSH protocol spec: https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.certkeys?annotate=HEAD
will be called:

permit-port-forwarding and should be part of existing SSH options in our RBAC ssh options key map.

[kontsevoy]

It's a bit unclear to me, what are we doing with this issue? Sounds like a legit use of SSH and folks should realize that session recording cannot possibly record other traffic. Update the docs?

[klizhentas]

no, add the flag to support turning permit-port-forwarding off in the RBAC like we did for pty

[knisbet]

Silly question, but even without being able to record the session, do we audit log the other traffic, like the user setup the following tunnel, or used SCP to copy a file of x bytes to the destination?

[klizhentas]

some of it in audit events, yes

[kontsevoy]

makes sense, I didn't realize we haven't done it yet.
here's the updated role definition with a new flag:

kind: role
version: v3
metadata:
  name: admin
spec:
  # SSH options used for user sessions 
  options:
    # port_forwarding controls either users are allowed to forward ports
    port_forwarding: true

[klizhentas]

looks good to me