Add "tunnel" mode to tsh proxy db #11720

r0mant · 2022-04-05T02:39:22Z

This PR updates tsh proxy db command to support "mutual TLS" mode where it opens a TLS tunnel which is already authenticated with the database's client certificate. This makes it possible for the actual database clients to connect through the local proxy directly without TLS authentication since the tunnel is already authenticated. The primary use-case for this is better UX for the local proxy usage with database clients which is esp. important for simplifying the Teleport Terminal usage.

Here's a usage example for Postgres. Start local authenticated proxy:

➜  ~ tsh proxy db --tunnel local
Started authenticated local proxy for the database "local" on 127.0.0.1:57129.

Use the following command to connect to the database:
  $ /opt/homebrew/opt/libpq/bin/psql postgres://localhost:57129

Connect to the database:

➜  ~ /opt/homebrew/opt/libpq/bin/psql postgres://localhost:57129/test
psql (14.2, server 13.5 (Debian 13.5-1.pgdg110+1))
Type "help" for help.

test=#

I have verified this for Postgres, MySQL, MongoDB and Redis. SQL Server already worked this way.

Refs https://github.com/gravitational/webapps.e/issues/177.

@smallinsky

As described in gravitational/webapps.e#177, we want to replace the db tab with just two sections: * "Connect with CLI" which will show the command to use in terminal * "Connect with GUI" which links to our documentation After gravitational/teleport#11720 gets merged, the "Connect with CLI" section will be massively simplified: it'll be basically just something like: psql postgres://localhost:12345 Moreover, @smallinsky suggested that tsh should be responsible for creating those CLI connection commands. We should also do this in the future as it'll let us support new protocols as soon as they land in tsh, without us having to touch Teleterm codebase, for the most part.

ravicious · 2022-04-05T11:38:01Z

To test this I need to have a cluster running code from this PR that also has a db connected to it, right? Is there an easy way to set this up?

tool/tsh/proxy.go

lib/srv/db/proxyserver.go

lib/srv/db/mysql/proxy.go

@smallinsky

As described in gravitational/webapps.e#177, we want to replace the db tab with just two sections: * "Connect with CLI" which will show the command to use in terminal * "Connect with GUI" which links to our documentation After gravitational/teleport#11720 gets merged, the "Connect with CLI" section will be massively simplified: it'll be basically just something like: psql postgres://localhost:12345 Moreover, @smallinsky suggested that tsh should be responsible for creating those CLI connection commands. We should also do this in the future as it'll let us support new protocols as soon as they land in tsh, without us having to touch Teleterm codebase, for the most part.

greedy52

what happens when "mtls" is used against older servers?

greedy52 · 2022-04-06T13:46:05Z

tool/tsh/proxy.go

+Use the following command to connect to the database:
+  $ {{.command}}


The "mtls" mode should also work for GUIs? Not suggesting any change here. Just curious if this should be default mode eventually.

Yep. I was planning to look into updating the docs after this merges.

klizhentas · 2022-04-06T16:12:06Z

@r0mant sorry for the nitpicks on the name, I was looking at this flag, what do you think about --tunnel mode? For users that could explain things a bit better.

r0mant · 2022-04-06T16:32:14Z

@klizhentas Sounds good, I will rename.

r0mant · 2022-04-06T18:07:59Z

what happens when "mtls" is used against older servers?

@greedy52 It will work for Mongo/Redis/MSSQL because those already use mutual TLS but not for Postgres/MySQL because older servers don't support plain connections through the TLS tunnel.

ravicious

I tested this on a Postgres db through Teleterm and it works like a charm.

In the future (after the Teleterm preview release) we might remove the concept of a "gateway" in Teleterm in favor of just running tsh proxy db underneath. Though the current gateway system also executes the equivalent of tsh db login, so we'll see.

@smallinsky

As described in gravitational/webapps.e#177, we want to replace the db tab with just two sections: * "Connect with CLI" which will show the command to use in terminal * "Connect with GUI" which links to our documentation After gravitational/teleport#11720 gets merged, the "Connect with CLI" section will be massively simplified: it'll be basically just something like: psql postgres://localhost:12345 Moreover, @smallinsky suggested that tsh should be responsible for creating those CLI connection commands. We should also do this in the future as it'll let us support new protocols as soon as they land in tsh, without us having to touch Teleterm codebase, for the most part.

