Teleport 10 is a major release that brings the following new features.
Platform:
- Passwordless (Preview)
- Resource Access Requests (Preview)
- Proxy Peering (Preview)
Server Access:
- IP-Based Restrictions (Preview)
- Automatic User Provisioning (Preview)
Database Access:
- Audit Logging for Microsoft SQL Server Database Access
- Snowflake Database Access (Preview)
- ElastiCache/MemoryDB Database Access (Preview)
Teleport Connect:
- Teleport Connect for Server and Database Access (Preview)
Machine ID:
- Machine ID Database Access Support (Preview)
Teleport 10 introduces passwordless support to your clusters. To use passwordless users may register a security key with resident credentials or use a built-in authenticator, like Touch ID.
See https://goteleport.com/docs/access-controls/guides/passwordless/.
Teleport 10 expands just-in-time access requests to allow for requesting access to specific resources. This lets you grant users the least privileged access needed for their workflows.
Just-in-time access requests are only available in Teleport Enterprise Edition.
Proxy peering enables Teleport deployments to scale without an increase in load from the number of agent connections. This is accomplished by allowing Proxy Services to tunnel client connections to the desired agent through a neighboring proxy and decoupling the number of agent connections from the number of Proxies.
Proxy peering can be enabled with the following configurations:
auth_service:
tunnel_strategy:
type: proxy_peering
agent_connection_count: 1proxy_service:
peer_listen_addr: 0.0.0.0:3021Network connectivity between proxy servers to the peer_listen_addr is required
for this feature to work.
Proxy peering is only available in Teleport Enterprise Edition.
Teleport 10 introduces a new role option to pin the source IP in SSH certificates. When enabled, the source IP that was used to request certificates is embedded in the certificate, and SSH servers will reject connection attempts from other IPs. This protects against attacks where valid credentials are exfiltrated from disk and copied out into other environments.
IP-based restrictions are only available in Teleport Enterprise Edition.
Teleport 10 can be configured to automatically create Linux host users upon login without having to use Teleport's PAM integration. Users can be added to specific Linux groups and assigned appropriate “sudoer” privileges.
To learn more about configuring automatic user provisioning read the guide: https://goteleport.com/docs/server-access/guides/host-user-creation/.
Teleport 9 introduced a preview of Database Access support for Microsoft SQL Server which didn’t include audit logging of user queries. Teleport 10 captures users' queries and prepared statements and sends them to the audit log, similarly to other supported database protocols.
Teleport Database Access for SQL Server remains in Preview mode with more UX improvements coming in future releases.
Refer to the guide to set up access to a SQL Server with Active Directory authentication: https://goteleport.com/docs/database-access/guides/sql-server-ad/.
Teleport 10 brings support for Snowflake to Database Access. Administrators can set up access to Snowflake databases through Teleport for their users with standard Database Access features like role-based access control and audit logging, including query activity.
Connect your Snowflake database to Teleport following this guide: https://goteleport.com/docs/database-access/guides/snowflake/.
Teleport 9 added Redis protocol support to Database Access. Teleport 10 improves this integration by adding native support for AWS-hosted Elasticache and MemoryDB, including auto-discovery and automatic credential management in some deployment configurations.
Learn more about it in this guide: https://goteleport.com/docs/database-access/guides/redis-aws/.
Teleport Connect is a graphical macOS application that simplifies access to your Teleport resources. Teleport Connect 10 supports Server Access and Database Access. Other protocols and Windows support are coming in a future release.
Get Teleport Connect installer from the macOS tab on the downloads page: https://goteleport.com/download/.
In Teleport 10 we’ve added Database Access support to Machine ID. Applications can use Machine ID to access databases protected by Teleport.
You can find Machine ID guide for database access in the documentation: https://goteleport.com/docs/machine-id/guides/databases/.
Please familiarize yourself with the following potentially disruptive changes in Teleport 10 before upgrading.
Teleport 10 agents will now refuse to start if they detect that the Auth Service
is more than one major version behind them. You can use the --skip-version-check flag to
bypass the version check.
Take a look at component compatibility guarantees in the documentation: https://goteleport.com/docs/setup/operations/upgrading/#component-compatibility.
Reverse tunnel connections will now respect HTTP_PROXY environment variables.
This may result in reverse tunnel agents not being able to re-establish
connections if the HTTP proxy is set in their environment and does not allow
connections to the Teleport Proxy Service.
Refer to the following documentation section for more details: https://goteleport.com/docs/setup/reference/networking/#http-connect-proxies.
With Teleport 10 we’ve migrated to new APT repositories that now support multiple release channels, Teleport versions and OS distributions. The new repositories have been backfilled with Teleport versions starting from 6.2.31 and we recommend upgrading to them. The old repositories will be maintained for the foreseeable future.
See updated installation instructions: https://goteleport.com/docs/server-access/getting-started/#step-14-install-teleport-on-your-linux-host.
The tctl access ls command that returned information about user server access
within the cluster was removed. Please use a previous tctl version if you’d like
to keep using it.
In previous versions of Teleport users needed full access to a Node/Kubernetes
pod in order to join a session. Teleport 10 relaxes this requirement. Joining
sessions remains deny-by-default but now only join_policy statements are
checked for session join RBAC.
See the Moderated Sessions guide for more details: https://goteleport.com/docs/access-controls/guides/moderated-sessions/.
The GitHub authentication connector’s teams_to_logins field is deprecated in favor of the new
teams_to_roles field. The old field will be removed in a future release.
Teleport 10 will now automatically use FIPS endpoints for AWS S3 and DynamoDB
when started with the --fips flag. You can use the use_fips_endpoint=false
connection endpoint option to use regular endpoints for Teleport in FIPS mode,
for example:
s3://bucket/path?region=us-east-1&use_fips_endpoint=false
See the S3/DynamoDB backends documentation for more information: https://goteleport.com/docs/setup/reference/backends/#s3.
This release of Teleport contains a security fix, as well as multiple improvements and bug fixes.
When checking a user’s roles prior to starting a session, Teleport may have incorrectly allowed a session to proceed without moderation depending on the order roles are received from the backend.
- Fixed issue with per-session MFA swallowing keypresses. #13822
- Fixed issue with
tsh db ls -Rnow showing allowed users. #13626 - Fixed vertical and horizontal scroll in desktop access. #13905
- Fixed issue with invalid query filters forcing
tshrelogin. #13747 - Fixed issue with TLS routing and proxy jump. #13928
- Fixed issue with MongoDB connections timing out in certain scenarios. #13859
- Fixed issue with Machine ID certificate renewal with empty requested roles. #13893
- Fixed issue with Windows desktops not being labeled with LDAP attribute labels. #13681
- Fixed issue with desktop access streaming not being terminated properly. #14024
- Added ability to use FIPS endpoints for S3 and DynamoDB using
use_fips_endpointconnection option. #13703 - Added ability to specify CA pin as a file path in the config. #13089
- Improved reconnect reliability after root proxy restart. #13967
- Improved error messages for failed auth client connections. #13835
This release of Teleport contains multiple improvements and bug fixes.
- Fixed issue with startup delay caused by AWS EC2 check. #13167
- Added
tsh ls -Rthat displays resources across all clusters and profiles. #13313 - Fixed issue with
tshnot correctly reporting "address in use" error during port forwarding. #13679 - Fixed two potential panics. #13590, #13655
- Fixed issue with enhanced session recording not working on recent Ubuntu versions. #13650
- Fixed issue with CA rotation when Database Service does not contain any databases. #13517
- Fixed issue with Desktop Access connection failing with "invalid channel name rdpsnd" error. #13450
- Fixed issue with invalid Teleport config when enabling IMDSv2 in Terraform config. #13537
This release of Teleport contains multiple improvements and bug fixes.
- Added Unicode clipboard support to Desktop Access. #13391
- Fixed backwards compatibility issue with fetch access requests from older servers. #13490
- Fixed issue with Application Access requests periodically failing with 500 errors. #13469
- Fixed issues with pagination when displaying applications. #13451
- Fixed file descriptor leak in Machine ID. #13386
This release of Teleport contains multiple improvements and bug fixes.
- Fixed backwards compatibility issue with fetching access requests from older servers. #13428
- Fixed issue with using Microsoft SQL Server Management Studio with Database Access. #13337
- Added support for
tsh proxy ssh -Jto improve interoperability with OpenSSH clients. #13311 - Added ability to provide security context in Helm charts. #13286
- Added Application and Database Access support to reference AWS Terraform deployment. #13383
- Improved reliability of dialing Auth Server through the Proxy. #13399
- Improved
kubectl execauditing by logging access denied attempts. #12831, #13400
This release of Teleport contains multiple security, bug fixes and improvements.
When setting up agent forwarding on the node, Teleport did not handle unix socket creation in a secure manner.
This could have given a potential attacker an opportunity to get Teleport to change arbitrary file permissions to the attacker’s user.
When handling websocket requests, Teleport did not verify that the provided Bearer token was generated for the correct user.
This could have allowed a malicious low privileged Teleport user to use a social engineering attack to gain higher privileged access on the same Teleport cluster.
When accepting an access request, Teleport did not enforce the maximum request reason size.
This could allow a malicious actor to mount a DoS attack by creating an access request with a very large request reason.
When initializing a moderated session, Teleport did not discard participant’s input prior to the moderator joining.
This could prevent a moderator from being able to interrupt a malicious command executed by a participant.
- Fixed issue with stdin hijacking when per-session MFA is enabled. #13212
- Added support for automatic tags import when running on AWS EC2. #12593
- Added ability to use multiple redirect URLs in OIDC connectors. #13046
- Fixed issue with ANSI escape sequences being broken when using
tshon Windows. #13221 - Fixed issue with
tsh sshprinting extra error upon exit if last command was unsuccessful. #12903 - Added support for Proxy Protocol v2 in MySQL proxy. #12993
- Upgraded to Go
v1.17.11. #13104 - Added Windows desktops labeling based on their LDAP attributes. #13238
- Improved performance when listing resources for users with many roles. #13263
This release of Teleport contains two bug fixes.
- Fixed issue with Machine ID's
tshversion check. #13037 - Fixed AWS related log spam in database agent when not running on AWS. #12984
This release of Teleport contains multiple improvements and bug fixes.
- Fixed issue with
tctlnot takingTELEPORT_HOMEenvironment variable into account. #12738 - Fixed issue with Redis
AUTHcommand not always authenticating the user in database access. #12754 - Fixed issue with Teleport not starting with deprecated U2F configuration. #12826
- Fixed issue with
tsh db lsnot showing allowed users for leaf clusters. #12853 - Fixed issue with
teleport configurefailing when given non-existent data directory. #12806 - Fixed issue with
tctlnot outputting debug logs. #12920 - Fixed issue with Kubernetes access not working when using default CA pool. #12874
- Fixed issue with Machine ID not working in TLS routing mode. #12990
- Improved connection performance in large clusters. #12832
- Improved memory usage in large clusters. #12724
Teleport 9.3.0 reduces the minimum GLIBC requirement to 2.18 and enforces more secure cipher suites for desktop access.
As a result of these changes, desktop access users with desktops running Windows Server 2012R2 will need to perform additional configuration to force Windows to use commpatible cipher suites.
Windows desktops running Windows Server 2016 and newer will continue to operate normally - no additional configuration is required.
This release of Teleport contains multiple improvements and bug fixes.
- Fixed compatibility issue with agents connected to older auth servers. #12728
- Fixed issue with TLS routing endpoint advertising preference for
http/1.1overh2. #12749 - Implemented multiple proxy restart stability improvements. #12632, #12488, #12689
- Improved compatibility with PuTTY. #12662
- Added support for global tsh config file
/etc/tsh.yaml. #12626 - Added
tbot configurecommand. #12576 - Fixed issue with Desktop Access not working in Teleport Cloud. #12781
- Improved Web UI performance in large clusters. #12637
- Fixed issue with running MySQL stored procedures via Database Access. #12734
This release of Teleport contains multiple improvements and bug fixes.
