Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Change default port order to 443, 3080 #4924

Closed
klizhentas opened this issue Nov 19, 2020 · 7 comments
Closed

Change default port order to 443, 3080 #4924

klizhentas opened this issue Nov 19, 2020 · 7 comments
Assignees
@tcsc
Labels
tsh tsh - Teleport's command line tool for logging into nodes running Teleport. ux
Milestone
7.0 "Stockholm"

Comments

@klizhentas
Copy link
Contributor

Feature Request

tsh login --proxy=example.com by default tries 3080 and then 443. The problem is that most of the time 3080 is blocked,
and the above command will hang before trying next port 443. Why don't we switch the order of ports, with 443 being the default, and 3080 a fallback.

Motivation

This will improve UX for everyone
@klizhentas klizhentas added this to the 5.1 "San Diego" milestone Nov 19, 2020
@klizhentas klizhentas added the ux label Nov 19, 2020
@sskousen
Copy link

Not sure if it would be possible, but using the Happy Eyeballs algorithm (https://tools.ietf.org/html/rfc8305), used for IPv4/IPv6, could give the best of both worlds. Basically, send a request on both 443 and 3080, and see which one comes back first (and is a valid teleport endpoint).

I was also bitten by the default 3080 thing, and switched from 443 just to make my developers' lives easier.

@russjones russjones added the tsh tsh - Teleport's command line tool for logging into nodes running Teleport. label Nov 24, 2020
@russjones russjones modified the milestones: 6.0 "San Diego", 6.1 Jan 26, 2021
@russjones russjones modified the milestones: 6.1, Runway Milestone Feb 3, 2021
@russjones russjones modified the milestones: Runway Milestone, 7.0 Mar 10, 2021
@benarent benarent mentioned this issue Mar 18, 2021
Closed
@tcsc
Copy link
Contributor

tcsc commented Mar 30, 2021

Useful debugging tip: drop packets to 3080 on the loopback:

$ [sudo] iptables -I INPUT -i lo -p tcp --dport 3080 -j DROP

@tcsc
Copy link
Contributor

tcsc commented Mar 30, 2021

Does this fallback behaviour still exist in teleport >= 6? When I run the current master it looks to time out on 3080 and then bail without trying anything else:

$ build/tsh login --insecure --proxy=localhost -d
DEBU [CLIENT]    open /home/trent/.tsh/localhost.yaml: no such file or directory client/api.go:719
INFO [CLIENT]    No teleport login given. defaulting to trent client/api.go:973
INFO [CLIENT]    no host login given. defaulting to trent client/api.go:983
INFO [CLIENT]    [KEY AGENT] Connected to the system agent: "/run/user/1000/keyring/ssh" client/api.go:2618
DEBU [CLIENT]    attempting to use loopback pool for local proxy addr: localhost:3080 client/api.go:2582
DEBU [CLIENT]    could not open any path in: /var/lib/teleport/webproxy_cert.pem client/api.go:2588

ERROR REPORT:
Original Error: *url.Error Get "https://localhost:3080/webapi/ping": dial tcp 127.0.0.1:3080: connect: connection timed out
Stack Trace:
        /home/trent/work/teleport/vendor/github.com/gravitational/teleport/api/client/webclient.go:80 github.com/gravitational/teleport/api/client.Ping
        /home/trent/work/teleport/lib/client/api.go:2230 github.com/gravitational/teleport/lib/client.(*TeleportClient).Ping
        /home/trent/work/teleport/lib/client/api.go:2102 github.com/gravitational/teleport/lib/client.(*TeleportClient).Login
        /home/trent/work/teleport/tool/tsh/tsh.go:750 main.onLogin
        /home/trent/work/teleport/tool/tsh/tsh.go:547 main.Run
        /home/trent/work/teleport/tool/tsh/tsh.go:256 main.main
        /usr/local/go/src/runtime/proc.go:225 runtime.main
        /usr/local/go/src/runtime/asm_amd64.s:1371 runtime.goexit
User Message: Get "https://localhost:3080/webapi/ping": dial tcp 127.0.0.1:3080: connect: connection timed out

@yusufharip
Copy link

yusufharip commented Mar 31, 2021 •
edited
Loading

Hi @tcsc how to setup the config to enable accessing web UI without using port in the end of url?

current --> https://teleport.myteam.com:3080
to be --> https://teleport.myteam.com

Is it possible right now?

tcsc added a commit that referenced this issue Apr 9, 2021
@tcsc
Adds concurrent default-port selection to tsh
0870a54 
Addresses issue #4924

If a default Web Proxy port is not specified by the user, either via
config or on the command line, `tsh` defaults to `3080`. Unfortunately
`3080` is often blocked by firewalls, leading to an unacceptably long
timeout for the user.

This change adds an RFC8305-like default-port selection algorithm,
that will try multiple ports on the supplied host concurrently and
select the most reponsive address to use for Web Proxy traffic. I
have included the standard HTTPS port (443) in the defaulut set,
and this can be easily expanded if other good candidates come along.

If the port selection fails for any reason, `tsh` reverts to the
legacy behaviour of picking `3080` automatically.
@tcsc tcsc mentioned this issue Apr 9, 2021
Merged
tcsc added a commit that referenced this issue Apr 12, 2021
@tcsc
Adds concurrent default-port selection to tsh
20eb18f 
Addresses issue #4924

If a default Web Proxy port is not specified by the user, either via
config or on the command line, `tsh` defaults to `3080`. Unfortunately
`3080` is often blocked by firewalls, leading to an unacceptably long
timeout for the user.

This change adds an RFC8305-like default-port selection algorithm,
that will try multiple ports on the supplied host concurrently and
select the most reponsive address to use for Web Proxy traffic. I
have included the standard HTTPS port (443) in the defaulut set,
and this can be easily expanded if other good candidates come along.

If the port selection fails for any reason, `tsh` reverts to the
legacy behaviour of picking `3080` automatically.
tcsc added a commit that referenced this issue Apr 15, 2021
@tcsc
Adds concurrent default-port selection to tsh
231a7b2 
Addresses issue #4924

If a default Web Proxy port is not specified by the user, either via
config or on the command line, `tsh` defaults to `3080`. Unfortunately
`3080` is often blocked by firewalls, leading to an unacceptably long
timeout for the user.

This change adds an RFC8305-like default-port selection algorithm,
that will try multiple ports on the supplied host concurrently and
select the most reponsive address to use for Web Proxy traffic. I
have included the standard HTTPS port (443) in the defaulut set,
and this can be easily expanded if other good candidates come along.

If the port selection fails for any reason, `tsh` reverts to the
legacy behaviour of picking `3080` automatically.
tcsc added a commit that referenced this issue Apr 20, 2021
@tcsc
Adds concurrent default-port selection to tsh
12a2872 
Addresses issue #4924

If a default Web Proxy port is not specified by the user, either via
config or on the command line, `tsh` defaults to `3080`. Unfortunately
`3080` is often blocked by firewalls, leading to an unacceptably long
timeout for the user.

This change adds an RFC8305-like default-port selection algorithm,
that will try multiple ports on the supplied host concurrently and
select the most reponsive address to use for Web Proxy traffic. I
have included the standard HTTPS port (443) in the defaulut set,
and this can be easily expanded if other good candidates come along.

If the port selection fails for any reason, `tsh` reverts to the
legacy behaviour of picking `3080` automatically.
@nklaassen
Copy link
Contributor

Hi @yusufharip. To avoid specifying the port number in the url, you will need to configure your teleport proxy to listen on the standard https port 443.

For this example, you would need a config like:

...
proxy_service:
  public_addr: teleport.myteam.com:443
  web_listen_addr: 0.0.0.0:443

You can check our configuration reference for more details.

@yusufharip
Copy link

Thanks @nklaassen work perfectly.

tcsc added a commit that referenced this issue May 4, 2021
@tcsc
Adds concurrent default-port selection to tsh
d006bf2 
Addresses issue #4924

If a default Web Proxy port is not specified by the user, either via
config or on the command line, `tsh` defaults to `3080`. Unfortunately
`3080` is often blocked by firewalls, leading to an unacceptably long
timeout for the user.

This change adds an RFC8305-like default-port selection algorithm,
that will try multiple ports on the supplied host concurrently and
select the most reponsive address to use for Web Proxy traffic. I
have included the standard HTTPS port (443) in the defaulut set,
and this can be easily expanded if other good candidates come along.

If the port selection fails for any reason, `tsh` reverts to the
legacy behaviour of picking `3080` automatically.
russjones pushed a commit that referenced this issue May 14, 2021
@tcsc @russjones
Adds concurrent default-port selection to tsh
17ffe33 
Addresses issue #4924

If a default Web Proxy port is not specified by the user, either via
config or on the command line, `tsh` defaults to `3080`. Unfortunately
`3080` is often blocked by firewalls, leading to an unacceptably long
timeout for the user.

This change adds an RFC8305-like default-port selection algorithm,
that will try multiple ports on the supplied host concurrently and
select the most reponsive address to use for Web Proxy traffic. I
have included the standard HTTPS port (443) in the defaulut set,
and this can be easily expanded if other good candidates come along.

If the port selection fails for any reason, `tsh` reverts to the
legacy behaviour of picking `3080` automatically.
russjones pushed a commit that referenced this issue May 14, 2021
@tcsc @russjones
Adds concurrent default-port selection to tsh
9e86006 
Addresses issue #4924

If a default Web Proxy port is not specified by the user, either via
config or on the command line, `tsh` defaults to `3080`. Unfortunately
`3080` is often blocked by firewalls, leading to an unacceptably long
timeout for the user.

This change adds an RFC8305-like default-port selection algorithm,
that will try multiple ports on the supplied host concurrently and
select the most reponsive address to use for Web Proxy traffic. I
have included the standard HTTPS port (443) in the defaulut set,
and this can be easily expanded if other good candidates come along.

If the port selection fails for any reason, `tsh` reverts to the
legacy behaviour of picking `3080` automatically.
russjones pushed a commit that referenced this issue May 15, 2021
@tcsc @russjones
Adds concurrent default-port selection to tsh
db8dfe5 
Addresses issue #4924

If a default Web Proxy port is not specified by the user, either via
config or on the command line, `tsh` defaults to `3080`. Unfortunately
`3080` is often blocked by firewalls, leading to an unacceptably long
timeout for the user.

This change adds an RFC8305-like default-port selection algorithm,
that will try multiple ports on the supplied host concurrently and
select the most reponsive address to use for Web Proxy traffic. I
have included the standard HTTPS port (443) in the defaulut set,
and this can be easily expanded if other good candidates come along.

If the port selection fails for any reason, `tsh` reverts to the
legacy behaviour of picking `3080` automatically.
@russjones
Copy link
Contributor

Fixed in Teleport 6.2.

@inertial-frame inertial-frame mentioned this issue Jun 15, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tcsc tcsc

Labels
tsh tsh - Teleport's command line tool for logging into nodes running Teleport. ux
Projects
None yet
Milestone
7.0 "Stockholm"
Development

No branches or pull requests
6 participants
@klizhentas @tcsc @sskousen @russjones @nklaassen @yusufharip