@smallinsky

As described in gravitational/webapps.e#177, we want to replace the db tab with just two sections: * "Connect with CLI" which will show the command to use in terminal * "Connect with GUI" which links to our documentation After gravitational/teleport#11720 gets merged, the "Connect with CLI" section will be massively simplified: it'll be basically just something like: psql postgres://localhost:12345 Moreover, @smallinsky suggested that tsh should be responsible for creating those CLI connection commands. We should also do this in the future as it'll let us support new protocols as soon as they land in tsh, without us having to touch Teleterm codebase, for the most part.

@smallinsky

* Limit navigation capabilities to reduce attack surface At the moment we don't create new windows nor navigate away from the rendered app, so we can just block everything. * Update to electron@13.6.9 (#703) * Use x64 arch when building & packaging Teleterm Our build system doesn't support arm64 for Mac releases yet (see issue gravitational/teleport#4226 for more information). Because of that, for the preview release we're likely going to have only the x64 version of Teleterm. This means that the shipped version of tsh should also be the x64 version. I tried to change electron-builder's config to use x64 for macOS, but the config options don't seem to work. I tried `mac.defaultArch` as well as changing `mac.target` in various ways but `electron-builder install-app-deps` just doesn't pick up those options. Both were set through `packages/teleterm/package.json` * Add `Notifications` component and service * Show errors in `ClusterResources`' tables using standard `Danger` labels * Use `Notifications` error in `syncRootCluster()` and `removeGateway()` * Do not block app rendering when initializing function fails * Fix accessing `serversSyncStatus` Map in `clustersService` * Revert "Use x64 arch when building & packaging Teleterm" This reverts commit 276e9a9. Turns out that for development, we need to use arm64 version of native deps. The build server is going to use x64 anyway, as per the reverted commit, but when making manual demo builds, we'll have to remember to use x64 for Teleterm and tsh. * Submit modals' forms on `Enter` press * Remove global `keyDown` handler from `KeyboardArrowsNavigation` as it blocked submitting forms * Use teleterm/logger in runtimeSettings (#716) The one from shared/libs/logger calls `window`, which doesn't exist in the context of Electron main process. * Improve Teleterm README (#719) * Mention that `yarn build-term` needs to be run first before attempting to run the app in dev mode (already had a couple of people who had problems with setting up the app because they didn't run this first). * Mention the assumption about both repos living in the same folder. * Move the architecture diagram to the end of the file. Most people reading the README are not doing it for the diagram, but build instructions. * Explain when gRPC files need to be recompiled. * Prevent crash when network or cluster is offline (#712) * Simplify the db connection tab (#720) As described in gravitational/webapps.e#177, we want to replace the db tab with just two sections: * "Connect with CLI" which will show the command to use in terminal * "Connect with GUI" which links to our documentation After gravitational/teleport#11720 gets merged, the "Connect with CLI" section will be massively simplified: it'll be basically just something like: psql postgres://localhost:12345 Moreover, @smallinsky suggested that tsh should be responsible for creating those CLI connection commands. We should also do this in the future as it'll let us support new protocols as soon as they land in tsh, without us having to touch Teleterm codebase, for the most part. * Resolve shell env (#718) Co-authored-by: Grzegorz Zdunek <gzdunek@users.noreply.github.com> Co-authored-by: Grzegorz Zdunek <grzegorz.zdunek@goteleport.com>

#11720 was backported to v9, but at that time Teleport Connect wasn't backported to v9, so the changes to gateway.go were dropped. This PR reintroduces them, as without that part it's not possible to open db connections when running Teleport Connect from the v9 branch.

@smallinsky

As described in gravitational/webapps.e#177, we want to replace the db tab with just two sections: * "Connect with CLI" which will show the command to use in terminal * "Connect with GUI" which links to our documentation After gravitational#11720 gets merged, the "Connect with CLI" section will be massively simplified: it'll be basically just something like: psql postgres://localhost:12345 Moreover, @smallinsky suggested that tsh should be responsible for creating those CLI connection commands. We should also do this in the future as it'll let us support new protocols as soon as they land in tsh, without us having to touch Teleterm codebase, for the most part.

