[sec_scan][5] add secrets backend service #43543

tigrato · 2024-06-26T14:21:33Z

This PR implements the backend service to support storing authorized_keys and private_keys into Teleport backend.

Part of https://github.com/gravitational/access-graph/issues/637

This PR implements the backend service to support storing `authorized_keys` and `private_keys` into Teleport backend. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]>

tigrato · 2024-07-09T12:56:47Z

Friendly ping @smallinsky @rudream

smallinsky

I have left a few suggestions but I have limited understending how/when keys will be upserted.

Itself the backend storage functionality LGTM but I have left a few concerns about naming.

smallinsky · 2024-07-09T13:18:32Z

api/types/accessgraph/authorized_key.go

+			Expires: timestamppb.New(
+				time.Now().Add(defaultKeyTTL),
+			),


In current design it will be not way to mock the expiration time.

Does it make sense to inject the header and allow to set the name and the expiration time from outside ?

func NewAuthorizedKey(metadata header.Metadata, spec *accessgraphv1pb.AuthorizedKeySpec) (*accessgraphv1pb.AuthorizedKey, error)

and generate the name value is CheckAndSetDefault ?

This isn't a big issue because you can always reset it after.

api/types/constants.go

lib/services/local/access_graph.go

smallinsky · 2024-07-09T15:04:20Z

api/types/accessgraph/private_key.go

+	if k.Spec.PublicKeyFingerprint == "" && k.Spec.PublicKeyMode != accessgraphv1pb.PublicKeyMode_PUBLIC_KEY_MODE_PROTECTED {
+		return trace.BadParameter("PublicKeyFingerprint is unset")
+	}


This is a bit confusing the there PrivateKeySpec has PublicKeyFingerprint and itself the references to Public Key and the any uniq members related to private key.

Does it make sense to rename it to something like: SSHKeyDetails

the PrivateKeySpec holds the public key fingerprint.

We do read the private key, extract the public key from it and compute the SHA256 fingerprint before sending it to teleport.

Why the private key needs to be read at first place. Does it make sense to read the public key and get the signature without read to read sensitive private key ?

smallinsky · 2024-07-09T15:05:47Z

lib/services/local/access_graph.go

+}
+
+// ListPrivateKeysForDevice lists all private keys for a given deviceID.
+func (k *AccessGraphSecretsService) ListPrivateKeysForDevice(ctx context.Context, deviceID string, pageSize int, pageToken string) ([]*accessgraphsecretspb.PrivateKey, string, error) {


At first glance this look scary that we are listing PrivateKeys. Can we just rework this to ListSSHKeysDetails ?

These are not private keys. We call them private keys because they represent a private key in the host machine but they actually just store the fingerprint of the public key derived from a private key.

There is no private key material leaving the user's laptop so this is 100% safe.
besides that, there won't be a public api to export these findings to the outside.

I agree with Marek. If this API doesn't list private keys, I'd not call it "ListPrivateKeys".

smallinsky · 2024-07-09T15:29:37Z

lib/services/local/access_graph.go

+
+// UpsertPrivateKey upserts a new private key.
+func (k *AccessGraphSecretsService) UpsertPrivateKey(ctx context.Context, in *accessgraphsecretspb.PrivateKey) (*accessgraphsecretspb.PrivateKey, error) {
+	svc := k.privateKeysSvc.WithPrefix(in.Spec.DeviceId)


Wonder why the deviceId prefix is needed the name consist with user + deviceID and fingerprint hash.

Does the backend will also have ability to list all keys from particular machine. If not the DeviceID prefix can be removed from backend item path.

Since each device reports all the new findings, we need to list the last reported data for a certain device to reconcile. everything happens server side!

api/types/accessgraph/authorized_key.go

api/types/accessgraph/authorized_key_test.go

api/types/accessgraph/private_key_test.go

jakule · 2024-07-09T17:11:24Z

lib/services/local/access_graph.go

+}
+
+// ListPrivateKeysForDevice lists all private keys for a given deviceID.
+func (k *AccessGraphSecretsService) ListPrivateKeysForDevice(ctx context.Context, deviceID string, pageSize int, pageToken string) ([]*accessgraphsecretspb.PrivateKey, string, error) {


I agree with Marek. If this API doesn't list private keys, I'd not call it "ListPrivateKeys".

public-teleport-github-review-bot · 2024-07-11T09:00:06Z

@tigrato See the table below for backport results.