- Fixed issue with
HTTP_PROXYbeing inadvertently respected in reverse tunnel connections. #12335 - Added
--formatflag totctl token addcommand. #12588 - Fixed backwards compatibility issues with session upload. #12535
- Added support for persistency in custom mode in Helm charts. #12218
- Fixed issue with PostgreSQL backend not respecting username from certificate. #12553
- Fixed issues with
kubectl cpandkubectl execnot working through Kubernetes Access. #12541 - Fixed issues with dynamic registration logic for cloud databases. #12451
- Fixed issue with automatic Add Application script failing to join the cluster. #12539
- Fixed issue with
tctlcrashing when PAM is enabled. #12572 - Added support for setting priority class and extra labels in Helm charts. #12568
- Fixed issue with App Access JWT tokens not including
iatclaim. #12589 - Added ability to inject App Access JWT tokens in rewritten headers. #12589
- Desktop Access automatically adds a
teleport.dev/oulabel for desktops discovered via LDAP. #12502 - Updated Machine ID to generates identity files compatible with
tctlandtsh. #12500 - Updated internal build infrastructure to Go 1.17.10. #12607
- Improved proxy memory usage in clusters with large number of nodes. #12573
This release of Teleport contains an improvement and several bug fixes.
- Updated
tctl rmcommand to support removing tokens. #12439 - Fixed issue with Teleport failing to start when using DynamoDB backend in pay-per-request mode. #12461
- Fixed issue with Kubernetes port forwarding not working. #12468
- Fixed issue with IAM policy limit when using database auto-discovery on Kubernetes. #12457
This release of Teleport contains multiple improvements, security and bug fixes.
- Fixed issue with U2F facets not being properly validated. #12208
- Hardened SQLite permissions. #12360
- Fixed issue with OIDC callback not checking
email_verifiedclaim. #12360 - Added
max_kubernetes_connectionsrole option for limiting simultaneous Kubernetes connections. #12360 - Fixed issue with Teleport failing to start with pay-per-request DynamoDB mode. #12360
- Reduced Machine ID verbosity in case of missing secure symlink kernel support. #12423
- Fixed
tsh proxy dbtunnel mode not working for CockroachDB connections. #12400 - Added support for database access certificates in Machine ID. #12195
- Improved shutdown/restart stability in certain scenarios. #12393
- Added support for clickable labels in web UI. #12422
This release of Teleport contains multiple improvements and bug fixes.
- Fixed issue with some MySQL clients not being able to connect to MySQL 8.0 servers. #12340
- Fixed multiple conditions that could lead to SSH sessions freezing. #12286
- Fixed issue with
tsh db lsfailing for leaf clusters. #12320 - Fixed a scenario in which Teleport's internal cache could potentially become unhealthy. #12251, #12002
- Improved performance when opening new Application Access sessions. #12300
- Added flags to the
teleport configurecommand. #12267 - Improved CA rotation stability. #12333
- Fixed issue with
mongoshcertificate verification when using TLS routing. #12363
This release of Teleport contains two bug fixes.
- Fixed issue with Teleport pods not becoming ready on Kubernetes. #12243
- Fixed issue with Teleport processes crashing upon restart after failed host UUID generation. #12222
This release of Teleport contains multiple bug fixes and improvements.
- Fixed regression issue where reverse tunnel connections inadvertently started respecting
HTTP_PROXY. #12035 - Fixed potential deadlock in SSH server. #12122
- Fixed issue with Kubernetes service not reporting its readiness. #12152
- Fixed issue with JumpCloud identity provider. #11936
- Fixed issue with deleting many records from Firestore backend. #12177
Teleport 9.1 is a minor release that brings several new features, security and bug fixes.
Teleport build infrastructure was updated to use Go v1.17.9 to fix CVE-2022-24675, CVE-2022-28327 and CVE-2022-27536.
Teleport users can now use PostgreSQL or CockroachDB for storing auth server data.
See the documentation for more information:
https://goteleport.com/docs/setup/reference/backends/#postgresqlcockroachdb-preview
Searching and filtering resources is now handled on the server, improving the
efficiency of queries with tsh, tctl, or the web UI.
The web UI loads resources faster by leveraging server-side pagination. Additionally, the web UI supports bookmarking searches by including the query in the URL.
- Fixed issue with stdin being ignored after refreshing expired credentials. #11847
- Fixed issue with
tshrequiring host login when using identity files for some commands. #11793 - Added support for calling proxy over plain HTTP in insecure mode. #11403
- Fixed multiple issues that could lead to sessions output freezing. #11853
- Added optional gRPC client/server latency metrics. #11773
- Fixed issue with connecting to self-hosted databases in TLS insecure mode. #11758
- Improved error message when incorrect auth connector name is used. #11884
- Implemented multiple moderated session stability improvements. #11803, #11890
- Added authenticated tunnel mode to
tsh proxy dbcommand. #11808 - Fixed issue with application sessions not being deleted upon web logout. #11956
- Improved MySQL audit logging to include support for additional commands. #11949
- Improved reliability of Teleport services restart. #11795
- Fixed issue with Okta OIDC auth connector not working. #11718
- Added support for
jsonandyamlformatting to alltshcommands. #12050 - Added support for setting
kubernetes_users,kubernetes_groups,db_names,db_usersandaws_role_arnstraits when creating users. #12133 - Fixed potential CA rotation panic. #12004
- Updated
tsh db lsto display allowed database usernames. #11942 - Fixed goroutine leak in OIDC client. #12078
This release of Teleport contains multiple improvements and fixes.
- Fixed issue with
:not being allowed in label keys. #11563 - Fixed potential panic in Kubernetes Access. #11614
- Added
teleport_connect_to_node_attempts_totalPrometheus metric. #11629 - Multiple CA rotation stability improvements. #11658
- Fixed console player Ctrl-C and Ctrl-D functionality. #11559
- Improved logging in case of node with existing state joining an new cluster. #11751
- Added preview of PostgreSQL/CockroachDB backend. #11667
- Fixed compatibility issues with CA loading between old and new tsh versions. #11663
- Fixed loggers not respecting JSON configuration. #11655
- Added support for Proxy Protocol v2. #11722
- Fixed a number of tsh player stability issues. #11491
- Improved network utilization caused by session uploader. #11698
- Improved remote clusters inventory bookkeeping. #11707
This release of Teleport contains multiple fixes.
- Fixed issue with
tctlignoringTELEPORT_HOMEenvironment variable. #11561 - Fixed multiple moderated sessions stability issues. #11494
- Fixed issue with
tsh versionexiting with error when tsh config file is not present. #11571 - Fixed issue with
tshnot respecting proxy hosts. #11496 - Fixed issue with Kubernetes forwarder taking HTTP proxies into account. #11462
- Fixed issue with stale DynamoDB Auth Services disrupting agent reconnect attempts. #11598
This release of Teleport contains multiple features, improvements and bug fixes.
- Added support for per-user
tshconfiguration preferences. #10336 - Added support for role bootstrapping in OSS. #11175
- Added
HTTP_PROXYsupport to tsh. #10209 - Improved error messages
tshandtctlshow to include usage information on invalid command line invocation. #11174 - Improved
tctl <resource> lsoutput to make it consistent across all resources. #9519 - Fixed multiple issues with CA rotation, graceful restart, and stability. #10706 #11074 #11283
- Fixed issue where MOTD was not always shown. #10735
- Fixed an issue where certificate extension not being included in
tctl auth sign. #10949 - Fixed a panic that could occur in the Web UI. #11389
This release of Teleport contains multiple improvements and bug fixes.
- Fixed issue with Ctrl-C freezing sessions. #11188
- Improved handling of unknown audit events. #11064
- Improved calculation of public addresses for dynamically registered apps. #11139
- Fixed
tsh aws ecrreturning 500 errors. #11108 - Fixed issue with deleting certain users. #11131
- Fixed issue with Machine ID not detecting token in file config. #11206
Teleport 9.0 is a major release that brings:
- Teleport Desktop Access GA
- Teleport Machine ID Preview
- Various additions to Teleport Database Access
- Moderated Sessions for Server and Kubernetes Access
Desktop Access adds support for clipboard sharing, session recording, and per-session MFA.
Teleport Machine ID Preview extends identity-based access to machines. It's the easiest way to issue, renew, and manage SSH and X.509 certificates for service accounts, microservices, CI/CD automation and all other forms of machine-to-machine access.
Database Access brings self-hosted Redis support, RDS MariaDB (10.6 and higher) support, auto-discovery for Redshift clusters, and auto-IAM configuration improvements to GA. Additionally, this release also brings Microsoft SQL Server with AD authentication to Preview.
Moderated Sessions enables the creation of sessions where a moderator has to be present. This feature can be selectively enabled for specific sessions via RBAC and can be used in conjunction with per-session MFA.
Desktop Access now supports copying and pasting text between your local workstation and a remote Windows Desktop. This feature requires a Chromium-based browser and can be disabled via RBAC.
Desktop sessions are now recorded and stored alongside SSH sessions, and can be viewed in Teleport's web interface. Desktop session recordings are fully compatible with the RBAC for sessions feature introduced in Teleport 8.1.
Per-session MFA settings now apply to desktop sessions. This allows cluster administrators to require an additional MFA "tap" prior to opening a desktop session. This feature requires a WebAuthn device.
Machine ID allows the creation of machine / bot / service account users who can automatically issue, renew, and manage SSH and X.509 certificates to facilitate machine-to-machine access.
Machine ID is a service that programmatically issues and renews short-lived certificates to any service account (e.g., a CI/CD server) by retrieving credentials from the Teleport Auth Service. This enables fine-grained role-based access controls and audit.
Some of the things you can do with Machine ID:
- Machines can retrieve short-lived SSH certificates for CI/CD pipelines.
- Machines can retrieve short-lived X.509 certificates for use with databases or applications.
- Configure role-based access controls and locking for machines.
- Capture access events in the audit log.
Machine ID getting started guide: https://goteleport.com/docs/ver/9.0/machine-id/getting-started/.
You can now use Database Access to connect to a self-hosted Redis instance or Redis cluster and view Redis commands in the Teleport audit log. We will be adding support for AWS Elasticache in the coming weeks.
Self-hosted Redis guide: https://goteleport.com/docs/ver/9.0/database-access/guides/redis/.
Teleport 9 includes a preview release of Microsoft SQL Server with Active Directory authentication support for Database Access. Audit logging of query activity is not included in the preview release and will be implemented in a later 9.x release.
SQL Server guide: https://goteleport.com/docs/ver/9.0/database-access/guides/sql-server-ad/.
Teleport 9 updates MariaDB support with auto-discovery and connection to AWS RDS MariaDB databases using IAM authentication. The minimum MariaDB version that supports IAM authentication is 10.6.
Updated RDS guide: https://goteleport.com/docs/ver/9.0/database-access/guides/rds/.
In addition, Teleport 9 expands auto-discovery to support Redshift databases and 2 new commands which simplify the Database Access getting started experience: "teleport db configure create", which generates Database Service configuration, and "teleport db configure bootstrap", which configures IAM permissions for the Database Service when running on AWS.
CLI commands reference: https://goteleport.com/docs/ver/9.0/database-access/reference/cli/#teleport-db-configure-create https://goteleport.com/docs/ver/9.0/database-access/reference/cli/#teleport-db-configure-bootstrap
With Moderated Sessions, Teleport administrators can define policies that allow users to invite other users to participate in SSH or Kubernetes sessions as observers, moderators or peers.
Moderated Sessions guide: https://goteleport.com/docs/ver/9.0/access-controls/guides/moderated-sessions/.
CentOS 6 support was deprecated in Teleport 8 and has now been removed.
Desktop Access now authenticates to LDAP using X.509 client certificates.
Support for the password_file configuration option has been removed.
Teleport 8.0 is a major release of Teleport that contains new features, improvements, and bug fixes.
Teleport 8.0 includes a preview of the Windows Desktop Access feature, allowing users passwordless login to Windows Desktops via any modern web browser.
Teleport users can connect to Active Directory enrolled Windows hosts running Windows 10, Windows Server 2012 R2 and newer Windows versions.
To try this feature yourself, check out our Getting Started Guide.
Review the Desktop Access design in:
In TLS routing mode all client connections are wrapped in TLS and multiplexed on a single Teleport proxy port.
