-
Notifications
You must be signed in to change notification settings - Fork 1.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Remove admonition about being in preview - Add audit events listing - Break reference.mdx up into separate pages
- Loading branch information
Showing
8 changed files
with
382 additions
and
167 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,137 @@ | ||
| --- | ||
| title: Desktop Access Access Controls | ||
| description: Role-based access control (RBAC) for Teleport Desktop Access | ||
| --- | ||
|
|
||
| # Desktop Access Role-Based Access Control | ||
|
|
||
| Teleport's RBAC allows administrators to set up granular access policies for | ||
| Windows desktops connected to Teleport. | ||
|
|
||
| Teleport's "role" resource provides the following instruments for controlling | ||
| desktop access: | ||
|
|
||
| ```yaml | ||
| kind: role | ||
| version: v4 | ||
| metadata: | ||
| name: developer | ||
| spec: | ||
| options: | ||
| # Specify whether or not to record the user's desktop sessions. | ||
| # Desktop session recording is enabled if one or more of the user's | ||
| # roles has enabled recording. Defaults to true if unspecified. | ||
| # Desktop sessions will never be recorded if auth_service.session_recording | ||
| # is set to 'off' in teleport.yaml or if the cluster's session_recording_config | ||
| # resource has set 'mode: off'. | ||
| record_sessions: | ||
| desktop: true | ||
|
|
||
| # Specify whether clipboard sharing should be allowed with the | ||
| # remote desktop (requires a supported browser). Defaults to true | ||
| # if unspecified. If one or more of the user's roles has disabled | ||
| # the clipboard, then it will be disabled. | ||
| desktop_clipboard: true | ||
| allow: | ||
| # Label selectors for desktops this role has access to. | ||
| windows_desktop_labels: | ||
| environment: ["dev", "stage"] | ||
|
|
||
| # Windows user accounts this role can connect as. | ||
| windows_desktop_logins: ["Administrator", "{{internal.windows_logins}}"] | ||
| ``` | ||
| <Admonition type="warning" title="Active Directory Configuration"> | ||
| Teleport's RBAC system is not a replacement for proper Active Directory | ||
| administration. Teleport-issued Windows certificates are valid for a small | ||
| amount of time, but they do apply to the entire domain. Proper care should be | ||
| taken to ensure that each Teleport user's roles reflect only the necesary | ||
| Windows logins, and that these Windows users are properly secured. | ||
| </Admonition> | ||
| ## Labeling | ||
| Both `allow` and `deny` rules support `windows_desktop_labels` selectors. These | ||
| selectors are matched against the labels set on the desktop. It is possible to | ||
| use wildcards (`"*"`) to match all desktop labels. | ||
|
|
||
| Windows desktops acquire labels in two ways: | ||
|
|
||
| 1. The `host_labels` rules defined in the Windows Desktop Service configuration | ||
| 2. Automatic `teleport.dev/` labels applied by Teleport (for desktops discovered | ||
| via LDAP only) | ||
|
|
||
| For example, the following `host_labels` configuration would apply the | ||
| `environment: dev` label to a Windows desktop named `test.dev.example.com`, | ||
| and the `environment: prod` label to `desktop.prod.example.com`: | ||
|
|
||
| ```yaml | ||
| host_labels: | ||
| - match: '^.*\.dev\.example\.com$' | ||
| labels: | ||
| environment: dev | ||
| - match: '^.*\.prod\.example\.com$' | ||
| labels: | ||
| environment: prod | ||
| ``` | ||
|
|
||
| For desktops discovered via LDAP, Teleport applies the following labels automatically: | ||
|
|
||
| | Label | LDAP Attribute | Example | | ||
| | ----- | -------------- | ------- | | ||
| | `teleport.dev/computer_name` | `name` | `WIN-I5G06B8RT33` | ||
| | `teleport.dev/dns_host_name` | [`dNSHostName`](https://docs.microsoft.com/en-us/windows/win32/adschema/a-dnshostname) | `WIN-I5G06B8RT33.example.com` | ||
| | `teleport.dev/os` | [`operatingSystem`](https://docs.microsoft.com/en-us/windows/win32/adschema/a-operatingsystem) | `Windows Server 2012` | ||
| | `teleport.dev/os_version`| [`osVersion`](https://docs.microsoft.com/en-us/windows/win32/adschema/a-operatingsystemversion) | `4.0` | ||
| | `teleport.dev/windows_domain`| Sourced from config | `example.com` | ||
| | `teleport.dev/is_domain_controller` | `primaryGroupID` | `true` | ||
|
|
||
| ## Logins | ||
|
|
||
| The `windows_desktop_logins` role setting lists the Windows user accounts that | ||
| the role permits access to. Like with SSH access, the | ||
| `{{internal.windows_logins}}` variable can be used for local users, which maps | ||
| to any logins that are supplied when the user is created with | ||
| `tctl users add alice --windows-logins=Administrator,DBUser`. | ||
|
|
||
| New clusters automatically populate the preset `access` role with the following: | ||
|
|
||
| ```yaml | ||
| allow: | ||
| windows_desktop_logins: ["{{internal.windows_logins}}"] | ||
| ``` | ||
|
|
||
| ## Clipboard Access | ||
|
|
||
| In order to a user to copy and paste between a remote desktop and their local | ||
| workstation, shared clipboard must be enabled for the user. The | ||
| `desktop_clipboard` role option defaults to enabled if unspecified. To disable | ||
| clipboard sharing for a Teleport user, ensure that they are assigned at least | ||
| one role that explicitly disables clipboard sharing: | ||
|
|
||
| ```yaml | ||
| desktop_clipboard: false | ||
| ``` | ||
|
|
||
| ## Session Recording | ||
|
|
||
| In order for a Teleport user's desktop sessions to be recorded, the following must | ||
| both be true: | ||
|
|
||
| - Session recording is enabled (i.e. not set to `off`) on the cluster. This | ||
| setting resides in `teleport.yaml` under `auth_service.session_recording`, but | ||
| can also be configured dynamically via the cluster's | ||
| `session_recording_config` resource. | ||
| - The user's roles enable desktop session recording. | ||
|
|
||
| By default, desktop session recording is considered enabled in Teleport roles | ||
| unless it is explicitly disabled: | ||
|
|
||
| ```yaml | ||
| record_sessions: | ||
| desktop: false | ||
| ``` | ||
|
|
||
| In order to disable desktop session recording for a user, _all_ of the user's | ||
| roles must disable it. In other words, the presence of a single role which | ||
| enables recording is enough to ensure sessions are recorded. |
This file was deleted.
Oops, something went wrong.
Oops, something went wrong.