Branch	Result
branch/v14	Failed
branch/v15	Failed
branch/v16	Create PR

* [sec_scan][5] add secrets backend service This PR implements the backend service to support storing `authorized_keys` and `private_keys` into Teleport backend. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]> * handle feedback * handle nits --------- Signed-off-by: Tiago Silva <[email protected]>

* Add the device assertion protos (#43804) * Add the device assertion protos * Update generated protos * Add a client-side API to assert devices (#43890) * Add a client-side API to assert devices * Add a godoc to authnStreamAdapter * Define server-side device assertion interfaces (#44036) * Define server-side device assertion interfaces * Update proto comments * Update generated protos * [sec_scan][1] Add `teleport.access_graph.v1.SecretsScannerService` (#43462) This PR introduces the `teleport.access_graph.v1.SecretsScannerService`that will be used by Teleport SSH nodes to report `authorized_keys` and user's laptops to report secrets found on them. The `ReportAuthorizedKeys` uses node's TLS certs signed by HostCA for authentication while `ReportSecrets` leverages the device trust credentials (requires that the device is enrolled) to report secrets without requiring valid user credentials. handle Alan's feedback * [sec_scan][2] expose `ssh_scan_enabled` in `AccessGraphConfig` response (#43467) This PR exposes the configuration for nodes to be aware that they should report SSH Authorized keys to Teleport. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][3] add `PrivateKey`, `AuthorizedKey` and `Device` to Access Graph resources (#43468) This PR extends the Access Graph resources to be able include the newly added `teleport.access_graph.v1.PrivateKey`, `teleport.access_graph.v1.AuthorizedKey` and existing device trust information `teleport.devicetrust.v1.Device`. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]> * fix: fix `nextKey` values when using multiple prefixes (#43486) This PR makes `generic.Service` correctly implementing `List*` functions when multiple key prefixes are defined Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][5] add secrets backend service (#43543) * [sec_scan][5] add secrets backend service This PR implements the backend service to support storing `authorized_keys` and `private_keys` into Teleport backend. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]> * handle feedback * handle nits --------- Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][6] add device events (#43905) This PR adds the ability to watch for events for `*devicepb.Device` objects. Backend storage representation of `devicepb.Device` is achieved using an internal representation that lives in `e/lib/devicetrust/storage` and whose logic is internal to the package. To be able to expose the unmarshal logic necessary for events to work, this PR exposes a registration hook that `e/lib/devicetrust/storage` function must call during initialization to register the unmarshal function. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][7] add authorizedKeys and privateKeys events support (#43906) This PR introduces the ability to watch for events related to `accessgraphsecretsv1pb.AuthorizedKey` and `accessgraphsecretsv1pb.PrivateKey` objects. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][9] add `access_graph_settings` protobuf (#44010) This PR adds the `clusterconfigpbv1.AccessGraphSettings` resource that will be used to control the secrets scanning definition of Teleport. This resource will be a singleton and the only goal is to carry some settings related to access graph because on the cloud, users don't have access to fileconf. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][10] add `AccessGraphSettingsUpdate` audit event (#44011) This PR adds the boilerplate code and proto definition for `AccessGraphSettingsUpdate` audit event. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][11] add `AccessGraphSettings` backend service (#44014) This PR adds the backend service to be able to create, update and retrieve access graph configurations from Teleport backend. This PR is part of gravitational/access-graph#637. * [sec_scan][12] add cache and events support for `AccessGraphSettings` (#44016) * [sec_scan][12] add cache and events support for `AccessGraphSettings` This PR adds the cache and events support for the new resource `AccessGraphSettings`. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * add tests --------- Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][13] add `AccessGraphSettings` gRPC implementation (#44021) This PR introduces the gRPC implementation for the CRUD operations related to `AccessGraphSettings`. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][14] create `AccessGraphSettings` on first auth init (#44032) * [sec_scan][14] create `AccessGraphSettings` on first auth init This PR adds a init script that sets `AccessGraphSettings` into Teleport backend when auth first inits and there is no `AccessGraphSettings`. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * remove iterations --------- Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][15] add support for edits to `AccessGraphSettings` via `tctl` (#44055) This PR allows any cluster admin to edit `access_graph_settings` objects via `tctl`. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][16] add methods to store/retrieve device assertion functions (#44081) This PR adds methods to store/retrieve functions defined by different teleport services. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][17] add `AssertDevice` to `FakeDeviceService` (#44159) * [sec_scan][17] add `AssertDevice` to `FakeDeviceService` This PR introduces a `AssertDevice` logic into `FakeDeviceService` to authenticate devices during unit tests using device trust credentials. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * simplify assert tests * Update lib/devicetrust/assert/assert_test.go Co-authored-by: Alan Parra <[email protected]> --------- Signed-off-by: Tiago Silva <[email protected]> Co-authored-by: Alan Parra <[email protected]> * [sec_scan][20] add `ReportSecrets` forwarder to proxy's gRPC insecure server (#44324) * [sec_scan][20] add `ReportSecrets` forwarder to proxy's gRPC insecure server This PR implements a `ReportSecrets` forwarder from Proxy server to Auth server. The goal is to allow clients to hit the proxy insecure gRPC server (credentialless) and proxy will forward requests to the AuthServer on behalf of the client. This is required because the client doesn't have valid credentials and it wasn't possible for it to reach auth server via reversetunnel when the cluster uses `separate` mode. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * add comments * move dial to lib/client/proxy/insecure --------- Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][19] add `tsh scan keys` implementation (#44220) * [sec_scan][19] add `tsh scan keys` implementation This PR introduces the required code to transverse a directory(es), finding all the SSH private keys and report them back to the cluster using the device security enclave as authentication mechanism. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * handle code review * fix message * handle code review * fork ssh private keys * add skip dirs support * handle code review --------- Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][22] add authorized keys reporter (#44523) * [sec_scan][22] add authorized keys reporter This PR introduces a SSH authorized keys reporter that monitors `/etc/passwd` file and all users' authorized_keys files and reports the findings back to teleport. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]> * handle comments * handle comments --------- Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][24] extract AuthorizedKey's comment and type (#44643) This PR adds ability to extract the comment and key type from AuthorizedKeys files. Signed-off-by: Tiago Silva <[email protected]> * fix api module * [sec_scan][27] add support for LDAP users and macOS (#45109) * [sec_scan][27] add support for LDAP users and macOS This PR extends support for authorized keys report for users managed by LDAP system and macOS targets. It leverages `getpwent` to read the system database files and retrieve the user properties. It doesn't use the `getpwent_r` because it's not available in macOS and because it's not (yet) standerdized > PLEASE NOTE: the `getpwent_r' function is not (yet) standardized. > The interface may change in later versions of this library. But > the interface is designed following the principals used for the > other reentrant functions so the chances are good this is what the > POSIX people would choose. Part of gravitational/access-graph#637 * handle comments * handle comments 2 * add comment --------- Signed-off-by: Tiago Silva <[email protected]> Co-authored-by: Alan Parra <[email protected]>

