mirror of
https://github.com/coder/coder.git
synced 2026-06-03 04:58:23 +00:00
Garrett Delfosse
7b7baea851
The agent SSH server unconditionally allows all four SSH forwarding paths (TCP local, TCP reverse, Unix local, Unix reverse). This is a sandbox escape vector when workspaces are used for AI agent containment — a reverse tunnel lets anything inside the workspace reach the user's local machine, bypassing network isolation. This adds two new agent CLI flags / environment variables: - `--block-reverse-port-forwarding` / `CODER_AGENT_BLOCK_REVERSE_PORT_FORWARDING` — blocks both TCP (`ssh -R`) and Unix socket reverse forwarding - `--block-local-port-forwarding` / `CODER_AGENT_BLOCK_LOCAL_PORT_FORWARDING` — blocks both TCP (`ssh -L`) and Unix socket local forwarding Template admins can set these via the `env` block on the container/VM resource that runs the agent (e.g. `docker_container`, `kubernetes_pod`), or via `coder_env` resources tied to the agent. Fixes https://github.com/coder/coder/issues/22275 <details> <summary>Implementation notes</summary> Follows the existing `BlockFileTransfer` pattern: 1. `agent/agentssh/agentssh.go` — New `BlockReversePortForwarding` and `BlockLocalPortForwarding` fields on `Config`. TCP callbacks check these before allowing forwarding. The `direct-streamlocal@openssh.com` channel handler is wrapped to reject Unix local forwards. 2. `agent/agentssh/forward.go` — `forwardedUnixHandler` gains a `blockReversePortForwarding` field to reject `streamlocal-forward@openssh.com` requests. 3. `agent/agent.go` — New fields on `Options` and `agent` struct, plumbed to SSH config. 4. `cli/agent.go` — New serpent flags with env vars. 5. Tests cover all four blocked paths: TCP local, TCP reverse, Unix local, Unix reverse. </details> > 🤖 Generated by Coder Agents
95 lines
3.9 KiB
Plaintext
95 lines
3.9 KiB
Plaintext
coder v0.0.0-devel
|
|
|
|
USAGE:
|
|
coder agent [flags]
|
|
|
|
Starts the Coder workspace agent.
|
|
|
|
OPTIONS:
|
|
--auth string, $CODER_AGENT_AUTH (default: token)
|
|
Specify the authentication type to use for the agent.
|
|
|
|
--agent-token string, $CODER_AGENT_TOKEN
|
|
An agent authentication token.
|
|
|
|
--agent-token-file string, $CODER_AGENT_TOKEN_FILE
|
|
A file containing an agent authentication token.
|
|
|
|
--agent-url url, $CODER_AGENT_URL
|
|
URL for an agent to access your deployment.
|
|
|
|
--log-human string, $CODER_AGENT_LOGGING_HUMAN (default: /dev/stderr)
|
|
Output human-readable logs to a given file.
|
|
|
|
--log-json string, $CODER_AGENT_LOGGING_JSON
|
|
Output JSON logs to a given file.
|
|
|
|
--log-stackdriver string, $CODER_AGENT_LOGGING_STACKDRIVER
|
|
Output Stackdriver compatible logs to a given file.
|
|
|
|
--agent-header string-array, $CODER_AGENT_HEADER
|
|
Additional HTTP headers added to all requests. Provide as key=value.
|
|
Can be specified multiple times.
|
|
|
|
--agent-header-command string, $CODER_AGENT_HEADER_COMMAND
|
|
An external command that outputs additional HTTP headers added to all
|
|
requests. The command must output each header as `key=value` on its
|
|
own line.
|
|
|
|
--block-file-transfer bool, $CODER_AGENT_BLOCK_FILE_TRANSFER (default: false)
|
|
Block file transfer using known applications: nc,rsync,scp,sftp.
|
|
|
|
--block-local-port-forwarding bool, $CODER_AGENT_BLOCK_LOCAL_PORT_FORWARDING (default: false)
|
|
Block local port forwarding through the SSH server (ssh -L).
|
|
|
|
--block-reverse-port-forwarding bool, $CODER_AGENT_BLOCK_REVERSE_PORT_FORWARDING (default: false)
|
|
Block reverse port forwarding through the SSH server (ssh -R).
|
|
|
|
--boundary-log-proxy-socket-path string, $CODER_AGENT_BOUNDARY_LOG_PROXY_SOCKET_PATH (default: /tmp/boundary-audit.sock)
|
|
The path for the boundary log proxy server Unix socket. Boundary
|
|
should write audit logs to this socket.
|
|
|
|
--debug-address string, $CODER_AGENT_DEBUG_ADDRESS (default: 127.0.0.1:2113)
|
|
The bind address to serve a debug HTTP server.
|
|
|
|
--devcontainers-discovery-autostart-enable bool, $CODER_AGENT_DEVCONTAINERS_DISCOVERY_AUTOSTART_ENABLE (default: false)
|
|
Allow the agent to autostart devcontainer projects it discovers based
|
|
on their configuration.
|
|
|
|
--devcontainers-enable bool, $CODER_AGENT_DEVCONTAINERS_ENABLE (default: true)
|
|
Allow the agent to automatically detect running devcontainers.
|
|
|
|
--devcontainers-project-discovery-enable bool, $CODER_AGENT_DEVCONTAINERS_PROJECT_DISCOVERY_ENABLE (default: true)
|
|
Allow the agent to search the filesystem for devcontainer projects.
|
|
|
|
--log-dir string, $CODER_AGENT_LOG_DIR (default: /tmp)
|
|
Specify the location for the agent log files.
|
|
|
|
--no-reap bool
|
|
Do not start a process reaper.
|
|
|
|
--pprof-address string, $CODER_AGENT_PPROF_ADDRESS (default: 127.0.0.1:6060)
|
|
The address to serve pprof.
|
|
|
|
--prometheus-address string, $CODER_AGENT_PROMETHEUS_ADDRESS (default: 127.0.0.1:2112)
|
|
The bind address to serve Prometheus metrics.
|
|
|
|
--script-data-dir string, $CODER_AGENT_SCRIPT_DATA_DIR (default: /tmp)
|
|
Specify the location for storing script data.
|
|
|
|
--socket-path string, $CODER_AGENT_SOCKET_PATH
|
|
Specify the path for the agent socket.
|
|
|
|
--socket-server-enabled bool, $CODER_AGENT_SOCKET_SERVER_ENABLED (default: true)
|
|
Enable the agent socket server.
|
|
|
|
--ssh-max-timeout duration, $CODER_AGENT_SSH_MAX_TIMEOUT (default: 72h)
|
|
Specify the max timeout for a SSH connection, it is advisable to set
|
|
it to a minimum of 60s, but no more than 72h.
|
|
|
|
--tailnet-listen-port int, $CODER_AGENT_TAILNET_LISTEN_PORT (default: 0)
|
|
Specify a static port for Tailscale to use for listening.
|
|
|
|
———
|
|
Run `coder --help` for a list of global options.
|