6 Commits (a2c42d3cd4e914b8ac879ac0a21c284ecaf143fc)

Author	SHA1	Message	Date
Percy Wegmann	4b525fdda0	ssh/tailssh: only chdir incubator process to user's homedir when necessary and possible ... Instead of changing the working directory before launching the incubator process, this now just changes the working directory after dropping privileges, at which point we're more likely to be able to enter the user's home directory since we're running as the user. For paths that use the 'login' or 'su -l' commands, those already take care of changing the working directory to the user's home directory. Fixes #13120 Signed-off-by: Percy Wegmann <percy@tailscale.com>	3 months ago
Percy Wegmann	7d83056a1b	ssh/tailssh: fix SSH on busybox systems ... This involved the following: 1. Pass the su command path as first of args in call to unix.Exec to make sure that busybox sees the correct program name. Busybox is a single executable userspace that implements various core userspace commands in a single binary. You'll see it used via symlinking, so that for example /bin/su symlinks to /bin/busybox. Busybox knows that you're trying to execute /bin/su because argv[0] is '/bin/su'. When we called unix.Exec, we weren't including the program name for argv[0], which caused busybox to fail with 'applet not found', meaning that it didn't know which command it was supposed to run. 2. Tell su to whitelist the SSH_AUTH_SOCK environment variable in order to support ssh agent forwarding. 3. Run integration tests on alpine, which uses busybox. 4. Increment CurrentCapabilityVersion to allow turning on SSH V2 behavior from control. Fixes #12849 Signed-off-by: Percy Wegmann <percy@tailscale.com>	3 months ago
Percy Wegmann	730f0368d0	ssh/tailssh: replace incubator process with su instead of running su as child ... This allows the SSH_AUTH_SOCK environment variable to work inside of su and agent forwarding to succeed. Fixes #12467 Signed-off-by: Percy Wegmann <percy@tailscale.com>	5 months ago
Percy Wegmann	d7fdc01f7f	ssh/tailssh: check IsSELinuxEnforcing in tailscaled process ... Checking in the incubator as this used to do fails because the getenforce command is not on the PATH. Updates #12442 Signed-off-by: Percy Wegmann <percy@tailscale.com>	5 months ago
Percy Wegmann	08a9551a73	ssh/tailssh: fall back to using su when no TTY available on Linux ... This allows pam authentication to run for ssh sessions, triggering automation like pam_mkhomedir. Updates #11854 Signed-off-by: Percy Wegmann <percy@tailscale.com>	6 months ago
Percy Wegmann	843afe7c53	ssh/tailssh: add integration test ... Updates tailscale/corp#11854 Signed-off-by: Percy Wegmann <percy@tailscale.com>	6 months ago