* Add the device assertion protos (#43804) * Add the device assertion protos * Update generated protos * Add a client-side API to assert devices (#43890) * Add a client-side API to assert devices * Add a godoc to authnStreamAdapter * Define server-side device assertion interfaces (#44036) * Define server-side device assertion interfaces * Update proto comments * Update generated protos * [sec_scan][1] Add `teleport.access_graph.v1.SecretsScannerService` (#43462) This PR introduces the `teleport.access_graph.v1.SecretsScannerService`that will be used by Teleport SSH nodes to report `authorized_keys` and user's laptops to report secrets found on them. The `ReportAuthorizedKeys` uses node's TLS certs signed by HostCA for authentication while `ReportSecrets` leverages the device trust credentials (requires that the device is enrolled) to report secrets without requiring valid user credentials. handle Alan's feedback * [sec_scan][2] expose `ssh_scan_enabled` in `AccessGraphConfig` response (#43467) This PR exposes the configuration for nodes to be aware that they should report SSH Authorized keys to Teleport. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][3] add `PrivateKey`, `AuthorizedKey` and `Device` to Access Graph resources (#43468) This PR extends the Access Graph resources to be able include the newly added `teleport.access_graph.v1.PrivateKey`, `teleport.access_graph.v1.AuthorizedKey` and existing device trust information `teleport.devicetrust.v1.Device`. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]> * fix: fix `nextKey` values when using multiple prefixes (#43486) This PR makes `generic.Service` correctly implementing `List*` functions when multiple key prefixes are defined Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][5] add secrets backend service (#43543) * [sec_scan][5] add secrets backend service This PR implements the backend service to support storing `authorized_keys` and `private_keys` into Teleport backend. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]> * handle feedback * handle nits --------- Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][6] add device events (#43905) This PR adds the ability to watch for events for `*devicepb.Device` objects. Backend storage representation of `devicepb.Device` is achieved using an internal representation that lives in `e/lib/devicetrust/storage` and whose logic is internal to the package. To be able to expose the unmarshal logic necessary for events to work, this PR exposes a registration hook that `e/lib/devicetrust/storage` function must call during initialization to register the unmarshal function. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][7] add authorizedKeys and privateKeys events support (#43906) This PR introduces the ability to watch for events related to `accessgraphsecretsv1pb.AuthorizedKey` and `accessgraphsecretsv1pb.PrivateKey` objects. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][9] add `access_graph_settings` protobuf (#44010) This PR adds the `clusterconfigpbv1.AccessGraphSettings` resource that will be used to control the secrets scanning definition of Teleport. This resource will be a singleton and the only goal is to carry some settings related to access graph because on the cloud, users don't have access to fileconf. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][10] add `AccessGraphSettingsUpdate` audit event (#44011) This PR adds the boilerplate code and proto definition for `AccessGraphSettingsUpdate` audit event. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][11] add `AccessGraphSettings` backend service (#44014) This PR adds the backend service to be able to create, update and retrieve access graph configurations from Teleport backend. This PR is part of gravitational/access-graph#637. * [sec_scan][12] add cache and events support for `AccessGraphSettings` (#44016) * [sec_scan][12] add cache and events support for `AccessGraphSettings` This PR adds the cache and events support for the new resource `AccessGraphSettings`. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * add tests --------- Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][13] add `AccessGraphSettings` gRPC implementation (#44021) This PR introduces the gRPC implementation for the CRUD operations related to `AccessGraphSettings`. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][14] create `AccessGraphSettings` on first auth init (#44032) * [sec_scan][14] create `AccessGraphSettings` on first auth init This PR adds a init script that sets `AccessGraphSettings` into Teleport backend when auth first inits and there is no `AccessGraphSettings`. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * remove iterations --------- Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][15] add support for edits to `AccessGraphSettings` via `tctl` (#44055) This PR allows any cluster admin to edit `access_graph_settings` objects via `tctl`. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][16] add methods to store/retrieve device assertion functions (#44081) This PR adds methods to store/retrieve functions defined by different teleport services. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][17] add `AssertDevice` to `FakeDeviceService` (#44159) * [sec_scan][17] add `AssertDevice` to `FakeDeviceService` This PR introduces a `AssertDevice` logic into `FakeDeviceService` to authenticate devices during unit tests using device trust credentials. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * simplify assert tests * Update lib/devicetrust/assert/assert_test.go Co-authored-by: Alan Parra <[email protected]> --------- Signed-off-by: Tiago Silva <[email protected]> Co-authored-by: Alan Parra <[email protected]> * [sec_scan][20] add `ReportSecrets` forwarder to proxy's gRPC insecure server (#44324) * [sec_scan][20] add `ReportSecrets` forwarder to proxy's gRPC insecure server This PR implements a `ReportSecrets` forwarder from Proxy server to Auth server. The goal is to allow clients to hit the proxy insecure gRPC server (credentialless) and proxy will forward requests to the AuthServer on behalf of the client. This is required because the client doesn't have valid credentials and it wasn't possible for it to reach auth server via reversetunnel when the cluster uses `separate` mode. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * add comments * move dial to lib/client/proxy/insecure --------- Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][19] add `tsh scan keys` implementation (#44220) * [sec_scan][19] add `tsh scan keys` implementation This PR introduces the required code to transverse a directory(es), finding all the SSH private keys and report them back to the cluster using the device security enclave as authentication mechanism. This PR is part of gravitational/access-graph#637. Signed-off-by: Tiago Silva <[email protected]> * handle code review * fix message * handle code review * fork ssh private keys * add skip dirs support * handle code review --------- Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][22] add authorized keys reporter (#44523) * [sec_scan][22] add authorized keys reporter This PR introduces a SSH authorized keys reporter that monitors `/etc/passwd` file and all users' authorized_keys files and reports the findings back to teleport. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]> * handle comments * handle comments --------- Signed-off-by: Tiago Silva <[email protected]> * [sec_scan][24] extract AuthorizedKey's comment and type (#44643) This PR adds ability to extract the comment and key type from AuthorizedKeys files. Signed-off-by: Tiago Silva <[email protected]> * update gomod * [sec_scan][27] add support for LDAP users and macOS (#45109) * [sec_scan][27] add support for LDAP users and macOS This PR extends support for authorized keys report for users managed by LDAP system and macOS targets. It leverages `getpwent` to read the system database files and retrieve the user properties. It doesn't use the `getpwent_r` because it's not available in macOS and because it's not (yet) standerdized > PLEASE NOTE: the `getpwent_r' function is not (yet) standardized. > The interface may change in later versions of this library. But > the interface is designed following the principals used for the > other reentrant functions so the chances are good this is what the > POSIX people would choose. Part of gravitational/access-graph#637 * handle comments * handle comments 2 * add comment --------- Signed-off-by: Tiago Silva <[email protected]> Co-authored-by: Alan Parra <[email protected]>

