teleport

Description

• SAML IdP
  • Fixed issue with SAML IdP advertising incorrect public address in some cases. #27376
  • Fixed issue with SAML IdP authentication failing on subsequent attempts. #27314
• Kubernetes Access
  • Fixed issue with simultaneous Kubernetes relogins opening multiple browser tabs. #27366
• Teleport Assist
  • Added Teleport Assist for Teleport Cloud users on Team plan. #27243
  • Fixed issue with intermittent connection reset and multiple UX tweaks. #27356
• Stability
  • Fixed issue with stalled auth server initialization when the backend is unavailable. #27298
• Web UI
  • Fixed issue with immediate web UI logout after successful login. #27296
  • Fixed issue with resource names sometimes now showing up in access requests. #27430
• CLI
  • Added support for creating Windows desktops via tctl. #27250
  • Fixed issue with tctl get all not returning locks. #27294
• Server Access
  • Fixed issue with access requests in headless mode. #27241
  • Fixed issue with port forwarding configuration being cached in tsh profile. #27208
• Database Access
  • Added support for automatic database user provisioning for PostgreSQL. #26555
  • Updated Elasticache support to automatically include IAM connect permissions. #27188
• Desktop Access
  • Fixed issue with automatic user creation failing in some cases. teleport.e#1579

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Description

• Auth
  • Fixed issue with headless auth not working when leaf cluster is selected. #26877
• CLI
  • Added support for registering Windows desktops using tctl. #27251
  • Added autocompletion support for bash and zsh. #26998
• Desktop Access
  • Increased LDAP dial timeout from 5 to 15 seconds. #27046
• Helm Charts
  • Improved clusterName validation in teleport-cluster chart. #26974
• Okta
  • Updated Okta import rules to support filtering user groups by description. #27020
• Performance & Scalability
  • Improved tsh login latency by fetching cluster alerts once. #27111
• Server Access
  • Fixed issue with port forwarding configuraiton being cached in tsh profile. #27207
• Tooling
  • Updated OpenSSL to 1.1.1u. #27113
• Web UI
  • Fixed issue with users being immediately logged out of web UI after completing SSO via OIDC. #27297

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Description

• Application Access
  • Updated tsh proxy app to not require explicit tsh app login. #26820
• Auth
  • Fixed issue with headless authentication not working when leaf cluster is selected. #26878
  • Fixed issue with GitHub Enterprise connector API endpoint URL path getting ignored. #26863
• CLI
  • Added tsh kubectl support for tracer exporter. #27130
  • Added support for bash and zsh autocompletion. #26999
  • Added support for calling tctl alert commands remotely. #26789
• Database Access
  • Added support for ElastiCache Redis IAM authentication. #26990
• Desktop Access
  • Increased LDAP dial timeout from 5 to 15 seconds. #27045
  • Improved LDAP error reporting. #26984
• Helm Charts
  • Improved clusterName validation in teleport-cluster Helm chart. #26973
• Kubernetes Operator
  • Fixed access denied issue when creating token resources. #27001
• Okta
  • Updated Okta import rules regex to support glob matching. #27126
  • Updated Okta import rules to support filtering user groups by description. #27021
• Performance & Scalability
  • Improved tsh login latency by making sure cluster alerts are fetched once. #27110
• Server Access
  • Added CA rotation support to EC2 OpenSSH discovery. #26888
  • Extended Proxy Templates support to tsh ssh. #26852
  • Fixed issue where system agent is not forwarded when using --add-keys-to-agent=no. #26929
• Tooling
  • Upgraded OpenSSL to 3.0.9. #27123
• TLS Routing
  • Added multiple UX improvements for tsh kube commands in TLS Routing mode behind ALB. #27155
• Web UI
  • Added back buttons to Access Management and Integrations flows where possible. #26727
  • Fixed issue with pagination buttons sometimes being invisible on the Nodes page. #26906

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Description

• Server Access
  • Fixed issue with system agent not being forwarding with --add-keys-to-agent=no. #26931
  • Fixed issue with enhanced recording SSH sessions sometimes failing to establish. #26730
  • Fixed issue with port forwarding silently failing on ambiguous label match. #26704
  • Fixed issue with random sudoer lines order in automatic host user creation. #24794
• Audit Log
  • Updated user login event to include list of applied login rules. #26476
• Desktop Access
  • Improved internal logging and user lookup efficiency. #26415
  • Fixed issue with directory sharing. #26092
• Database Access
  • Fixed issue with connecting to active Cassandra with tsh db connect. #26380
  • Fixed issue with connecting to Azure Cache for Redis with default user. #26320
• macOS
  • Ensured version in correctly set in tsh.app Info.plist. #26319
• Machine ID
  • Added pprof diagnostics endpoints to tbot. #26148
  • Fixed goroutine leak in tbot. #26147
• CLI
  • Improved error reporting for MFA. #26105
  • Improved error reporting for in-effect locks. #25481
  • Improved alert ack flows #26042
  • Fixed issue with tsh sometimes failing to display cluster alerts. #25301
  • Added tsh fido2 attobj debug command. #25927
• Trusted Clusters
  • Fixed issue with connecting to leaf cluster resources. #25922
• Terraform
  • Fixed ACL issue with creating S3 bucket in single-node terraform script. #25856
  • Fixed ACL issue with creating S3 bucket in HA terraform script. #25334
• HSM
  • Added support for YubiHSM2 SDK version 2023.01. #25818
  • Fixed issue with inadvertent deletion of active HSM keys. #25209
• IP Pinning
  • Fixed issue with IP pinning not working for PostgreSQL in separate listener mode. #25530
• Tooling
  • Updated Go to 1.20.4. #25507
• AMIs
  • Fixed issue with AMI init script failing to acquire lock. #25297
• MFA
  • Improved handling of accidental webauthn RPID changes. #25291
  • Improved performance of the MFA ceremony. #24829
• Teleport Connect
  • Fixed issue that could lead to UI crash during logout. #25183

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Description

• SSO
  • Fixed issue with Github Enterprise SSO not respecting custom API endpoint path. #26864
• Server Access
  • Extended Proxy Templates to support tsh ssh. #26853
• CLI
  • Added ability to run tctl alert commands remotely. #26791
• Web UI
  • Added back buttons to integrations and resource adding dialogs. #26726

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Description

• Access Management
  • Added macOS arm64 support to the node install script. #26504, #26698
  • Restored the "Add application" dialog. #26457
  • Updated node install script to respect cluster version. #26322
• Audit Log
  • Updated Okta events to include app and group names. #26370
  • Updated user login event to add list of applied login rules. #26474
• Desktop Access
  • Improved internal logging and user lookup efficiency. #26413
• Okta Access
  • Updated Okta import rules to support regex group and app name matching. #26799
• Server Access
  • Fixed issue with SSH sessions sometimes failing to start when enhanced session recording is enabled. #26728
  • Fixed issue with port forwarding silently failing when using a label based target. #26701
  • Added certificate rotation support to teleport join openssh command. #26674
  • Added support for using hostnames in OpenSSH node resources in addition to IPs. #26549
• Kubernetes Access
  • Extended kubectl auth can-i support to consider kubernetes_resources RBAC rules. #26584
• Kubernetes Operator
  • Added ProvisionToken support. #26618

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Description

This release of Teleport contains multiple improvements and bug fixes.

• Teleport Assist
  • Fixed React error in when navigating between Assist and web UI other pages. #26745
• Server Access
  • Fixed issue with SSH sessions sometimes failing to establish in enhanced session recording mode. #26729
  • Fixed issue with port forwarding silently failing when using a label based target. #26703
• Kubernetes Access
  • Extended kubectl auth can-i support to account for kubernetes_resources RBAC rules. #26586
• Desktop Access
  • Improved internal logging and Windows user lookup efficiency. #26414
• Web UI
  • Restored the "Add application" dialog. #26459

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Description

This release of Teleport contains multiple improvements and bug fixes.

• Audit Log
  • Updated login event to include the list of applied login rules. #26475
  • Updated Okta audit events to include extra apps and groups fields. #26371
• Database Access
  • Fixed issue with connecting to active Cassandra database. #26379
• Web UI
  • Improved error reporting in the RDS flow for some scenarios. #26400
  • Fixed issue with install script always installing latest instead of cluster version. #26323

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Description

• Auth
  • Improved error message on tsh login when trying to authenticate with unregistered device. #26103
  • Populate locked_time user status value when local user is locked. #26255
• Machine ID
  • Fixed goroutine leak in tbot. #26125
  • Added pprof diagnostics endpoints to tbot. #26117
• Audit Log
  • Added audit events for Okta integration. #26000
  • Do not include empty Windows domains in audit log for Desktop Access. #26078
• CLI
  • Added --format flag to tctl alerts ls command and include acknowledged alerts in verbose mode. #26040
  • Added tsh fido2 attobj debug command that can parse attestation objects. #25923
  • Fixed issue with tsh version not being reflected in the macOS application bundle info. #26314
• IP Pinning
  • Fixed issue with tctl commands not working when IP pinning is enabled. #25993
• Terraform
  • Fixed issue with ACL being disabled for new buckets in non-HA terraform setup. #25854
• Performance & Scalability
  • Added ability to enable trace logging level. #25833
• Helm Charts
  • Fixed issue with invite token being incorrectly overridden when it was manually created. #26175
• HSM
  • Added support for YubiHSM2 SDK version 2023.01. #25816
• Teleport Connect
  • Disabled "Open new terminal" action if there's no active workspace. #26333
  • Fixed issue with cluster filter not being taken into account when listing offline clusters. #26127
  • Added support for TLS Routing behind ALB support for SSH and Database access. #25899
• Database Access
  • Improved initial connect auth check for Azure Cache access. #26317
  • Fixed issue with connecting to default active Cassandra database. #26378
• TLS Routing
  • Added support for tsh kube join in single-port mode behind ALB. #26283
  • Added support for tsh request search --kind=pod in single-port mode behind ALB. #26128
• Kubernetes Access
  • Fixed panic when using proxy peering. #26174
• GCP
  • Added GCP IAM joining method. #26165
• Desktop Access
  • Fixed issue with directory sharing not working. #26090

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Description

Teleport Assist

This release of Teleport introduces a preview release of Teleport Assist, a GPT-4 powered chat assistant that allows you to execute commands on servers connected to your Teleport cluster.

It is available for Teleport Cloud customers on Teleport Team plan starting from 05/19/23.

Changelog

In addition, this release contains the following improvements and bug fixes.

• Auth
  • Improved error message on tsh login when trying to authenticate with unregistered device. #26104
  • Populate locked_time user status value when local user is locked. #26256
• Machine ID
  • Fixed goroutine leak in tbot. #26146
  • Added pprof diagnostics endpoints to tbot. #26118
• Audit Log
  • Added audit events for Okta integration. #26003
  • Do not include empty Windows domains in audit log for Desktop Access. #26080
  • Fixed issue with device.authenticate showing up as uknown. #26069
• CLI
  • Added --format flag to tctl alerts ls command and include acknowledged alerts in verbose mode. #26041
  • Added tsh fido2 attobj debug command that can parse attestation objects. #25924
• IP Pinning
  • Fixed issue with tctl commands not working when IP pinning is enabled. #25994
• Terraform
  • Fixed issue with ACL being disabled for new buckets in non-HA terraform setup. #25855
• Performance & Scalability
  • Added ability to enable trace logging level. #25832
• HSM
  • Added support for YubiHSM2 SDK version 2023.01. #25817

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Description

This release of Teleport contains multiple improvements and bug fixes.

• Access Management UI
  • Added new AWS integration and RDS database enrollment flow. #25604, #25594
• API client
  • Improve API client connection failure feedback. #25563
• Server Access
  • Improved InvalidInstanceID error feedback during EC2 discovery. #25641
• Web UI
  • Fixed incorrect error message when connecting to a node that is offline. #25661
  • Fixed issue with connecting to resources in leaf clusters with per-session MFA. #25862

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Description

Teleport 13 brings the following marquee features and improvements:

• (Preview, Enterprise-only) Automatic agent upgrades.
• (Preview) TLS routing through ALB for Server, Kubernetes and Application Access.
• (Preview, Enterprise-only) Ability to import applications and groups from Okta to Application Access.
• (Preview) AWS OpenSearch support for Database Access.
• (Preview) View and control access to OpenSSH nodes natively in Teleport.
• Cross-cluster search for Teleport Connect.
• Kubernetes Access performance improvements.
• Universal binaries (including Apple Silicon) for macOS.
• Simplified RDS onboarding flow in Access Management UI.
• Light theme for Web UI.

(Preview) Automatic agent upgrades

In Teleport 13 users can configure their Teleport agents deployed via apt/yum repositories or a Helm chart to be upgraded automatically.

(Preview) TLS routing through ALB for Server, Kubernetes and Application Access

Teleport 13 adds single-port TLS routing mode support to Server, Kubernetes and Application Access for clusters deployed behind application layer load balancers such as AWS ALB.

(Preview, Enterprise-only) Ability to import applications and groups from Okta to Application Access

In Teleport 13 users can import apps and groups from Okta and use Teleport access requests for requesting short-term access to them. This feature is only available in the Teleport Enterprise edition.

(Preview) AWS OpenSearch support for Database Access

Database Access users can now connect to AWS OpenSearch databases.

(Preview) View and control access to OpenSSH nodes natively in Teleport

In Teleport 13 users will be able register OpenSSH nodes as a resource with the cluster.

This will allow users to view the OpenSSH nodes in Web UI and using tsh ls and use RBAC to control access to them.

See updated OpenSSH integration guide: https://goteleport.com/docs/ver/13.x/server-access/guides/openssh/.

Cross-cluster search for Teleport Connect

Teleport Connect now includes a new search experience, allowing you to search for and connect to resources across all logged-in clusters.

Kubernetes Access performance improvements

In Teleport 13 we improved the way Teleport Proxy handles Kubernetes Access credentials.

Users will experience better performance when interacting with Kubernetes clusters using kubectl or via the API.

Universal binaries (including Apple Silicon) for macOS

Teleport 13 binaries (including Teleport Connect) will have universal architecture and run natively on both Intel and ARM macOS systems.

Simplified RDS onboarding flow in Access Management UI

When connecting an RDS database using Teleport 13 Access Management UI, users can connect their AWS account and select the RDS database to add instead of entering details manually.

To try out the new flow, add an RDS database using the Resource Management UI in your cluster’s Web UI dashboard.

Light theme for Web UI

Teleport's web UI includes an optional light theme.

The light theme is enabled by default but can be changed back to the dark theme via the top-right corner user settings menu.

Desktop Access recording export

Session recordings for Windows desktop sessions can now be exported to video format for offline playback with the new tsh recordings export command.

SFTP in Moderated Sessions

Teleport 13 adds the ability to transfer files in Moderated Sessions. This feature requires that both the session originator and the moderator have joined the session via the web UI.

Breaking changes

Please familiarize yourself with the following potentially disruptive changes in Teleport 13 before upgrading.

Terraform provider require_session_mfa

Users using require_session_mfa field in teleport_auth_preference and teleport_role resources should be aware that the field now accepts a number indicating MFA mode instead of a boolean.

teleport_auth_preference.spec.require_session_mfa
teleport_role.spec.options.require_session_mfa

Possible values are:

| Value | Meaning                                           |
|-------|---------------------------------------------------|
| 0     | Off                                               |
| 1     | Regular per-session MFA                           |
| 2     | Per-session MFA with hardware key                 |
| 3     | Per-session MFA with hardware key requiring touch |

Default session join mode

Teleport 13 defaults to observer (read-only) mode when joining SSH and Kubernetes sessions. Prior versions of Teleport would default to peer mode for SSH sessions and moderator mode for Kubernetes sessions. To override the default join mode, specify the --mode flag with tsh join.

CA rotation deprecation

Teleport 13 removes support for rotating all certificate authorities with tctl auth rotate --type=all. The type flag is now required, which ensures that only one CA is rotated at a time, increasing cluster stability during rotations.

Join token API changes

The default 30-minute expiry no longer applies to tokens created via YAML resource files. If you want to enforce an expiration, ensure this is set in the metadata.expires field. Tokens created using tctl nodes add and tctl tokens add will continue to have a default 30m expiry applied.

Additionally, users of Teleport’s API module will note that the CreateToken and UpsertToken RPCs are now deprecated in favor of CreateTokenV2 and UpsertTokenV2. The new V2 variants no longer have a default expiry, so be sure to set a TTL if you want your tokens to expire.

The original RPCs are still supported in Teleport 13 and will be removed completely for Teleport 14.

Enhanced user validation

Teleport 13 will refuse to create or update users that reference non-existent roles. In some circumstances, older versions of Teleport would permit you to create users and assign them invalid roles. In Teleport 13 this is a hard error.

Quay.io registry

Quay.io registry was deprecated in Teleport 11 and starting with Teleport 13, Teleport container images are no longer being published to it.

Users should use the public ECR registry: https://goteleport.com/docs/installation/#docker.

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Warning

Pre-releases are not production ready, use at your own risk!

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Description

This release of Teleport contains multiple improvements and bug fixes.

• Auth server
  • Fixed panic when cluster has access requests. teleport.e#1298
• Application Access
  • Improved error message when Proxy is using untrusted certificate. #25606
• Database Access
  • Fixed issue with Postgres listener not supporting IP pinning. #25529

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Warning: This release has a regression issue that can lead to auth server panic on clusters with access requests.
We strongly recommend upgrading to 12.3.2 or newer instead.

Description

This release of Teleport contains a security Go upgrade as well as multiple improvements and bug fixes.

• Security
  • Updated Go to 1.20.4 to fix CVE-2023-24539, CVE-2023-24540 and CVE-2023-29400. #25506
• CLI
  • Follow up fix for MFA permission denied error from tsh for non-SSH protocols. #25486
  • Improved tsh ssh error when session fails due to active lock. #25482
• SAML IdP
  • Fixed issue with SAML IdP routes not working. #25474
• Proxy
  • Fixed issue with missing Connection header for ALPN connection upgrade. #25411

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

---

labels: security-patch=yes

Warning: This release has a regression issue that can lead to auth server panic on clusters with access requests.
We strongly recommend upgrading to 12.3.2 or newer instead.

Description

This release of Teleport contains multiple improvements and bug fixes.

• Desktop Access
  • Added support for automatic Windows user creation. #25348
• CLI
  • Fixed MFA permission denied error from tsh for non-SSH protocols. #25430
• Terraform
  • Fixed AccessControlListNotSupported error in HA terraform. #25335
• Device Trust
  • Updated device trust audit events to have descriptive types. #25320

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Warning: This release has a regression issue that can lead to auth server panic on clusters with access requests.
We strongly recommend upgrading to 12.3.2 or newer instead.

Description

This release of Teleport contains multiple improvements and bug fixes.

• Auth
  • Fixed issue where Github SSO would fail if a user is a part of more than 30 teams. #25098
  • Fixed issue with tsh login with "required" hardware key policy returning "policy not met" error. #24956
  • Improved device trust logging and error reporting. #24912
  • Detect and warn about RPID changes when using webautn. #25289
• Access Management
  • Fixed issue with running install script on macOS for enterprise clusters. #25076
• Server Access
  • Fixed issue with headless tsh ssh not working when used in rsync -rsh. #25242
  • Fixed issue with headless tsh ssh prompting users for MFA. #25187
  • Fixed issue with tsh ssh failing to connect over public address with per-session MFA. #25223
  • Fixed issue with tsh scp failing on some destination paths. #24861
  • Require explicit username in headless tsh ssh. #25112
  • Updated automatic user provisioning to sort sudoers lines by role name to ensure stable order. #24792
  • Updated tsh commands to recognize SSH_ environment variables. #24470
• Database Access
  • Fixed issue with tsh db env and tsh db config not recognizing separate MySQL listener. #24827
• Kubernetes Access
  • Added --set-context flag to tsh kube login to allow overriding default context name. #25253
• IdP
  • Fixed issue with SAML IdP not being disabled properly. #25309
• IP Pinning
  • Fixed interoperability issues with load balancers with proxy protocol v2 enabled. #25302
• CLI
  • Fixed issue with cluster alerts sometimes not showing up after tsh login. #25300
• AMIs
  • Fixed issue with startup script failing to acquire lock from AWS metadata. #25296
• HSM
  • Fixed issue with inadvertent deletion of active HSM keys when using YubiHSM2 SDK version 2023.1. #25208
• Performance & Scalability
  • Improved performance of MFA ceremony. #24804

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Warning

Pre-releases are not production ready, use at your own risk!

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Description

This release of Teleport contains multiple improvements and bug fixes.

• Auto-discovery
  • Added discovery_group support to discovery service to avoid races between multiple services. #24717
• Configuration
  • Prevent proxies from trying to join cluster over reverse tunnel. #24669
• CLI
  • Added --raw flag to teleport version command. #24771
• Database Access
  • Updated teleport db configure to support more AWS databases. #24496
  • Reduced log spam when AWS database engine name is not recognized. #24414
• Kubernetes Access
  • Fixed memory leak when using Kubernetes port-forwarding. #24762
  • Fixed issue with moderated sessions requiring moderator to have access to the cluster. #24181
  • Fixed issue with exec commands status not always being correctly returned to clients. #24154
  • Reduced log spam when using port-forwarding. #24659
• Server Access
  • Fixed issue with excessive audit logging when copying files over SFTP. #24845
  • Fixed issue with tsh scp not recognizing wildcard patterns. #24845
  • Fixed issue with tsh scp failing when max sessions is set to 1. #24845
  • Fixed issue with tsh scp failing when path contains a colon. #24845
  • Fixed compatibility issue with v12 auth server when copying files with enabled MFA. #24874
  • Improved error reporting from tsh scp when file copying is disabled. #24845
• Performance & Scalability
  • Improved tsh ssh performance when per-session MFA is not required. #24473
  • Improved agent reconnect speed in proxy peering mode. #24142
• Machine ID
  • Fixed issue with incorrect identity being logged in post-renewal message. #24245
• Web UI
  • Improved access denied errors by showing node names instead of UUIDs. #24088

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.

Description

This release of Teleport contains multiple improvements and bug fixes.

• CLI
  • Added --raw flag to teleport version command. #24770
• Database Access
  • Reduce log spam when AWS database engine name is not recognized. #24415
• Desktop Access
  • Fixed issue with desktop listing requiring extra RBAC permissions. #24346
• Machine ID
  • Fixed issue with incorrect identity being logged in post-renewal message. #24244
• Kubernetes Access
  • Fixed issue with incorrect status being returned to exec clients. #24160
• Performance & scalability
  • Improved agent reconnect speed in proxy peering mode. #24143
• Tooling
  • Upgraded Go to v1.19.8. #24065
• Web UI
  • Added per-session MFA support to connection testers. #23785

Download

Download the current and previous releases of Teleport at https://goteleport.com/download.