TLS routing can be enabled by including the following auth service configuration:
auth_service:
proxy_listener_mode: multiplex
...and setting proxy configuration version to v2 to prevent legacy listeners from
being created:
version: v2
proxy_service:
...Teleport application access extends AWS console support to CLI . Users are able
to log into their AWS console using tsh app login and use tsh aws commands
to interact with AWS APIs.
See more info in the documentation.
With dynamic registration users are able to manage applications and databases without needing to update static YAML configuration or restart application or database agents.
See dynamic registration guides for apps and databases.
With RDS auto discovery Teleport database agents can automatically discover RDS instances and Aurora clusters in an AWS account.
See updated RDS guide for more information.
WebAuthn support enables Teleport users to use modern second factor options, including Apple FaceID and TouchID.
In addition, the Teleport Web UI includes new second factor management tools, enabling users to configure and update their second factor devices via their web browser.
Lastly, our UI becomes more secure by requiring an additional second factor confirmation for certain privileged actions (editing roles for second factor confirmation, for example).
- Added support for CockroachDB to Database Access. #8505
- Reduced network utilization on large clusters during login. #8471
- Added metrics and added the ability for
tctl topto show network utilization for resource propagation. #8338 #8603 #8491 - Added support for account recovery and cancellation. #6769
- Added per-session MFA support to Database Access. #8270
- Added support for profile specific
kubeconfig. #7840
- Fixed issues with web applications that utilized EventSource with Application Access. #8359
- Fixed issue were interactive sessions would always return exit code 0. #8081
- Fixed issue where JWT signer was omitted from bootstrap logic. #8119
CentOS 6 support will be deprecated in Teleport 8 and removed in Teleport 9.
Teleport 8 will continue to receive security patches for about 9 months after which it will be EOL. Users are encouraged to upgrade to CentOS 7 in that time frame.
New run time dependencies have been added to Teleport 8 due to the inclusion of
Rust in the build chain. Teleport 8 requires libgcc_s.so and libm.so be
installed on systems running Teleport.
Users of distroless container images are encouraged to use the gcr.io/distroless/cc-debian11 image to run Teleport.
FROM gcr.io/distroless/cc-debian11
Alpine users are recommended to install the libgcc package in addition to any
glibc compatibility layer they have already been using.
apk --update --no-cache add libgcc
With the GODEBUG=x509ignoreCN=0 flag removed in Go 1.17, Database Access users
will no longer be able to connect to databases that include their hostname in
the CommonName field of the presented certificate. Users are recommended to
update their database certificates to include hostname in the
Subject Alternative Name extension instead.
Subscribe to Github issue #7636 which will add ability to control level of TLS verification as a workaround.
New clusters will no longer have the default admin role, it has been replaced
with 3 smaller scoped roles: access, auditor, and editor.
Teleport 7.0 is a major release of Teleport that contains new features, improvements, and bug fixes.
Added support for MongoDB to Teleport Database Access. #6600.
View the Database Access with MongoDB for more details.
Added support for GCP Cloud SQL MySQL to Teleport Database Access. #7302
View the Cloud SQL MySQL guide for more details.
Added support for AWS Console to Teleport Application Access. #7590
Teleport Application Access can now automatically sign users into the AWS Management Console using Identity federation. View AWS Management Console guide for more details.
Added the ability to block network traffic (IPv4 and IPv6) on a per-SSH session basis. Implemented using BPF tooling which required kernel 5.8 or above. #7099
Updated Enhanced Session Recording to no longer require the installation of external compilers like bcc-tools. Implemented using BPF tooling which required kernel 5.8 or above. #6027
- Added the ability to terminate Database Access certificates when the certificate expires. #5476
- Added additional FedRAMP compliance controls, such as custom disconnect and MOTD messages. #6091 #7396
- Added the ability to export Audit Log and session recordings using the Teleport API. #6731 #7360
- Added the ability to partially configure a cluster. #5857 RFD #28
- Added the ability to disable port forwarding on a per-host basis. #6989
- Added ability to configure
tshhome directory. #7035 - Added ability to generate OpenSSH client configuration snippets using
tsh config. #7437 - Added default-port detection to
tsh#6374 - Improved performance of the Web UI for users with many roles. #7588
- Fixed a memory leak that could affect etcd users. #7631
- Fixed an issue where
tsh logincould fail if the user had multiple public addresses defined on the proxy. #7368
Enhanced Session Recording has been updated to use CO-RE BPF executables. This makes deployment much simpler, you no longer have to install bcc-tools, but comes with a higher minimum kernel version of 5.8 and above. #6027
Kubernetes Access will no longer automatically register a cluster named after the Teleport cluster if the proxy is running within a Kubernetes cluster. Users wishing to retain this functionality now have to explicitly set kube_cluster_name. #6786
tsh login has been updated to no longer change the current Kubernetes context. While tsh login will write credentials to kubeconfig it will only update your context if tsh login --kube-cluster or tsh kube login <kubeCluster> is used. #6045
Teleport 6.2 contains new features, improvements, and bug fixes.
Note: the DynamoDB indexing change described below may cause rate-limiting errors from AWS APIs and is slow on large deployments (1000+ existing audit events). The next patch release, v6.2.1, will improve the migration performance. If you run a large DynamoDB-based cluster, we advise you to wait for v6.2.1 before upgrading.
Added support for Amazon Redshift to Teleport Database Access.#6479.
View the Database Access with Redshift on AWS Guide for more details.
- Added pass-through header support for Teleport Application Access. #6601
- Added ability to propagate claim information from root to leaf clusters. #6540
- Added Proxy Protocol for MySQL Database Access. #6594
- Added prepared statement support for Postgres Database Access. #6303
- Added
GetSessionEventsRequestRPC endpoint for Audit Log pagination. RFD 19 #6731 - Changed DynamoDB indexing strategy for events. RFD 24 #6583
- Fixed multiple per-session MFA issues. #6542 #6567 #6625 #6779 #6948
- Fixed etcd JWT renewal issue. #6905
- Fixed issue where
kubectl execsessions were not being recorded when the target pod was killed. #6068 - Fixed an issue that prevented Teleport from starting on ARMv7 systems. #6711.
- Fixed issue that caused Access Requests to inconsistently allow elevated Kuberentes access. #6492
- Fixed an issue that could cause
session.endevents not to be emitted. #6756 - Fixed an issue with PAM variable interpolation. #6558
Teleport 6.2 brings a potentially backward incompatible change with tsh agent forwarding.
Prior to Teleport 6.2, tsh ssh -A would create an in-memory SSH agent from your ~/.tsh directory and forward that agent to the target host.
Starting in Teleport 6.2 tsh ssh -A by default now forwards your system SSH agent (available at $SSH_AUTH_SOCK). Users wishing to retain the prior behavior can use tsh ssh -o "ForwardAgent local".
For more details see RFD 22 and implementation in #6525.
DynamoDB users should note that the events backend indexing strategy has changed and a data migration will be triggered after upgrade. For optimal performance perform this migration with only one auth server online. It may take some time and progress will be periodically written to the auth server log. During this migration, only events that have been migrated will appear in the Web UI. After completion, all events will be available.
For more details see RFD 24 and implementation in #6583.
This release of Teleport contains multiple bug fixes.
- Added additional Prometheus Metrics. #6511
- Updated the TLS handshake timeout to 5 seconds to avoid timeout issues on large clusters. #6692
- Fixed issue that caused non-interactive SSH output to show up in logs. #6683
- Fixed two issues that could cause Teleport to panic upon startup. #6431 #5712
This release of Teleport contains a bug fix.
- Added support for PROXY protocol to Database Access (MySQL). #6517
This release of Teleport contains a new feature.
- Added log formatting and support to enable timestamps for logs. #5898
This release of Teleport contains a bug fix.
- Fixed an issue where DEB builds were not published to the Teleport DEB repository.
Teleport 6.1 contains multiple new features, improvements, and bug fixes.
Added support for U2F authentication on every SSH and Kubernetes "connection" (a single tsh ssh or kubectl call). This is an advanced security feature that protects users against compromises of their on-disk Teleport certificates. Per-session MFA can be enforced cluster-wide or only for some specific roles.
For more details see Per-Session MFA documentation or RFD 14 and RFD 15 for technical details.
Added ability to request multiple users to review and approve access requests.
See #5071 for technical details.
- Added the ability to propagate SSO claims to PAM modules. #6158
- Added support for cluster routing to reduce latency to leaf clusters. RFD 21
- Added support for Google Cloud SQL to Database Access. #6090
- Added support CLI credential issuance for Application Access. #5918
- Added support for Encrypted SAML Assertions. #5598
- Added support for user impersonation. #6073
- Fixed interoperability issues with
gpg-agent. RFD 18 - Fixed websocket support in Application Access. #6028
- Fixed file argument issues with
tsh play. #1580 - Fixed
utmpregressions that caused issues in LXC containers. #6256
This release of Teleport contains a bug fix.
- Fixed a issue that caused high network on deployments with many leaf Trusted Clusters. #6263
This release of Teleport contains bug fixes and adds new default roles.
- Fixed an issue with proxy web endpoint resetting connection when run with
--insecure-no-tlsflag. #5923 - Introduced role presets:
auditor,editorandaccess. #5968 - Added ability to inline
google_service_accountfield into Google Workspace OIDC connector. #5563
This release of Teleport contains multiple bug fixes.
- Fixed issue that caused ACME default configuration to fail with
TLS-ALPN-01challenge. #5839 - Fixed regression in ADFS integration. #5880
Teleport 6.0 is a major release with new features, functionality, and bug fixes.
We have implemented Database Access, open sourced role-based access control (RBAC), and added official API and a Go client library.
Users can review the 6.0 milestone on Github for more details.
Review the Database Access design in RFD #11.
With Database Access users can connect to PostgreSQL and MySQL databases using short-lived certificates, configure SSO authentication and role-based access controls for databases, and capture SQL query activity in the audit log.
Configure Database Access following the Getting Started guide.
To learn more about configuring role-based access control for Database Access, check out RBAC section.
Architecture provides a more in-depth look at Database Access internals such as networking and security.
See Reference for an overview of Database Access related configuration and CLI commands.
Finally, check out Frequently Asked Questions.
Open source RBAC support was introduced in RFD #7.
RBAC support gives OSS administrators more granular access controls to servers and other resources with a cluster (like session recording access). An example of an RBAC policy could be: "admins can do anything, developers must never touch production servers and interns can only SSH into staging servers as guests"
In addition, some Access Workflow Plugins will now become available to open source users.
- Access Workflows Golang SDK and API
- Slack
- Gitlab
- Mattermost
- JIRA Plugin
- PagerDuty Plugin
API and Client Libraries support was introduced in RFD #10.
The new API and client library reduces the dependencies needed to use the Teleport API as well as making it easier to use. An example of using the new API is below.
// Create a client connected to the Auth server with an exported identity file.
clt, err := client.NewClient(client.Config{
Addrs: []string{"auth.example.com:3025"},
Credentials: []client.Credentials{
client.LoadIdentityFile("identity.pem"),
},
})
if err != nil {
log.Fatalf("Failed to create client: %v.", err)
}
defer clt.Close()
// Create a Access Request.
accessRequest, err := types.NewAccessRequest(uuid.New(), "access-admin", "admin")
if err != nil {
log.Fatalf("Failed to build access request: %v.", err)
}
if err = clt.CreateAccessRequest(ctx, accessRequest); err != nil {
log.Fatalf("Failed to create access request: %v.", err)
}- Added
utmp/wtmpsupport for SSH in #5491. - Added the ability to set a Kubernetes specific public address in #5611.
- Added Proxy Protocol support to Kubernetes Access in #5299.
- Added ACME (Let's Encrypt) support to make getting and using TLS certificates easier. #5177.
- Added the ability to manage local users to the Web UI in #2945.
- Added the ability to preserve timestamps when using
tsh scpin #2889.
- Fixed authentication failure when logging in via CLI with Access Workflows after removing
.tshdirectory in #5323. - Fixed
tsh loginfailure when--proxydiffers from actual proxy public address in #5380. - Fixed session playback issues in #2945.
- Fixed several UX issues in #5559, #5568, #4965, and #5057.
Please follow our standard upgrade procedure to upgrade your cluster.