tigrato added backport/branch/v14 no-changelog Indicates that a PR does not require a changelog entry backport/branch/v15 backport/branch/v16 labels Jun 26, 2024

tigrato marked this pull request as ready for review July 8, 2024 09:40

github-actions bot added the size/lg label Jul 8, 2024

github-actions bot requested review from rudream and smallinsky July 8, 2024 09:41

tigrato force-pushed the tigrato/ssh-keys-impl4 branch from b06e835 to 59ef61d Compare July 9, 2024 09:20

Base automatically changed from tigrato/ssh-keys-impl4 to master July 9, 2024 10:09

tigrato force-pushed the tigrato/ssh-keys-impl5 branch 3 times, most recently from 8f7e716 to 14e2b8b Compare July 9, 2024 11:03

[sec_scan][5] add secrets backend service

9380571

This PR implements the backend service to support storing `authorized_keys` and `private_keys` into Teleport backend. Part of gravitational/access-graph#637 Signed-off-by: Tiago Silva <[email protected]>

tigrato force-pushed the tigrato/ssh-keys-impl5 branch from 14e2b8b to 9380571 Compare July 9, 2024 12:55

smallinsky reviewed Jul 9, 2024

View reviewed changes

handle feedback

321eda8

tigrato requested a review from smallinsky July 9, 2024 16:36

jakule reviewed Jul 9, 2024

View reviewed changes

jakule mentioned this pull request Jul 9, 2024

[sec_scan][7] add authorizedKeys and privateKeys events support #43906

Merged

handle nits

dc6b13d

smallinsky approved these changes Jul 10, 2024

View reviewed changes

jakule approved these changes Jul 11, 2024

View reviewed changes

public-teleport-github-review-bot bot removed the request for review from rudream July 11, 2024 04:32

tigrato added this pull request to the merge queue Jul 11, 2024

Merged via the queue into master with commit 157d0d7 Jul 11, 2024
39 checks passed

tigrato deleted the tigrato/ssh-keys-impl5 branch July 11, 2024 08:58

tigrato mentioned this pull request Jul 30, 2024

[v16] Backport Secrets scanner #44799

Merged

tigrato mentioned this pull request Jul 30, 2024

[v15] Backport Secrets scanner #44800

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[sec_scan][5] add secrets backend service #43543

[sec_scan][5] add secrets backend service #43543

tigrato commented Jun 26, 2024

tigrato commented Jul 9, 2024

smallinsky left a comment

smallinsky Jul 9, 2024

tigrato Jul 9, 2024

smallinsky Jul 9, 2024

tigrato Jul 9, 2024

smallinsky Jul 10, 2024

smallinsky Jul 9, 2024

tigrato Jul 9, 2024

jakule Jul 9, 2024

smallinsky Jul 9, 2024

tigrato Jul 9, 2024

jakule Jul 9, 2024

public-teleport-github-review-bot bot commented Jul 11, 2024

[sec_scan][5] add secrets backend service #43543

[sec_scan][5] add secrets backend service #43543

Conversation

tigrato commented Jun 26, 2024

tigrato commented Jul 9, 2024

smallinsky left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

public-teleport-github-review-bot bot commented Jul 11, 2024