@smallinsky

As described in gravitational/webapps.e#177, we want to replace the db tab with just two sections: * "Connect with CLI" which will show the command to use in terminal * "Connect with GUI" which links to our documentation After #11720 gets merged, the "Connect with CLI" section will be massively simplified: it'll be basically just something like: psql postgres://localhost:12345 Moreover, @smallinsky suggested that tsh should be responsible for creating those CLI connection commands. We should also do this in the future as it'll let us support new protocols as soon as they land in tsh, without us having to touch Teleterm codebase, for the most part.

r0mant requested review from ravicious, greedy52 and smallinsky April 5, 2022 02:39

github-actions bot added database-access Database access related issues and PRs tsh tsh - Teleport's command line tool for logging into nodes running Teleport. labels Apr 5, 2022

github-actions bot requested review from probakowski and timothyb89 April 5, 2022 02:39

r0mant removed request for timothyb89 and probakowski April 5, 2022 02:40

ravicious added the teleterm-backport label Apr 5, 2022

ravicious mentioned this pull request Apr 5, 2022

Simplify the db connection tab gravitational/webapps#720

Merged

smallinsky approved these changes Apr 5, 2022

View reviewed changes

tool/tsh/proxy.go Outdated Show resolved Hide resolved

lib/srv/db/proxyserver.go Outdated Show resolved Hide resolved

lib/srv/db/mysql/proxy.go Outdated Show resolved Hide resolved

r0mant force-pushed the roman/proxy branch from 037c648 to fc1be78 Compare April 5, 2022 20:03

greedy52 approved these changes Apr 6, 2022

View reviewed changes

r0mant force-pushed the roman/proxy branch from be18100 to 442a70c Compare April 6, 2022 16:55

r0mant changed the title ~~Add "mtls" mode to tsh proxy db~~ Add "tunnel" mode to tsh proxy db Apr 6, 2022

Add auth'd tunnel mode to tsh proxy db command

a989544

r0mant force-pushed the roman/proxy branch from 4177400 to a989544 Compare April 6, 2022 22:01

ravicious approved these changes Apr 7, 2022

View reviewed changes

Merge branch 'master' into roman/proxy

f1a8853

r0mant enabled auto-merge (squash) April 7, 2022 17:00

r0mant merged commit 97c0b5c into master Apr 7, 2022

r0mant deleted the roman/proxy branch April 7, 2022 18:33

r0mant added a commit that referenced this pull request Apr 7, 2022

Add auth'd tunnel mode to tsh proxy db command (#11720)

62fe977

r0mant mentioned this pull request Apr 7, 2022

(v9) Add auth'd tunnel mode to tsh proxy db command #11808

Merged

r0mant added a commit that referenced this pull request Apr 7, 2022

Add auth'd tunnel mode to tsh proxy db command (#11720) (#11808)

64bfe84

ravicious mentioned this pull request Apr 8, 2022

Generate DB CLI commands for Teleterm from tsh daemon #11835

Merged

This was referenced Apr 14, 2022

Some GUI database clients require DER private key #6116

Closed

Update DBeaver guides to use authenticated local proxy. #12037

Merged

webvictim mentioned this pull request Apr 19, 2022

opened in error #12068

Closed

ravicious removed the teleconnect-backport label Apr 25, 2022

ravicious mentioned this pull request Apr 28, 2022

[v9] Backport Teleport Connect gateway changes from #11720 #12297

Merged

webvictim mentioned this pull request Jun 8, 2022

Opened in error #13285

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add "tunnel" mode to tsh proxy db #11720

Add "tunnel" mode to tsh proxy db #11720

r0mant commented Apr 5, 2022 •

edited

Loading

ravicious commented Apr 5, 2022

greedy52 left a comment

greedy52 Apr 6, 2022

r0mant Apr 6, 2022

klizhentas commented Apr 6, 2022

r0mant commented Apr 6, 2022

r0mant commented Apr 6, 2022

ravicious left a comment

		Use the following command to connect to the database:
		$ {{.command}}

Add "tunnel" mode to tsh proxy db #11720

Add "tunnel" mode to tsh proxy db #11720

Conversation

r0mant commented Apr 5, 2022 • edited Loading

ravicious commented Apr 5, 2022

greedy52 left a comment

Choose a reason for hiding this comment

greedy52 Apr 6, 2022

Choose a reason for hiding this comment

r0mant Apr 6, 2022

Choose a reason for hiding this comment

klizhentas commented Apr 6, 2022

r0mant commented Apr 6, 2022

r0mant commented Apr 6, 2022

ravicious left a comment

Choose a reason for hiding this comment

r0mant commented Apr 5, 2022 •

edited

Loading