Note, for clusters using GitHub SSO and Trusted Clusters, when upgrading SSO users will lose connectivity to leaf clusters. Local users will not be affected.
To restore connectivity to leaf clusters for SSO users, leaf admins should update the trusted_cluster role mapping resource like below.
kind: trusted_cluster
version: v2
metadata:
name: "zztop-oss"
spec:
enabled: true
token: "bar"
web_proxy_addr: 172.10.1.1:3080
tunnel_addr: 172.10.1.1:3024
role_map:
- remote: "admin"
local: ['admin']
- remote: "^(github-.*)$"
local: ['admin']This release of Teleport adds a new feature.
- Support for creating and assuming Access Workflow requests from within the Web UI (first step toward full Workflow UI support: #4937).
This release of Teleport contains a security fix.
- Patch a SAML authentication bypass (see https://github.com/russellhaering/gosaml2/security/advisories/GHSA-xhqq-x44f-9fgg): #5119.
Any Enterprise SSO users using Okta, Active Directory, OneLogin or custom SAML connectors should upgrade their auth servers to version 5.0.2 and restart Teleport. If you are unable to upgrade immediately, we suggest disabling SAML connectors for all clusters until the updates can be applied.
This release of Teleport contains multiple bug fixes.
- Always set expiry times on server resource in heartbeats #5008
- Fixes streaming k8s responses (
kubectl logs -f,kubectl run -it, etc) #5009 - Multiple fixes for the k8s forwarder #5038
Teleport 5.0 is a major release with new features, functionality, and bug fixes. Users can review 5.0 closed issues on Github for details of all items.
Teleport 5.0 introduces two distinct features: Teleport Application Access and significant Kubernetes Access improvements - multi-cluster support.
Teleport can now be used to provide secure access to web applications. This new feature was built with the express intention of securing internal apps which might have once lived on a VPN or had a simple authorization and authentication mechanism with little to no audit trail. Application Access works with everything from dashboards to single page Javascript applications (SPA).
Application Access uses mutually authenticated reverse tunnels to establish a secure connection with the Teleport unified Access Plane which can then becomes the single ingress point for all traffic to an internal application.
Adding an application follows the same UX as adding SSH servers or Kubernetes clusters, starting with creating a static or dynamic invite token.
$ tctl tokens add --type=appThen simply start Teleport with a few new flags.
$ teleport start --roles=app --token=xyz --auth-server=proxy.example.com:3080 \
--app-name="example-app" \
--app-uri="http://localhost:8080"This command will start an app server that proxies the application "example-app" running at http://localhost:8080 at the public address https://example-app.example.com.
Applications can also be configured using the new app_service section in teleport.yaml.
app_service:
# Teleport Application Access is enabled.
enabled: yes
# We've added a default sample app that will check
# that Teleport Application Access is working
# and output JWT tokens.
# https://dumper.teleport.example.com:3080/
debug_app: true
apps:
# Application Access can be used to proxy any HTTP endpoint.
# Note: Name can't include any spaces and should be DNS-compatible A-Za-z0-9-._
- name: "internal-dashboard"
uri: "http://10.0.1.27:8000"
# By default Teleport will make this application
# available on a sub-domain of your Teleport proxy's hostname
# internal-dashboard.teleport.example.com
# - thus the importance of setting up wilcard DNS.
# If you want, it's possible to set up a custom public url.
# DNS records should point to the proxy server.
# internal-dashboard.teleport.example.com
# Example Public URL for the internal-dashboard app.
# public_addr: "internal-dashboard.acme.com"
# Optional labels
# Labels can be combined with RBAC rules to provide access.
labels:
customer: "acme"
env: "production"
# Optional dynamic labels
commands:
- name: "os"
command: ["/usr/bin/uname"]
period: "5s"
# A proxy can support multiple applications. Application Access
# can also be deployed with a Teleport node.
- name: "arris"
uri: "http://localhost:3001"
public_addr: "arris.example.com"Application access requires two additional changes. DNS must be updated to point the application domain to the proxy and the proxy must be loaded with a TLS certificate for the domain. Wildcard DNS and TLS certificates can be used to simplify deployment.
# When adding the app_service certificates are required to provide a TLS
# connection. The certificates are managed by the proxy_service
proxy_service:
# We've extended support for https certs. Teleport can now load multiple
# TLS certificates. In the below example we've obtained a wildcard cert
# that'll be used for proxying the applications.
# The correct certificate is selected based on the hostname in the HTTPS
# request using SNI.
https_keypairs:
- key_file: /etc/letsencrypt/live/teleport.example.com/privkey.pem
cert_file: /etc/letsencrypt/live/teleport.example.com/fullchain.pem
- key_file: /etc/letsencrypt/live/*.teleport.example.com/privkey.pem
cert_file: /etc/letsencrypt/live/*.teleport.example.com/fullchain.pemYou can learn more at https://goteleport.com/teleport/docs/application-access/
Teleport 5.0 also introduces two highly requested features for Kubernetes.
- The ability to connect multiple Kubernetes Clusters to the Teleport Access Plane, greatly reducing operational complexity.
- Complete Kubernetes audit log capture #4526, going beyond the existing
kubectl execcapture.
For a full overview please review the Kubernetes RFD.
To support these changes, we've introduced a new service. This moves Teleport Kubernetes configuration from the proxy_service into its own dedicated kubernetes_service section.
When adding the new Kubernetes service, a new type of join token is required.
tctl tokens add --type=kubeExample configuration for the new kubernetes_service:
# ...
kubernetes_service:
enabled: yes
listen_addr: 0.0.0.0:3027
kubeconfig_file: /secrets/kubeconfigNote: a Kubernetes port still needs to be configured in the proxy_service via kube_listen_addr.
tsh kube commands are used to query registered clusters and switch kubeconfig context:
$ tsh login --proxy=proxy.example.com --user=awly
# list all registered clusters
$ tsh kube ls
Cluster Name Status
------------- ------
a.k8s.example.com online
b.k8s.example.com online
c.k8s.example.com online
# on login, kubeconfig is pointed at the first cluster (alphabetically)
$ kubectl config current-context
proxy.example.com-a.k8s.example.com
# but all clusters are populated as contexts
$ kubectl config get-contexts
CURRENT NAME CLUSTER AUTHINFO
* proxy.example.com-a.k8s.example.com proxy.example.com proxy.example.com-a.k8s.example.com
proxy.example.com-b.k8s.example.com proxy.example.com proxy.example.com-b.k8s.example.com
proxy.example.com-c.k8s.example.com proxy.example.com proxy.example.com-c.k8s.example.com
# switch between different clusters:
$ tsh kube login c.k8s.example.com
# the traditional way is also supported:
$ kubectl config use-context proxy.example.com-c.k8s.example.com
# check current cluster
$ kubectl config current-context
proxy.example.com-c.k8s.example.comOther Kubernetes changes:
- Support k8s clusters behind firewall/NAT using a single Teleport cluster #3667
- Support multiple k8s clusters with a single Teleport proxy instance #3952
We've added two new RBAC resources; these provide the ability to limit token creation and to list and modify Teleport users:
- resources: [user]
verbs: [list,create,read,update,delete]
- resources: [token]
verbs: [list,create,read,update,delete]Learn more about Teleport's RBAC Resources
Teleport 5.0 also adds the ability to set labels on Trusted Clusters. The labels are set when creating a trusted cluster invite token. This lets teams use the same RBAC controls used on nodes to approve or deny access to clusters. This can be especially useful for MSPs that connect hundreds of customers' clusters - when combined with Access Workflows, cluster access can easily be delegated. Learn more by reviewing our Truster Cluster Setup & RBAC Docs
Creating a trusted cluster join token for a production environment:
$ tctl tokens add --type=trusted_cluster --labels=env=prodkind: role
#...
deny:
# cluster labels control what clusters user can connect to. The wildcard ('*')
# means any cluster. By default, deny rules are empty to preserve backwards
# compatibility
cluster_labels:
'env': 'prod'Teleport 5.0 also iterates on the UI Refresh from 4.3. We've moved the cluster list into our sidebar and have added an Application launcher. For customers moving from 4.4 to 5.0, you'll notice that we have moved session recordings back to their own dedicated section.
Other updates:
- We now provide local user management via
https://[cluster-url]/web/users, providing the ability to easily edit, reset and delete local users. - Teleport Node & App Install scripts. This is currently an Enterprise-only feature that provides customers with an easy 'auto-magic' installer script. Enterprise customers can enable this feature by modifying the 'token' resource. See note above.
- We've added a Waiting Room for customers using Access Workflows. Docs
Starting with Teleport 5.0, we now provide an RPM repo for stable releases of Teleport. We've also started signing our RPMs to provide assurance that you're always using an official build of Teleport.
See https://rpm.releases.teleport.dev/ for more details.
- Added
--format=jsonplayback option fortsh play. For exampletsh play --format=json ~/play/0c0b81ed-91a9-4a2a-8d7c-7495891a6ca0.tar | jq '.eventcan be used to show all events within an a local archive. #4578 - Added support for continuous backups and auto scaling for DynamoDB. #4780
- Added a Linux ARM64/ARMv8 (64-bit) Release. #3383
- Added
https_keypairsfield which replaceshttps_key_fileandhttps_cert_file. This allows administrators to load multiple HTTPS certs for Teleport Application Access. Teleport 5.0 is backwards compatible with the old format, but we recommend updating your configuration to usehttps_keypairs.
Enterprise Only:
tctlcan load credentials from~/.tsh#4678- Teams can require a user submitted reason when using Access Workflows #4573
- Updated
tctlto always format resources as lists in JSON/YAML. #4281 - Updated
tsh statusto now print Kubernetes status. #4348 - Fixed intermittent issues with
loginuid.so. #3245 - Reduced
access denied to Proxylog spam. #2920 - Various AMI fixes: paths are now consistent with other Teleport packages and configuration files will not be overwritten on reboot.
We've added an API Reference to simply developing applications against Teleport.
Please follow our standard upgrade procedure.
- Optional: Consider updating
https_key_file&https_cert_fileto our newhttps_keypairs:format. - Optional: Consider migrating Kubernetes Access from
proxy_servicetokubernetes_serviceafter the upgrade.
This release of teleport contains a security fix and a bug fix.
- Patch a SAML authentication bypass (see https://github.com/russellhaering/gosaml2/security/advisories/GHSA-xhqq-x44f-9fgg): #5120.
Any Enterprise SSO users using Okta, Active Directory, OneLogin or custom SAML connectors should upgrade their auth servers to version 4.4.6 and restart Teleport. If you are unable to upgrade immediately, we suggest disabling SAML connectors for all clusters until the updates can be applied.
- Fix an issue where
tsh loginwould fail with anAccessDeniederror if the user was perviously logged into a leaf cluster. #5105
This release of Teleport contains a bug fix.
- Fixed an issue where a slow or unresponsive Teleport auth service could hang client connections in async recording mode. #4696
This release of Teleport adds enhancements to the Access Workflows API.
-
Support for creating limited roles that trigger access requests on login, allowing users to be configured such that no nodes can be accessed without externally granted roles.
-
Teleport UI support for automatically generating access requests and assuming new roles upon approval (access requests were previously only available in
tsh). -
New
claims_to_rolesmapping that can use claims from external identity providers to determine which roles a user can request. -
Various minor API improvements to help make requests easier to manage and audit, including support for human-readable request/approve/deny reasons and structured annotations.
This release of Teleport adds support for a new build architecture.
- Added automatic arm64 builds of Teleport to the download portal.
This release of Teleport contains a bug fix.
- Fixed an issue where defining multiple logging configurations would cause Teleport to crash. #4598
This is a major Teleport release with a focus on new features, functionality, and bug fixes. It’s a substantial release and users can review 4.4 closed issues on Github for details of all items.
This addition to Teleport helps customers obtain AC-10 control. We now provide two new optional configuration values: max_connections and max_sessions.
This value is the total number of concurrent sessions within a cluster to nodes running Teleport. This value is applied at a per user level. If you set max_connections to 1, a tsh user would only be able to tsh ssh into one node at a time.
This value limits the total number of session channels which can be established across a single SSH connection (typically used for interactive terminals or remote exec operations). This is for cases where nodes have Teleport set up, but a user is using OpenSSH to connect to them. It is essentially equivalent to the MaxSessions configuration value accepted by sshd.
spec:
options:
# Optional: Required to be set for AC-10 Compliance
max_connections: 2
# Optional: To match OpenSSH behavior set to 10
max_sessions: 10A new session_control_timeout configuration value has been added to the auth_service configuration block of the Teleport config file. It's unlikely that you'll need to modify this.
auth_service:
session_control_timeout: 2m # default
# ...Teleport 4.4 includes a complete refactoring of our event system. This resolved a few customer bug reports such as #3800: Events overwritten in DynamoDB and #3182: Teleport consuming all disk space with multipart uploads.
Along with foundational improvements, 4.4 includes two new experimental session_recording options: node-sync and proxy-sync.
NOTE: These experimental modes require all Teleport auth servers, proxy servers and nodes to be running Teleport 4.4.
# This section configures the 'auth service':
auth_service:
# Optional setting for configuring session recording. Possible values are:
# "node" : sessions will be recorded on the node level (the default)
# "proxy" : recording on the proxy level, see "recording proxy mode" section.
# "off" : session recording is turned off
#
# EXPERIMENTAL *-sync modes: proxy and node send logs directly to S3 or other
# storage without storing the records on disk at all. This mode will kill a
# connection if network connectivity is lost.
# NOTE: These experimental modes require all Teleport auth servers, proxy servers and
# nodes to be running Teleport 4.4.
#
# "node-sync" : sessions recording will be streamed from node -> auth -> storage
# "proxy-sync : sessions recording will be streamed from proxy -> auth -> storage
#
session_recording: "node-sync"- Added session streaming. #4045
- Added concurrent session control. #4138
- Added ability to specify leaf cluster when generating
kubeconfigviatctl auth sign. #4446 - Added output options (like JSON) for
tsh ls. #4390 - Added node ID to heartbeat debug log #4291
- Added the option to trigger
pam_authenticateon login #3966
- Fixed issue that caused some idle
kubectl execsessions to terminate. #4377 - Fixed symlink issued when using
tshon Windows. #4347 - Fixed
tctl topso it runs without the debug flag and on dark terminals. #4282 #4231 - Fixed issue that caused DynamoDB not to respect HTTP CONNECT proxies. #4271
- Fixed
/readyzendpoint to recover much quicker. #4223
- Updated Google Workspace documentation to add clarification on supported account types. #4394
- Updated IoT instructions on necessary ports. #4398
- Updated Trusted Cluster documentation on how to remove trust from root and leaf clusters. #4358
- Updated the PAM documentation with PAM authentication usage information. #4352
Please follow our standard upgrade procedure.
This release of Teleport contains a security fix.
- Patch a SAML authentication bypass (see https://github.com/russellhaering/gosaml2/security/advisories/GHSA-xhqq-x44f-9fgg): #5122.
Any Enterprise SSO users using Okta, Active Directory, OneLogin or custom SAML connectors should upgrade their auth servers to version 4.3.9 and restart Teleport. If you are unable to upgrade immediately, we suggest disabling SAML connectors for all clusters until the updates can be applied.
This release of Teleport adds support for a new build architecture.
- Added automatic arm64 builds of Teleport to the download portal.
This release of Teleport contains a security fix and a bug fix.
- Mitigated CVE-2020-15216 by updating github.com/russellhaering/goxmldsig.
A vulnerability was discovered in the github.com/russellhaering/goxmldsig library which is used by Teleport to validate the
signatures of XML files used to configure SAML 2.0 connectors. With a carefully crafted XML file, an attacker can completely
bypass XML signature validation and pass off an altered file as a signed one.
The goxmldsig library has been updated upstream and Teleport 4.3.7 includes the fix. Any Enterprise SSO users using Okta,
Active Directory, OneLogin or custom SAML connectors should upgrade their auth servers to version 4.3.7 and restart Teleport.
If you are unable to upgrade immediately, we suggest deleting SAML connectors for all clusters until the updates can be applied.
- Fixed an issue where DynamoDB connections made by Teleport would not respect the
HTTP_PROXYorHTTPS_PROXYenvironment variables. #4271
This release of Teleport contains multiple bug fixes.
- Fixed an issue with prefix migration that could lead to loss of cluster state. #4299 #4345
- Fixed an issue that caused excessively slow loading of the UI on large clusters. #4326
- Updated
/readyzendpoint to recover faster after node goes into degraded state. #4223 - Added node UUID to debug logs to allow correlation between TCP connections and nodes. #4291
This release of Teleport contains a bug fix.
- Fixed issue that caused Teleport Docker images to be built incorrectly. #4201
This release of Teleport contains multiple bug fixes.
- Fixed issue that caused intermittent login failures when using PAM modules like
pam_loginuid.soandpam_selinux.so. #4133 - Fixed issue that required users to manually verify a certificate when exporting an identity file. #4003
- Fixed issue that prevented local user creation using Firestore. #4160
- Fixed issue that could cause
tshto panic when using a PEM file. #4189
This release of Teleport contains multiple bug fixes.
- Reverted base OS in container images to Ubuntu. #4054
- Fixed an issue that prevented changing the path for the Audit Log. #3771
- Fixed an issue that allowed servers with invalid labels to be added to the cluster. #4034
- Fixed an issue that caused Cloud Firestore to panic on startup. #4041
- Fixed an error that would cause Teleport to fail to load with the error "list of proxies empty". #4005
- Fixed an issue that would prevent playback of Kubernetes session #4055
- Fixed regressions in the UI. #4013 #4012 #4035 #4051 #4044
This is a major Teleport release with a focus on new features, functionality, and bug fixes. It’s a substantial release and users can review 4.3 closed issues on Github for details of all items.
Teleport 4.3 includes a completely redesigned Web UI. The new Web UI expands the management functionality of a Teleport cluster and the user experience of using Teleport to make it easier and simpler to use. Teleport's new terminal provides a quick jumping-off point to access nodes and nodes on other clusters via the web.
Teleport's Web UI now exposes Teleport’s Audit log, letting auditors and administrators view Teleport access events, SSH events, recording session, and enhanced session recording all in one view.
Teleport 4.3 introduces four new plugins that work out of the box with Approval Workflow. These plugins allow you to automatically support role escalation with commonly used third party services. The built-in plugins are listed below.
- Added the ability for local users to reset their own passwords. #2387
- Added user impersonation (
kube_users)support to Kubernetes Proxy. #3369 - Added support for third party S3-compatible storage for sessions. #3057
- Added support for GCP backend data stores. #3766 #3014
- Added support for X11 forwarding to OpenSSH servers. #3401
- Added support for auth plugins in proxy
kubeconfig. #3655 - Added support for OpenSSH-like escape sequence. #3752
- Added
--browserflag totsh. #3737 - Updated
teleport configureoutput to be more useful out of the box. #3429 - Updated ability to only show SSO on the login page. #2789
- Updated help and support section in Web UI. #3531
- Updated default SSH signing algorithm to SHA-512 for new clusters. #3777
- Standardized audit event fields.
- Fixed removing existing user definitions in kubeconfig. #3209
- Fixed an issue where port forwarding could fail in certain circumstances. #3749
- Fixed temporary role grants issue when forwarding Kubernetes requests. #3624
- Fixed an issue that prevented copy/paste in the web termination. #92
- Fixed an issue where the proxy did not test Kubernetes permissions at startup. #3812
- Fixed
tshandgpg-agentintegration. #3169 - Fixed Vulnerabilities in Teleport Docker Image https://quay.io/repository/gravitational/teleport?tab=tags
Always follow the recommended upgrade procedure to upgrade to this version.
If you’re upgrading an existing version of Teleport, you may want to consider rotating CA to SHA-256 or SHA-512 for RSA SSH certificate signatures. The previous default was SHA-1, which is now considered to be weak against brute-force attacks. SHA-1 certificate signatures are also no longer accepted by OpenSSH versions 8.2 and above. All new Teleport clusters will default to SHA-512 based signatures. To upgrade an existing cluster, set the following in your teleport.yaml:
teleport:
ca_signature_algo: "rsa-sha2-512"
Rotate the cluster CA, following these docs.
Due to the number of changes included in the redesigned Web UI, some URLs and functionality have shifted. Refer to the following ticket for more details. #3580
Teleport 4.3 has made the audit log accessible via the Web UI. Enterprise customers
can limit access by changing the options on the new event resource.
# list and read audit log, including audit events and recorded sessions
- resources: [event]
verbs: [list, read]The minimum set of Kubernetes permissions that need to be granted to Teleport proxies has been updated. If you use the Kubernetes integration, please make sure that the ClusterRole used by the proxy has sufficient permissions.
The etcd backend now correctly uses the “prefix” config value when storing data. Upgrading from 4.2 to 4.3 will migrate the data as needed at startup. Make sure you follow our Teleport upgrade guidance.
Note: If you use an etcd backend with a non-default prefix and need to downgrade from 4.3 to 4.2, you should backup Teleport data and restore it into the downgraded cluster.
This release of Teleport contains a security fix.
- Mitigated CVE-2020-15216 by updating github.com/russellhaering/goxmldsig.
A vulnerability was discovered in the github.com/russellhaering/goxmldsig library which is used by Teleport to validate the
signatures of XML files used to configure SAML 2.0 connectors. With a carefully crafted XML file, an attacker can completely
bypass XML signature validation and pass off an altered file as a signed one.
The goxmldsig library has been updated upstream and Teleport 4.2.12 includes the fix. Any Enterprise SSO users using Okta,
Active Directory, OneLogin or custom SAML connectors should upgrade their auth servers to version 4.2.12 and restart Teleport.
If you are unable to upgrade immediately, we suggest deleting SAML connectors for all clusters until the updates can be applied.
This release of Teleport contains multiple bug fixes.
- Fixed an issue that prevented upload of session archives to NFS volumes. #3780
- Fixed an issue with port forwarding that prevented TCP connections from being closed correctly. #3801
- Fixed an issue in
tshthat would cause connections to the Auth Server to fail on large clusters. #3872 - Fixed an issue that prevented the use of Write-Only roles with S3 and GCS. #3810
This release of Teleport contains multiple bug fixes.
- Fixed an issue that caused Teleport environment variables not to be available in PAM modules. #3725
- Fixed an issue with
tsh login <clusterName>not working correctly with Kubernetes clusters. #3693
This release of Teleport contains multiple bug fixes.
- Fixed an issue where double
tsh loginwould be required to login to a leaf cluster. #3639 - Fixed an issue that was preventing connection reuse. #3613
- Fixed an issue that could cause
tsh lsto return stale results. #3536
This release of Teleport contains multiple bug fixes.
- Fixed issue where
^Cwould not terminatetsh. #3456 - Fixed an issue where enhanced session recording could cause Teleport to panic. #3506
As part of a routine security audit of Teleport, a security vulnerability was discovered that affects all recent releases of Teleport. We strongly suggest upgrading to the latest patched release to mitigate this vulnerability.
Due to a flaw in how the Teleport Web UI handled host certificate validation, host certificate validation was disabled for clusters where connections were terminated at the node. This means that an attacker could impersonate a Teleport node without detection when connecting through the Web UI.
Clusters where sessions were terminated at the proxy (recording proxy mode) are not affected.
Command line programs like tsh (or ssh) are not affected by this vulnerability.
To mitigate this issue, upgrade and restart all Teleport proxy processes.
This release of Teleport contains a bug fix.
- Fixed a regression in certificate reissuance that could cause nodes to not start. #3449
This release of Teleport contains multiple bug fixes.
- Added support for custom OIDC prompts. #3409
- Added support for
kubernetes_usersin roles. #3409 - Added support for extended variable interpolation. #3409
- Added SameSite attribute to CSRF cookie. #3441
This release of Teleport contains bug fixes.
- Fixed issue where Teleport could connect to the wrong node and added support to connect via UUID. #2396
- Fixed issue where
tsh loginwould fail to output identity when using the--outparameter. #3339
This release of Teleport contains bug and security fixes.
- Mitigated CVE-2020-9283 by updating golang.org/x/crypto.
