Lock UI improvements #25130
Comments
zmb3
added
the
feature-request
|
Item 3 may be fixed by #25342. Edit, the PR above does not fix it. It looks like the frontend tries to upgrade to websocket immediately, but the backend fails with an error before completing the websocket handshake, so the UI just observes a disconnect. |
|
Did a little more digging into this one and it looks like the UX for locks could use a lot of improvements and not just UI updates. In addition to the generic "disconnected" error that you see when an existing SSH session is terminated due to lock, we have a number of other issues. Here's a snippet of my logs (auth, proxy, node all in one process). 2025-01-14T22:50:28.345-07:00 INFO emitting audit event event_type:lock.created fields:map[cluster_name:zac code:TLK00I ei:0 event:lock.created expires:2025-01-15T06:50:28.33695Z lock:map[target:map[server_id:b507c22c-685e-45bd-a796-7a5bcd63e3e6]] name:a84dcded-b0fa-46ed-a9cb-03266240d648 target:map[server_id:b507c22c-685e-45bd-a796-7a5bcd63e3e6] time:2025-01-15T05:50:28.345Z trace.component:audit uid:1778868e-78be-4029-9e1b-9da7ad68d91a updated_by:zac user:zac user_kind:1] events/emitter.go:287 2025-01-14T22:50:29.051-07:00 INFO [SESSION:N] Closing party party_id:ad280382-5ff1-4f44-b224-27a72e42fcce srv/sess.go:2242 2025-01-14T22:50:29.051-07:00 INFO [SESSION:N] Removing party from session. session_id:7ddda71b-b7aa-4426-9c5c-8d101cdf4a27 party.id:2facbd26-ff62-4916-9251-cd77782dc342 party.remote_addr:127.0.0.1:52165 srv/sess.go:1634 2025-01-14T22:50:29.051-07:00 ERRO [NODE] Failed to close connection local_addr:127.0.0.1:3080 remote_addr:127.0.0.1:52165 login:zmb teleport_user:zac id:1 error:"[ ERROR REPORT: Original Error: *net.OpError close tcp 127.0.0.1:3022->127.0.0.1:52208: use of closed network connection Stack Trace: github.com/gravitational/teleport/lib/limiter/listener.go:99 github.com/gravitational/teleport/lib/limiter.(*wrappedConn).Close github.com/gravitational/teleport/lib/utils/timeout.go:77 github.com/gravitational/teleport/lib/utils.(*timeoutConn).Close golang.org/x/[email protected]/ssh/connection.go:97 golang.org/x/crypto/ssh.(*connection).Close github.com/gravitational/teleport/lib/srv/monitor.go:435 github.com/gravitational/teleport/lib/srv.(*Monitor).disconnectClient github.com/gravitational/teleport/lib/srv/monitor.go:476 github.com/gravitational/teleport/lib/srv.(*Monitor).handleLockInForce github.com/gravitational/teleport/lib/srv/monitor.go:400 github.com/gravitational/teleport/lib/srv.(*Monitor).start github.com/gravitational/teleport/lib/srv/monitor.go:299 github.com/gravitational/teleport/lib/srv.StartMonitor.func1 runtime/asm_arm64.s:1223 runtime.goexit User Message: close tcp 127.0.0.1:3022->127.0.0.1:52208: use of closed network connection]" srv/monitor.go:436 In these logs we see:
It's also interesting that the node is trying to emit a In summary, let's expand the scope here to include:
|
A few suggestions for improving locks, now that they're more usable in the UI:
The node name is not part of the lock resource, so we'd have to make a separate call for this, similar to what we do for access requests.
session.rejectedevent in the audit log. Large amounts of text inside[ ]is hard to read. (We should probably remove all traces of these square brackets and find another way to emphasize certain text.Device trust is able to show nice errors when sessions are rejected due to untrusted devices, see if we can do the same thing here.
The text was updated successfully, but these errors were encountered: