Forbid ssh key signing with specified extensions when role allowed_extensions is not set #12847
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
stevendpclark
force-pushed
the
stevendpclark/vault-3375-ssh-extension-fail-close
branch
from
f73c63b to
beee2ae
Compare
…tensions is not set - This is a behaviour change on how we process the allowed_extensions role parameter when it does not contain a value. The previous handling allowed a client to override and specify any extension they requested. - We now require a role to explicitly set this behaviour by setting the parameter to a '*' value which matches the behaviour of other keys such as allowed_users within the role. - No migration of existing roles is provided either, so operators if they truly want this behaviour will need to update existing roles appropriately.
stevendpclark
force-pushed
the
stevendpclark/vault-3375-ssh-extension-fail-close
branch
from
beee2ae to
181e590
Compare
stevendpclark
requested review from
sgmiller,
victorr,
cipherboy,
rculpepper and
divyapola5
stevendpclark
commented
Oct 15, 2021
sgmiller
approved these changes
Oct 15, 2021
| @@ -0,0 +1,5 @@ | |||
| ```release-note:breaking-change | |||
| secrets/ssh: Roles with empty allowed_extensions will now forbid end-users | |||
There was a problem hiding this comment.
I think this has to be a single line, though I'm not positive.
There was a problem hiding this comment.
I believe it's okay as 11775.txt (https://github.com/hashicorp/vault/blob/main/changelog/11775.txt) is multiple lines and seems to have generated ok: https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#180
victorr
reviewed
Oct 15, 2021
stevendpclark
deleted the
stevendpclark/vault-3375-ssh-extension-fail-close
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
parameter when it does not contain a value. The previous handling allowed
a client to override and specify any extension they requested signing of an ssh key
to a '*' value which matches the behaviour of other keys such as allowed_users
within the role.
want this behaviour will need to update existing roles appropriately.