3 ms·
This solves a problem we were looking at my last job: recording and replaying sessions. Identity management and bastion setup are solved problems, but it is nic
by pritambaral 11y ago
This solves a problem we were looking at my last job: recording and replaying sessions. Identity management and bastion setup are solved problems, but it is nice to have an all in one package.
Of course, this raises a few security questions:
1. Do I have to run this as a server on every host I intend to ssh into? Or can it use existing installations of openssh for that?
2. Is this re-inventing any authentication mechanism? If yes, how robust is it and how thoroughly has it been tested? (I'm guess not much right now, since this isn't production ready yet, but the question will remain for a while.)
3. Do I have to use a different client? Or are existing ssh clients fully sufficient? The article does mention compatibility with OpenSSH, but does not detail. It also mentions using HTTPS as a transport instead of SSH, which is concerning in the case of compatibility.
- old-gregg 11y agoSure: 1. You don't have to. http://gravitational.com/teleport/docs/admin-guide/#using-teleport-with-openssh http://gravitational.com/teleport/docs/admin-guide/#using-te... 2. It uses existing SSH protocol features, that's why OpenSSH clients and servers are fully compatible. 3. See above. Regular `ssh` will work, but `tsh` may be a bit more convenient. 4. HTTPS is used to perform 2nd factor authentication initially. Once you received your session key, it switches to SSH for the duration of a session. Edit: formatting
- newman314 11y agoActually not quite fully, it does not appear that go ssh supports ed25519.
- pritambaral 11y agoWhy do I need to add keys to my local authorized_keys file in order to ssh out? Does Teleport shell into MY computer?! That is a bit fishy...