- Fixed PAM integration to support user creation upon login. #3317 #3346
- Improved Teleport performance on large IoT clusters. #3227
- Added support for PluginData to Teleport plugins. #3286 #3298
This release of Teleport contains bug fixes and improvements.
- Fixed a regression in role mapping between trusted clusters. #3252
- Improved variety of issues with Enhanced Session Recording including support for more opearting systems and install from packages. #3279
This release of Teleport contains bug fixes and minor usability improvements.
- New build command for client-only (
tsh) .pkg builds. #3159 - Added support for etcd password auth. #3234
- Added third-party s3 support. #3234
- Fixed an issue where access-request event system fails when cache is enabled. #3223
- Fixed cgroup resolution so enhanced session recording works on Debian based distributions. #3215
This is a minor Teleport release with a focus on new features and bug fixes.
- Alpha: Enhanced Session Recording lets you know what's really happening during a Teleport Session. #2948
- Alpha: Workflows API lets admins escalate RBAC roles in response to user requests. Read the docs. #3006
- Beta: Teleport provides HA Support using Firestore and Google Cloud Storage using Google Cloud Platform. Read the docs. #2821
- Remote tctl execution is now possible. Read the docs. #1525 #2991
- Fixed issue in socks4 when rendering remote address #3110
- Adopting root/leaf terminology for trusted clusters. Trusted cluster documentation.
- Documented Teleport FedRAMP & FIPS Support. FedRAMP & FIPS documentation.
This release of Teleport contains a security fix.
- Mitigated CVE-2020-15216 by updating github.com/russellhaering/goxmldsig.
A vulnerability was discovered in the github.com/russellhaering/goxmldsig library which is used by Teleport to validate the
signatures of XML files used to configure SAML 2.0 connectors. With a carefully crafted XML file, an attacker can completely
bypass XML signature validation and pass off an altered file as a signed one.
The goxmldsig library has been updated upstream and Teleport 4.1.11 includes the fix. Any Enterprise SSO users using Okta,
Active Directory, OneLogin or custom SAML connectors should upgrade their auth servers to version 4.1.11 and restart Teleport.
If you are unable to upgrade immediately, we suggest deleting SAML connectors for all clusters until the updates can be applied.
As part of a routine security audit of Teleport, a security vulnerability was discovered that affects all recent releases of Teleport. We strongly suggest upgrading to the latest patched release to mitigate this vulnerability.
Due to a flaw in how the Teleport Web UI handled host certificate validation, host certificate validation was disabled for clusters where connections were terminated at the node. This means that an attacker could impersonate a Teleport node without detection when connecting through the Web UI.
Clusters where sessions were terminated at the proxy (recording proxy mode) are not affected.
Command line programs like tsh (or ssh) are not affected by this vulnerability.
To mitigate this issue, upgrade and restart all Teleport proxy processes.
This release of Teleport contains a security fix.
- Mitigated CVE-2020-9283 by updating golang.org/x/crypto.
This release of Teleport contains a bug fix.
- Fixed a regression in role mapping between trusted clusters. #3252
This release of Teleport contains a bug fix.
- Fixed issue where the port forwarding option in a role was ignored. #3208
This release of Teleport contains a bug fix.
- Fixed an issue that caused Teleport not to start with certain OIDC claims. #3053
This release of Teleport adds support for an older version of Linux.
- Added RHEL/CentOS 6.x builds to the build pipeline. #3175
This release of Teleport contains a bug fix.
- Fixed GSuite integration by adding support for service accounts. #3122
This release of Teleport contains multiple bug fixes.
- Removed
TLS_RSA_WITH_AES_128_GCM_SHA{256,384}from default ciphersuites due to compatibility issues with HTTP2. - Fixed issues with
local_authfor FIPS builds. #3100 - Upgraded Go runtime to 1.13.2 to mitigate CVE-2019-16276 and CVE-2019-17596.
This release of Teleport contains improvements to the build code.
- Added support for building Docker images using the FIPS-compliant version of Teleport. The first of these images is quay.io/gravitational/teleport-ent:4.1.2-fips
- In future, these images will be automatically built for use by Teleport Enterprise customers.
This release of Teleport contains a bug fix.
- Fixed an issue with multi-cluster EKS when the Teleport proxy runs outside EKS. #3070
This is a major Teleport release with a focus on stability and bug fixes.
- Support for IPv6. #2124
- Kubernetes support does not require SNI. #2766
- Support use of a path for
auth_tokeninteleport.yaml. #2515 - Implement ProxyJump compatibility. #2543
- Audit logs should show roles. #2823
- Allow
tshto go background and without executing remote command. #2297 - Provide a high level tool to backup and restore the cluster state. #2480
- Investigate nodes using stale list when connecting to proxies (discovery protocol). #2832
- Proxy can hang due to invalid OIDC connector. #2690
- Proper
-Dflag parsing. #2663 tshstatus does not show correct cluster name. #2671- Teleport truncates MOTD with PAM. #2477
- Miscellaneous fixes around error handling and reporting.
As part of a routine security audit of Teleport, a security vulnerability was discovered that affects all recent releases of Teleport. We strongly suggest upgrading to the latest patched release to mitigate this vulnerability.
Due to a flaw in how the Teleport Web UI handled host certificate validation, host certificate validation was disabled for clusters where connections were terminated at the node. This means that an attacker could impersonate a Teleport node without detection when connecting through the Web UI.
Clusters where sessions were terminated at the proxy (recording proxy mode) are not affected.
Command line programs like tsh (or ssh) are not affected by this vulnerability.
To mitigate this issue, upgrade and restart all Teleport proxy processes.
This release of Teleport contains a security fix.
- Mitigated CVE-2020-9283 by updating golang.org/x/crypto.
This release of Teleport contains a bug fix.
- Fixed a regression in role mapping between trusted clusters. #3252
This release of Teleport contains a bug fix.
- Fixed issue where the port forwarding option in a role was ignored. #3208
This release of Teleport contains a bug fix.
- Fixed an issue that caused Teleport not to start with certain OIDC claims. #3053
This release of Teleport adds support for an older version of Linux.
- Added RHEL/CentOS 6.x builds to the build pipeline. #3175
This release of Teleport contains a bug fix.
- Fixed a goroutine leak that occured whenever a leaf cluster disconnected from the root cluster. #3037
This release of Teleport contains a bug fix.
- Fixed issue where Web UI could not connect to older nodes within a cluster. #2993
This release of Teleport contains two bug fixes.
- Fixed issue where new versions of
tshcould not connect to older clusters. #2969 - Fixed trait encoding to be more robust. #2970
This release of Teleport contains a bug fix.
- Fixed issue introduced in 4.0.5 that broke session recording when using the recording proxy. #2957
This release of Teleport contains a bug fix.
- Fixed a memory leak in the cache module. #2892
- Reduced keep-alive interval to improve interoperability with popular load balancers. #2845
- Fixed issue where non-RSA certificates were rejected when not in FIPS mode. #2805
This release of Teleport contains multiple bug fixes.
- Fixed an issue that caused active sessions not to be shown. #2801
- Fixed further issues with host certificate principal generation. #2812
- Fixed issue where fetching CA would sometimes return not found. #2805
This release of Teleport contains multiple bug fixes.
- Fixed issue that caused processes to be spawned with an incorrect GID. #2791
- Fixed host certificate principal generation to only include hosts or IP addresses. #2790
- Fixed issue preventing
tsh4.0 from connection to 3.2 clusters. #2784
This is a major Teleport release which introduces support for Teleport Internet of Things (IoT). In addition to this new feature this release includes usability, performance, and bug fixes listed below.
With Teleport 4.0, nodes gain the ability to use reverse tunnels to dial back to a Teleport cluster to bypass firewall restrictions. This allows connections even to nodes that a cluster does not have direct network access to. Customers that have been using Trusted Clusters to achieve this can now utilize a unified interface to access all nodes within their infrastructure.
With this release of Teleport, we have built out the foundation to help Teleport Enterprise customers build and meet the requirements in a FedRAMP System Security Plan (SSP). This includes a FIPS 140-2 friendly build of Teleport Enterprise as well as a variety of improvements to aid in complying with security controls even in FedRAMP High environments.
- Teleport now support 10,000 remote connections to a single Teleport cluster. Using our recommend hardware setup.
- Added ability to delete node using
tctl rm. #2685 - Output of
tsh lsis now sorted by node name. #2534
- Switched to
xdg-opento open a browser window on Linux. #2536 - Increased SSO callback timeout to 180 seconds. #2533
- Set permissions on TTY similar to OpenSSH. #2508
The lists of improvements and bug fixes above mention only the significant changes, please take a look at the complete list on Github for more.
Teleport 4.0 is backwards compatible with Teleport 3.2 and later. Follow the recommended upgrade procedure to upgrade to this version.
Note that due to substantial changes between Teleport 3.2 and 4.0, we recommend creating a backup of the backend datastore (DynamoDB, etcd, or dir) before upgrading a cluster to Teleport 4.0 to allow downgrades.
Teleport has always validated host certificates when a client connects to a server, however prior to Teleport 4.0, Teleport did not validate the host the user requests a connection to is in the list of principals on the certificate. To ensure a seamless upgrade, make sure the hosts you connect to have the appropriate address set in public_addr in teleport.yaml before upgrading.
This release of Teleport contains a bug fix.
- Fixed a regression in role mapping between trusted clusters. #3252
This release of Teleport contains a bug fix and a feature.
- Restore
CreateWebSessionmethod used by some integrations. #3076 - Add Docker registry and Helm repository support to
tsh login. #3045
This release of Teleport contains a bug fix.
- Fixed issue with TLS certificate not included in identity exported by
tctl auth sign. #3001
This release of Teleport contains a bug fix.
- Fixed issue where Web UI could not connect to older nodes within a cluster. #2993
This release of Teleport contains two bug fixes.
- Fixed issue where new versions of
tshcould not connect to older clusters. #2969 - Fixed trait encoding to be more robust. #2970
This release of Teleport contains a bug fix.
- Fixed issue introduced in 3.2.8 that broke session recording when using the recording proxy. #2957
This release of Teleport contains multiple bug fixes.
- Read cluster name from
TELEPORT_SITEenvironment variable intsh. #2675 - Multiple improvements around logging in and saving
tshprofiles. #2657
This release of Teleport contains a bug fix.
- Fixed issue with
--bind-addrimplementation. #2650
This release of Teleport contains a new feature.
- Added
--bind-addrto forcetshto bind to a specific port during SSO login. #2620
This version brings support for Amazon's managed Kubernetes offering (EKS).
Starting with this release, Teleport proxy uses the impersonation API instead of the CSR API.
This release of Teleport contains a bug fix.
- Fixed issue where Web UI could not connect to older nodes within a cluster. #2993
This release of Teleport contains two bug fixes.
- Fixed issue where new versions of
tshcould not connect to older clusters. #2969 - Fixed trait encoding to be more robust. #2970
This release of Teleport contains a bug fix.
- Fixed issue introduced in 3.1.10 that broke session recording when using the recording proxy. #2957
This release of Teleport contains a bug fix.
- Fixed issue where SSO users TTL was set incorrectly. #2564
This release of Teleport contains a bug fix.
This release of Teleport contains bug fixes, security fixes, and user experience improvements.
- Use
xdg-openinstead ofsensible-browserto open links on Linux. #2454 - Increased SSO callback timeout to 180 seconds. #2483
- Improved Teleport error messages when it fails to start. #2525
- Sort
tsh lsoutput by node name. #2511 - Support different regions for S3 (sessions) and DynamoDB (audit log). #2007
- Fixed syslog output even when Teleport is in debug mode. #2550
- Fixed audit log naming conventions. #2388
- Fixed issue where
~/.tsh/profilewas deleted upon logout. #2546 - Fixed output of
tctl getto be compatible withtctl create. #2479 - Fixed issue where multiple file upload with
scpdid not work correctly. #2094 - Correctly set permissions TTY. #2540
- Mitigated scp issues when connected to malicious server #2539
Teleport 3.1.5 contains a bug fix and security fix.
- Fixed issue where certificate authorities were not fetched during every login. #2526
- Upgraded Go to 1.11.5 to mitigate CVE-2019-6486: CPU denial of service in P-521 and P-384 elliptic curve implementation.
Teleport 3.1.4 contains one new feature and two bug fixes.
- Added support for GSuite as a SSO provider. #2455
- Fixed issue where Kubernetes groups were not being passed to remote clusters. #2484
- Fixed issue where the client was pulling incorrect CA for trusted clusters. #2487
Teleport 3.1.3 contains two security fixs.
- Updated xterm.js to mitigate a RCE in xterm.js.
- Mitigate potential timing attacks during bearer token authentication. #2482
- Fixed
x509: certificate signed by unknown authorityerror when connecting to DynamoDB within Gravitational publish Docker image. #2473
Teleport 3.1.2 contains a security fix. We strongly encourage anyone running Teleport 3.1.1 to upgrade.
- Due to the flaw in internal RBAC verification logic, a compromised node, trusted cluster or authenticated non-privileged user can craft special request to Teleport's internal auth server API to gain access to the private key material of the cluster's internal certificate authorities and elevate their privileges to gain full administrative access to the Teleport cluster. This vulnerability only affects authenticated clients, there is no known way to exploit this vulnerability outside the cluster for unauthenticated clients.
Teleport 3.1.1 contains a security fix. We strongly encourage anyone running Teleport 3.1.0 to upgrade.
- Upgraded Go to 1.11.4 to mitigate CVE-2018-16875: CPU denial of service in chain validation Go. For customers using the RHEL5.x compatible release of Teleport, we've backported this fix to Go 1.9.7, before releasing RHEL 5.x compatible binaries.
This is a major Teleport release with a focus on backwards compatibility, stability, and bug fixes. Some of the improvements:
- Added support for regular expressions in RBAC label keys and values. #2161
- Added support for configurable server side keep-alives. #2334
- Added support for some
-oto improve OpenSSH interoperability. #2330 - Added i386 binaries as well as binaries built with older version of Go to support legacy systems. #2277
- Added SOCKS5 support to
tsh. #1693 - Improved UX and security for nodes joining a cluster. #2294
- Improved Kubernetes UX. #2291 #2258 #2304
- Fixed bug that did not allow copy and paste of texts over 128 in the Web UI. #2313
- Fixes issues with
scpwhen using the Web UI. #2300
Teleport 3.0.5 contains a security fix.
- Upgraded Go to 1.11.5 to mitigate CVE-2019-6486: CPU denial of service in P-521 and P-384 elliptic curve implementation.
Teleport 3.0.4 contains two security fixs.
- Updated xterm.js to mitigate a RCE in xterm.js.
- Mitigate potential timing attacks during bearer token authentication. #2482
Teleport 3.0.3 contains a security fix. We strongly encourage anyone running Teleport 3.0.2 to upgrade.
- Due to the flaw in internal RBAC verification logic, a compromised node, trusted cluster or authenticated non-privileged user can craft special request to Teleport's internal auth server API to gain access to the private key material of the cluster's internal certificate authorities and elevate their privileges to gain full administrative access to the Teleport cluster. This vulnerability only affects authenticated clients, there is no known way to exploit this vulnerability outside the cluster for unauthenticated clients.
Teleport 3.0.2 contains a security fix. We strongly encourage anyone running Teleport 3.0.1 to upgrade.
- Upgraded Go to 1.11.4 to mitigate CVE-2018-16875: CPU denial of service in chain validation Go. For customers using the RHEL5.x compatible release of Teleport, we've backported this fix to Go 1.9.7, before releasing RHEL 5.x compatible binaries.
This release of Teleport contains the following bug fix:
- Fix regression that marked ADFS claims as invalid. #2293
This is a major Teleport release which introduces support for Kubernetes clusters. In addition to this new feature this release includes several usability and performance improvements listed below.
tsh logincan retreive and install certificates for both Kubernetes and SSH at the same time.- Full audit log support for
kubectlcommands, including recording of the sessions ifkubectl execcommand was interactive. - Unified (AKA "single pane of glass") RBAC for both SSH and Kubernetes permissions.
For more information about Kubernetes support, take a look at the Kubernetes and SSH Integration Guide
- Teleport administrators can now fine-tune the enabled ciphersuites #1999
- Improved user experience linking trusted clusters together #1971
- All Teleport components (proxy, auth and nodes) now support
public_addrsetting which allows them to be hosted behind NAT/Load Balancers. #1793 - We have documented the previously undocumented monitoring endpoints #2103
- The
etcdback-end has been updated to implement 3.3+ protocol. See the upgrading notes below. - Listing nodes via
tsh lsor the web UI no longer shows nodes that the currently logged in user has no access to. #1954 - It is now possible to build
tshclient on Windows. Note: onlytsh logincommand is implemented. #1996. -iflag totsh loginis now guarantees to be non-interactive. #2221
- Removed the bogus error message "access denied to perform action create on user" #2132
scpimplementation in "recording proxy" mode did not work correctly. #2176- Removed the limit of 8 trusted clusters with SSO. #2192
tsh lsnow works correctly when executed on a remote/trusted cluster #2204
The lists of improvements and bug fixes above mention only the significant changes, please take a look at the complete list on Github for more.
Follow the recommended upgrade procedure to upgrade to this version.
WARNING: if you are using Teleport with the etcd back-end, make sure your
etcd version is 3.3 or newer prior to upgrading to Teleport 3.0.
Teleport 2.7.9 contains a security fix.
- Upgraded Go to 1.11.5 to mitigate CVE-2019-6486: CPU denial of service in P-521 and P-384 elliptic curve implementation.
Teleport 2.7.8 contains two security fixs.
- Updated xterm.js to mitigate a RCE in xterm.js.
- Mitigate potential timing attacks during bearer token authentication. #2482
Teleport 2.7.7 contains two security fixes. We strongly encourage anyone running Teleport 2.7.6 to upgrade.
- Due to the flaw in internal RBAC verification logic, a compromised node, trusted cluster or authenticated non-privileged user can craft special request to Teleport's internal auth server API to gain access to the private key material of the cluster's internal certificate authorities and elevate their privileges to gain full administrative access to the Teleport cluster. This vulnerability only affects authenticated clients, there is no known way to exploit this vulnerability outside the cluster for unauthenticated clients.
- Upgraded Go to 1.11.4 to mitigate CVE-2018-16875: CPU denial of service in chain validation Go.
This release of Teleport contains the following bug fix:
- Fix regression that marked ADFS claims as invalid. #2293
This release of Teleport contains the following bug fix:
- Teleport auth servers do not delete temporary files named
/tmp/multipart-#2250
This release of Teleport focuses on bugfixes.
- Fixed issues with
client_idle_timeout. #2166 - Added support for scalar and list values for
node_labelsin roles. #2136 - Improved font support on Ubuntu.
This release of Teleport focuses on bugfixes.
- Fixed issue that cause
failed executing request: user agent missingmissing error when upgrading from 2.6.
This release of Teleport focuses on bugfixes.
- Fixed issue in Teleport 2.7.2 where rollback to Go 1.9.7 was not complete for
linux-amd64binaries.
This release of Teleport focuses on bugfixes.
- Rollback to Go 1.9.7 for users with custom CA running into
x509: certificate signed by unknown authority.
The primary goal of 2.7.0 release was to address the community feedback and improve the performance and flexibility when running Teleport clusters with large number of nodes.
- The Web UI now includes
scp(secure copy) functionality. This allows Windows users and other users of the Web UI to upload/download files into SSH nodes using a web browser. - Fine-grained control over forceful session termination has been added #1935. It is now possible to:
- Forcefully disconnect idle clients (no client activity) after a specified timeout.
- Forcefully disconnect clients when their certificates expire in the middle of an active SSH session.
- Performance of SSH login commands have been improved on large clusters (thousands of nodes). #2061
- DynamoDB storage back-end performance has been improved. #2021
- Performance of session recording via a proxy has been improved #1966
- Connections between trusted clusters are managed better #2023
As awlays, this release contains several bug fixes. The full list can be seen here. Here are some notable ones:
- It is now possible to issue certificates with a long TTL via admin's
auth signtool. Previously they were limited to 30 hours for undocumented reason. 1745 - Dynamic label values were shown as empty strings. 2056
Follow the recommended upgrade procedure to upgrade to this version.
This release of Teleport focuses on bugfixes.
- Fixed issue in Teleport 2.6.8 where rollback to Go 1.9.7 was not complete for
linux-amd64binaries.
This release of Teleport focuses on bugfixes.
- Rollback to Go 1.9.7 for users with custom CA running into
x509: certificate signed by unknown authority.
This release of Teleport focuses on bugfixes.
- Resolved dynamic label regression. #2056
This release of Teleport focuses on bugfixes.
- Remote clusters no longer try to re-connect to proxies that have been permanently removed. #2023
- Speed up login on systems with many users. #2021
- Improve overall performance of the etcd backend. #2030
- Role login validation now applies after variables have been substituted. #2022
This release of Teleport focuses on bugfixes.
- Remote clusters no longer try to re-connect to proxies that have been permanently removed. #2023
- Speed up login on systems with many users. #2021
- Improve overall performance of the etcd backend. #2030
- Role login validation now applies after variables have been substituted. #2022
This release of Teleport focuses on bugfixes.
- Reduced go routine usage by the forwarding proxy. #1966
- Teleport no longer sends full version in the SSH handshake. #970
- Force flag works correctly for Trusted Clusters. #1871
- Allow manual creation of Certificate Authorities. #2001
- Include Teleport username in port forwarding events. #2004
- Allow
tctl auth signto create user certificate with arbitrary TTL values. #1745 - Upgrade to Go 1.10.3. #2008
This release of Teleport focuses on bugfixes.
- Use ciphers, KEX, and MAC algorithms from Teleport configuration in reverse tunnel server. #1984
- Update path sanitizer it allow
@. #1985
This release of Teleport brings new features, significant performance and usability improvements as well usual bugfixes.
During this release cycle, the Teleport source code has been audited for security vulnerabilities by Cure53 and this release (2.6.0) contains patches for the discovered problems.
- Support for DynamoDB for storing the audit log events. #1755
- Support for Amazon S3 for storing the recorded SSH sessions. #1755
- Support for rotating certificate authorities (CA rotation). [#1899] (gravitational#1899)
- Integration with Linux PAM (pluggable authentication modules) subsystem. #742 and #1766
- The new CLI command
tsh statusshows users which Teleport clusters they are authenticated with. #1628
Additionally, Teleport 2.6.0 has been submitted to the AWS marketplace. Soon AWS users will be able to create properly configured, secure and highly available Teleport clusters with ease.
-
Role templates (depreciated in Teleport 2.3) were fully removed. We recommend migrating to role variables which are documented here
-
Resource names (like roles, connectors, trusted clusters) can no longer contain unicode or other special characters. Update the names of all user created resources to only include characters, hyphens, and dots.
-
advertise_iphas been deprecated and replaced withpublic_addrsetting. See #1803 The existing configuration files will still work, but we advise Teleport administrators to update it to reflect the new format. -
Teleport no longer uses
boltdbback-end for storing cluster state by default. The new default is calleddirand it uses simple JSON files stored in/var/lib/teleport/backend. This change applies to brand new Teleport installations, the existing clusters will continue to useboltdb. -
The default set of enabled cryptographic primitives has been updated to reflect the latest state of SSH and TLS security. #1856.
The list of most visible bug fixes in this release:
tshnow properly handles Ctrl+C #1882- High CPU utilization on ARM platforms during daemon start-up. #1886
- Terminal window size can get out of sync on AWS. #1874
- Some CLI commands print errors twice. #1889
- SSH session playback can be interrupted for long sessions. #1774
- Processing
HUPUNIX signal is unreliable whenteleportdaemon runs undersystemd. #1844
You can see the full list of 2.6.0 changes here.
Follow the recommended upgrade procedure to upgrade to this version.
This release of Teleport focuses on bugfixes.
- Allow creation of users from
tctl create. #1949
This release of Teleport focuses on bugfixes.
- Improvements to Teleport HUP signal handling for more reliable reload. #1844
- Restore output format of
tctl nodes add --format=json. #1846
This release of Teleport focuses on bugfixes.
- Allow creation of multiple sessions per connection (fixes Ansible issues with the recording proxy). #1811
This release of Teleport focuses on bugfixes.
