Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

scp to agentless nodes allowed in spite of RBAC denial #24949

Closed
nklaassen opened this issue Apr 20, 2023 · 0 comments · Fixed by #25012
Closed

scp to agentless nodes allowed in spite of RBAC denial #24949

nklaassen opened this issue Apr 20, 2023 · 0 comments · Fixed by #25012
Assignees
Labels
agentless bug scp test-plan-problem Issues which have been surfaced by running the manual release test plan

Comments

@nklaassen
Copy link
Contributor

Expected behavior:

When ssh_file_copy is set to false in a user's role, they are blocked from using tsh scp for any target node, including agentless nodes.

Current behavior:

tsh scp and OpenSSH scp both work to copy files to/from agentless nodes without error.
The action is correctly denied for teleport nodes.

I'm not sure if it's technically even possible to block file copies, but the test plan indicates the expected behaviour is to block it. So we should either fix this or update the test plan (and docs).

Bug details:

  • Teleport version: v13.0.0-alpha.1
  • Recreation steps: Create an agentless node. Create a role with ssh_file_copy: false. Assign the role to a user and try tsh scp file user@agentless-node:
  • Debug logs
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
agentless bug scp test-plan-problem Issues which have been surfaced by running the manual release test plan
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants