Skip to content

Commit 855423d

Browse files
eriktateeriktate
authored
replacing documentation references to port_forwarding with ssh_port_forwarding and adding some additional context to the rbac reference (#50441)
1 parent c0bd290 commit 855423d

File tree

11 files changed

+113
-19
lines changed

11 files changed

+113
-19
lines changed

‎docs/pages/admin-guides/api/rbac.mdx

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -859,7 +859,11 @@ spec:
859859
enabled: true
860860
max_session_ttl: 30h0m0s
861861
pin_source_ip: false
862-
port_forwarding: true
862+
ssh_port_forwarding:
863+
remote:
864+
enabled: true
865+
local:
866+
enabled: true
863867
record_session:
864868
default: best_effort
865869
desktop: true
@@ -906,7 +910,11 @@ spec:
906910
enabled: true
907911
max_session_ttl: 30h0m0s
908912
pin_source_ip: false
909-
port_forwarding: true
913+
ssh_port_forwarding:
914+
remote:
915+
enabled: true
916+
local:
917+
enabled: true
910918
record_session:
911919
default: best_effort
912920
desktop: true

‎docs/pages/enroll-resources/server-access/rbac.mdx

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -135,8 +135,18 @@ spec:
135135
create_host_user_mode: keep
136136
# forward_agent controls whether SSH agent forwarding is allowed
137137
forward_agent: true
138-
# port_forwarding controls whether TCP port forwarding is allowed for SSH
139-
port_forwarding: true
138+
# ssh_port_forwarding controls which TCP port forwarding modes are allowed over SSH. This replaces
139+
# the deprecated port_forwarding field, which did not differentiate between remote and local
140+
# port forwarding modes. If you have any existing roles that allow forwarding by enabling the
141+
# legacy port_forwarding field then the forwarding controls configured in ssh_port_forwarding will be
142+
# ignored.
143+
ssh_port_forwarding:
144+
# configures remote port forwarding behavior
145+
remote:
146+
enabled: true
147+
# configures local port forwarding behavior
148+
local:
149+
enabled: true
140150
# ssh_file_copy controls whether file copying (SCP/SFTP) is allowed.
141151
# Defaults to true.
142152
ssh_file_copy: false

‎docs/pages/includes/role-spec.mdx

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,18 @@ spec:
1313
max_session_ttl: 8h
1414
# forward_agent controls whether SSH agent forwarding is allowed
1515
forward_agent: true
16-
# port_forwarding controls whether TCP port forwarding is allowed for SSH
17-
port_forwarding: true
16+
# ssh_port_forwarding controls which TCP port forwarding modes are allowed over SSH. This replaces
17+
# the deprecated port_forwarding field, which did not differentiate between remote and local
18+
# port forwarding modes. If you have any existing roles that allow forwarding by enabling the
19+
# legacy port_forwarding field then the forwarding controls configured in ssh_port_forwarding will be
20+
# ignored.
21+
ssh_port_forwarding:
22+
# configures remote port forwarding behavior
23+
remote:
24+
enabled: true
25+
# configures local port forwarding behavior
26+
local:
27+
enabled: true
1828
# ssh_file_copy controls whether file copying (SCP/SFTP) is allowed.
1929
# Defaults to true.
2030
ssh_file_copy: false

‎docs/pages/reference/access-controls/roles.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ user:
5252
| - | - | - |
5353
| `max_session_ttl` | Max. time to live (TTL) of a user's SSH certificates | The shortest TTL wins |
5454
| `forward_agent` | Allow SSH agent forwarding | Logical "OR" i.e. if any role allows agent forwarding, it's allowed |
55-
| `port_forwarding` | Allow TCP port forwarding | Logical "OR" i.e. if any role allows port forwarding, it's allowed |
55+
| `ssh_port_forwarding` | Allow TCP port forwarding | Logical "AND" i.e. if any role denies port forwarding, it's denied |
5656
| `ssh_file_copy` | Allow SCP/SFTP | Logical "AND" i.e. if all roles allows file copying, it's allowed |
5757
| `client_idle_timeout` | Forcefully terminate active sessions after an idle interval | The shortest timeout value wins, i.e. the most restrictive value is selected |
5858
| `disconnect_expired_cert` | Forcefully terminate active sessions when a client certificate expires | Logical "OR" i.e. evaluates to "yes" if at least one role requires session termination |

‎docs/pages/reference/terraform-provider/resources/role.mdx

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,17 @@ resource "teleport_role" "example" {
2727
2828
spec = {
2929
options = {
30-
forward_agent = false
31-
max_session_ttl = "7m"
32-
port_forwarding = false
30+
forward_agent = false
31+
max_session_ttl = "7m"
32+
ssh_port_forwarding = {
33+
remote = {
34+
enabled = false
35+
}
36+
37+
local = {
38+
enabled = false
39+
}
40+
}
3341
client_idle_timeout = "1h"
3442
disconnect_expired_cert = true
3543
permit_x11_forwarding = false

‎examples/resources/admin.yaml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,5 +28,9 @@ spec:
2828
- network
2929
forward_agent: true
3030
max_session_ttl: 30h0m0s
31-
port_forwarding: true
31+
ssh_port_forwarding:
32+
remote:
33+
enabled: true
34+
local:
35+
enabled: true
3236
version: v3

‎examples/resources/user.yaml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,5 +56,9 @@ spec:
5656
- network
5757
forward_agent: true
5858
max_session_ttl: 30h0m0s
59-
port_forwarding: true
59+
ssh_port_forwarding:
60+
remote:
61+
enabled: true
62+
local:
63+
enabled: true
6064
version: v3

‎integrations/terraform/examples/resources/teleport_role/resource.tf

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,17 @@ resource "teleport_role" "example" {
1313

1414
spec = {
1515
options = {
16-
forward_agent = false
17-
max_session_ttl = "7m"
18-
port_forwarding = false
16+
forward_agent = false
17+
max_session_ttl = "7m"
18+
ssh_port_forwarding = {
19+
remote = {
20+
enabled = false
21+
}
22+
23+
local = {
24+
enabled = false
25+
}
26+
}
1927
client_idle_timeout = "1h"
2028
disconnect_expired_cert = true
2129
permit_x11_forwarding = false

‎integrations/terraform/reference.mdx

Lines changed: 36 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2051,7 +2051,8 @@ Options is for OpenSSH options like agent forwarding.
20512051
| max_sessions | number | | MaxSessions defines the maximum number of concurrent sessions per connection. |
20522052
| permit_x11_forwarding | bool | | PermitX11Forwarding authorizes use of X11 forwarding. |
20532053
| pin_source_ip | bool | | PinSourceIP forces the same client IP for certificate generation and usage |
2054-
| port_forwarding | bool | | |
2054+
| ssh_port_forwarding | object | | SSHPortForwarding configures what types of SSH port forwarding are allowed by a role. |
2055+
| port_forwarding | bool | | Deprecated: Use SSHPortForwarding instead. |
20552056
| record_session | object | | RecordDesktopSession indicates whether desktop access sessions should be recorded. It defaults to true unless explicitly set to false. |
20562057
| request_access | string | | RequestAccess defines the access request strategy (optional|note|always) where optional is the default. |
20572058
| request_prompt | string | | RequestPrompt is an optional message which tells users what they aught to request. |
@@ -2085,6 +2086,31 @@ SAML are options related to the Teleport SAML IdP.
20852086
|---------|------|----------|-------------|
20862087
| enabled | bool | | |
20872088

2089+
##### spec.options.ssh_port_forwarding
2090+
2091+
SSHPortForwarding configures what types of SSH port forwarding are allowed by a role.
2092+
2093+
| Name | Type | Required | Description |
2094+
|--------|--------|----------|-----------------------------------------------------------|
2095+
| remote | object | | remote contains options related to remote port forwarding |
2096+
| local | object | | local contains options related to local port forwarding |
2097+
2098+
###### spec.options.ssh_port_forwarding.remote
2099+
2100+
remote contains options related to remote port forwarding
2101+
2102+
| Name | Type | Required | Description |
2103+
|---------|------|----------|-------------|
2104+
| enabled | bool | | |
2105+
2106+
###### spec.options.ssh_port_forwarding.local
2107+
2108+
local contains options related to local port forwarding
2109+
2110+
| Name | Type | Required | Description |
2111+
|---------|------|----------|-------------|
2112+
| enabled | bool | | |
2113+
20882114
##### spec.options.record_session
20892115

20902116
RecordDesktopSession indicates whether desktop access sessions should be recorded. It defaults to true unless explicitly set to false.
@@ -2114,11 +2140,19 @@ resource "teleport_role" "example" {
21142140
options = {
21152141
forward_agent = false
21162142
max_session_ttl = "7m"
2117-
port_forwarding = false
21182143
client_idle_timeout = "1h"
21192144
disconnect_expired_cert = true
21202145
permit_x11_forwarding = false
21212146
request_access = "denied"
2147+
ssh_port_forwarding = {
2148+
remote = {
2149+
enabled = false
2150+
}
2151+
2152+
local = {
2153+
enabled = false
2154+
}
2155+
}
21222156
}
21232157
21242158
allow = {

‎rfd/0007-rbac-oss.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,11 @@ role:
9090
name: user
9191
spec:
9292
options:
93-
port_forwarding: true
93+
ssh_port_forwarding:
94+
remote:
95+
enabled: true
96+
local:
97+
enabled: true
9498
max_session_ttl: 30h
9599
forward_agent: true
96100
enhanced_recording: ['command', 'network']

‎rfd/0008-application-access.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -303,7 +303,11 @@ version: v3
303303
spec:
304304
options:
305305
forward_agent: true
306-
port_forwarding: false
306+
ssh_port_forwarding:
307+
remote:
308+
enabled: false
309+
local:
310+
enabled: false
307311
allow:
308312
logins: ["rjones"]
309313
# Application labels define labels that an application must match for this

0 commit comments

Comments
 (0)