- Only reset SIGINT handler if it has not been set to ignore. #1814
- Improvement of user-visible errors. #1798 #1779
This release of Teleport focuses on bugfixes.
- Fix logging, collect status of forked processes. #1785 #1776
- Turn off proxy support when no-tls is used. #1800
- Correct the signup URL. #1777
- Fix GitHub team pagination issues. #1734
- Increase global dial timeout to 30 seconds. #1760
- Reuse existing singing key. #1713
- Don't panic on channel failures. #1808
This release of Teleport includes bug fixes and regression fixes.
- Run session migration in the background. #1784
- Include node name in regenerated host certificates. #1786
This release of Teleport fixes a regression in Teleport binaries.
- Binaries for macOS have been rebuilt to resolve "certificate signed by a unknown authority" issue.
This is a major release of Teleport. Its goal is to make cloud-native deployments easier. Numerous AWS users have contributed feedback to this release, which includes:
-
Auth servers in highly available (HA) configuration can share the same
/var/lib/teleportdata directory when it's hosted on NFS (or AWS EFS). #1351 -
There is now an AWS reference deployment in
examples/awsdirectory. It uses Terraform and demonstrates how to deploy large Teleport clusters on AWS using best practices like auto-scaling groups, security groups, secrets management, load balancers, etc. -
The Teleport daemon now implements built-in connection draining which allows zero-downtime upgrades. See documentation.
-
Dynamic join tokens for new nodes can now be explicitly set via
tctl node add --token. This allows Teleport admins to use an external mechanism for generating cluster invitation tokens. #1615 -
Teleport now correctly manages certificates for accessing proxies behind a load balancer with the same domain name. The new configuration parameter
public_addrmust be used for this. #1174.
-
Switching to a new TLS-based auth server API improves performance of large clusters. #1528
-
Session recordings are now compressed by default using gzip. This reduces storage requirements by up to 80% in our real-world tests. #1579
-
More user-friendly authentication errors in Teleport audit log helps Teleport admins troubleshoot configuration errors when integrating with SAML/OIDC providers. #1554, #1553, #1599
-
tshclient will now report if a server's API is no longer compatible.
-
tsh logoutwill now correctly log out from all active Teleport sessions. This is useful for users who're connected to multiple Teleport clusters at the same time. #1541 -
When parsing YAML, Teleport now supports
--list item separator to create multiple resources with a singletctl createcommand. #1663 -
Fixed a panic in the Web UI backend #1558
Certain components of Teleport behave differently in version 2.5. It is important to note that these changes are not breaking Teleport functionality. They improve Teleport behavior on large clusters deployed on highly dynamic cloud environments such as AWS. This includes:
- Session list in the Web UI is now limited to 1,000 sessions.
- The audit log and recorded session storage has been moved from
/var/lib/teleport/logto/var/lib/teleport/log/<auth-server-id>. This is related to #1351 described above. - When connecting a trusted cluster users can no longer pick an arbitrary name for them.
Their own (local) names will be used, i.e. the
cluster_namesetting now defines how the cluster is seen from the outside. #1543
This release of Teleport contains a bugfix.
- Only reset SIGINT handler if it has not been set to ignore. #1814
This release of Teleport focuses on bugfixes.
This release of Teleport fixes a regression in Teleport binaries.
- Binaries for macOS have been rebuilt to resolve "certificate signed by a unknown authority" issue.
This release of Teleport focuses on bugfixes.
- Resolved
tsh logoutregression. #1541 - Binaries for supported platforms all built with Go 1.9.2.
This release of Teleport focuses on bugfixes.
- Resolved "access denied" regression in Trusted Clusters. #1733
- Key written with wrong username to
~/.tsh. #1749 - Resolved Trusted Clusters toggling regression. #1751
This release of Teleport focuses on bugfixes.
- Wait for copy to complete before propagating exit-status. #1646
- Don't discard initial bytes in HTTP CONNECT tunnel. #1659
- Pass caching key generator to services and use cache in recording proxy. #1639
- Only display "Change Password" in UI for local users. #1669
- Update Singup URL. #1643
- Improved Teleport version reporting. #1538
- Fixed regressions in terminal size handling and Trusted Clusters introduced in 2.4.1. #1674 #1692
This release is focused on fixing a few regressions in Teleport as well as adding a new feature.
- Exposed the
--compatflag to Web UI users. #1542
- Wrap lines correctly on initial login. #1087
- Accept port numbers larger than
32767: #1576 - Don't show the
Joinbutton when using the recording proxy. #1421 - Don't double record sessions when using the recording proxy and Teleport nodes. #1582
- Fixed regressions in
tsh loginandtsh logout. #1611 #1541
This release adds two major new features and a few improvements and bugfixes.
- New Commercial Teleport Editions: "Pro" and "Business" allow users to purchase a Teleport subscription without signing contracts.
- Teleport now supports SSH session recording even for nodes running OpenSSH #1327 This feature is called "recording proxy mode".
- Users of open source edition of Teleport can now authenticate against Github #1445
- The Web UI now supports persistent URLs to Teleport nodes which can be integrated into 3rd party web apps. #1511
- Session recording can now be turned off #1430
- Teleport client
tshno longer supports being an SSH agent. We recommend using build-in SSH agents for MacOS and Linux, likessh-agentfromopenssh-clientpackage.
There have been numerous small usability and performance improvements, but some notable fixed bugs are listed below:
- Resource (file descriptor) leak #1433
- Correct handling of the terminal type #1402
- Crash on startup #1395
This release is focused on fixing a few regressions in configuration and UI/UX.
- Updated documentation to accurately reflect 2.3 changes
- Web UI can use introspection so users can skip explicitly specifying SSH port #1410
- Fixed issue of 2FA users getting prematurely locked out #1347
- UI (regression) when invite link is expired, nothing is shown to the user #1400
- OIDC regression with some providers #1371
- Legacy configuration for trusted clusters regression: #1381
- Dynamic tokens for adding nodes: "access denied" #1348
This release focus was to increase Teleport user experience in the following areas:
- Easier configuration via
tctlresource commands. - Improved documentation, with expanded 'examples' directory.
- Improved CLI interface.
- Web UI improvements.
- Web UI: users can connect to OpenSSH servers using the Web UI.
- Web UI now supports arbitrarty SSH logins, in addition to role-defined ones, for better compatibility with OpenSSH.
- CLI: trusted clusters can now be managed on the fly without having to edit Teleport configuration. #1137
- CLI:
tsh loginsupports exporting a user identity into a file to be used later with OpenSSH. tsh agentcommand has been deprecated: users are expected to use native SSH Agents on their platforms.
- More granular RBAC rules #1092
- Role definitions now support templates. #1120
- Authentication: Teleport now supports multilpe OIDC/SAML endpoints.
- Configuration: local authentication is always enabled as a fallback if a SAML/OIDC endpoints go offline.
- Configuration: SAML/OIDC endpoints can be created on the fly using
tctland without having to edit configuration file or restart Teleport. - Web UI: it is now easier to turn a trusted cluster on/off #1199.
- Proper handling of
ENV_SUPATHfromlogin.defs#1004 - Reverse tunnels would periodically lose connectivity. #1156
tshnow stores user identities in a format compatible with OpenSSH. 1171.
- Updated YAML parsing library. #1226
- Fixed issue with SSH dial potentially hanging indefinitely. #1153
- Fixed issue where node did not have correct permissions. #1151
- Fixed issue with remote tunnel timeouts. #1140.
- Fixed issue with Trusted Clusters where a clusters could lose its signing keys. #1050.
- Fixed SAML signing certificate export in Enterprise. #1109.
- Fixed an issue where in certain situations
tctl lswould not work. #1102.
- Added
--compat=oldsshto bothtshandtctlthat can be used to request certificates in the legacy format (no roles in extensions). #1083
- Fixed multiple regressions when using SAML with dynamic roles. #1080
- HTTP CONNECT tunneling for Trusted Clusters. #860
- Long lived certificates and identity export which can be used for automation. #1033
- New terminal for Web UI. #933
- Read user environment files. #1014
- Improvements to Auth Server resiliency and availability. #1071
- Server side configuration of support ciphers, key exchange (KEX) algorithms, and MAC algorithms. #1062
- Renaming
tshtosshor making a symlinktsh -> sshremoves the need to typetsh ssh, making it compatible with familiarssh user@host. #929
- SAML 2.0. #1070
- Role mapping for Trusted Clusters. #983
- ACR parsing for OIDC identity providers. #901
- Improvements to OpenSSH interoperability.
tshprofile is now always read. #1047- Correct signal handling when Teleport is launched using sysvinit. #981
- Role templates now automatically fill out default values when omitted. #912
- Fixed regression in TLP-01-009.
Teleport 2.0.5 contains a variety of security fixes. We strongly encourage anyone running Teleport 2.0.0 and above to upgrade to 2.0.5.
The most pressing issues (a phishing attack which can potentially be used to extract plaintext credentials and an attack where an already authenticated user can escalate privileges) can be resolved by upgrading the web proxy. However, however all nodes need to be upgraded to mitigate all vulnerabilities.
- Patch for TLP-01-001 and TLP-01-003: Check redirect.
- Patch for TLP-01-004: Always check is namespace is valid.
- Patch for TLP-01-005: Check user principal when joining session.
- Patch for TLP-01-006 and TLP-01-007: Validate Session ID.
- Patch for TLP-01-008: Use a fake hash for password authentication if user does not exist.
- Patch for TLP-01-009: Command injection in scp.
- Roles created the the Web UI now have
noderesource. #949
- Execute commands using user's shell. #943
- Allow users to read their own roles. #941
- Fix User CA import. #919
- Role template defaults. #916
- Skip UserInfo if not provided. #915
- Agent socket had wrong permissions. #936
- Introduced Dynamic Roles. #897
This is a major new release of Teleport.
- Native support for DynamoDB back-end for storing cluster state.
- It is now possible to turn off 2nd factor authentication.
- 2nd factor now uses TOTP. #522
- New and easy to use framework for implementing secret storage plug-ins.
- Audit log format has been finalized and documented.
- Experimental simple file-based secret storage back-end.
- SSH agent forwarding.
- Friendlier CLI error messages.
tsh loginis now compatible with SSH agents.
- Role-based access control (RBAC)
- Dynamic configuration: ability to manage roles and trusted clusters at runtime.
Full list of Github issues: https://github.com/gravitational/teleport/milestone/8
v1.3.2 is a maintenance release which fixes a Web UI issue when in some cases static web assets like custom fonts would not load properly.
- Issue #687 - broken web assets on some browsers.
v1.3.1 is a maintenance release which fixes a few issues found in 1.3
- Teleport session recorder can skip characters.
- U2F was enabled by default in "demo mode" if
teleport.yamlfile was missing.
- U2F documentation has been improved
This release includes several major new features and it's recommended for production use.
- Support for hardware U2F keys for 2nd factor authentication.
- CLI client profiles:
tshcan now remember its--proxysetting. - tctl auth sign command to allow administrators to generate user session keys
- Web UI is now served directly from the executable. There is no more need for web
assets in
/usr/local/share/teleport
- Multiple auth servers in config doesn't work if the last on is not reachable. #593
tsh scp -rdoes not handle directory upload properly #606
This is a maintenance release and it's a drop-in replacement for previous versions.
- Usability bugfixes as can be seen here
- Updated documentation
- Added examples directory with sample configuration and systemd unit file.
This is a maintenance release meant to be a drop-in upgrade of previous versions.
- User experience improvements: nicer error messages
- Better compatibility with ssh command:
-tflag can be used to force allocation of TTY
This release was recommended for production with one reservation: time-limited certificates did not work correctly in this release due to #529
- Improvements in performance and usability of the Web UI
- Smaller binary sizes thanks to Golang v1.7
- Wrong url to register new users. #497
- Logged in users inherit Teleport supplemental groups bug security. #507
- Joining a session running on a trusted cluster does not work. #504
This release only includes the addition of the ability to specify non-standard
HTTPS port for Teleport proxy for tsh --proxy flag.
This release only includes one major bugfix #486 plus minor changes not exposed to OSS Teleport users.
- Guessing
advertise_ipchooses IPv6 address space. #486
The first official release of Teleport!