10 ms·

Teleport 2.0 Released: Modern SSH for clusters and teams

133 points by craigkerstiens 10y ago

twakefield 10y ago
Hey HN, we (gravitational) are pretty excited about this release. We'll be monitoring the thread in case you have any questions.
- atonse 10y ago
  Hi twakefield, congrats on the release! So does this seem like a typical use in an AWS VPC: - SSH bastion server with public IP with security groups for each user - Every other server only has private IPs, only allowing access between each other and then the bastion server How do you generate and store keys? Are you using something like Hashicorp's Vault?
  - russjones 10y ago
    Hi atonse, Russell from Gravitational here. As far as configuring your VPC having the bastion (Proxy) as the only server with a public address is reasonable. One of the nice things about Teleport is that the Teleport Proxy itself doesn't have access to much, so exposing it to the Internet is fine. The Auth Server is the one that holds sensitive information and we recommend you create a security group for it and only allow it to be accessed from Teleport Proxies or Teleport Nodes. With respect to keys, they are stored and accessed via the Auth Server in Teleport. We recommend you have strong access controls on the Auth Server. If you are using the default backend (BoltDB) or directory based backend that's all you need to do. If you are using etcd we recommend you have strong access controls on the server that runs etcd as well as etcd itself, we have an example in our Teleport repo for etcd configuration if you're interested[1]. If you are using DynamoDB, we recommend having a strong IAM policy. We are not using Vault at the moment. [1] https://github.com/gravitational/teleport/tree/master/examples/etcd https://github.com/gravitational/teleport/tree/master/exampl...
    - old-gregg 10y ago
      Speaking of Vault, AFAIK the community expressed a lot of interest in providing custom secret storage plugins, so the latest releases have had a much simpler storage interface to implement, which is how DynamoDB was added, someone just sent a PR: https://github.com/gravitational/teleport/tree/master/lib/backend/dynamo https://github.com/gravitational/teleport/tree/master/lib/ba...
    - atonse 10y ago
      Great, thanks for the info!
    - walrus01 10y ago
      > Teleport Proxy itself doesn't have access to much, so exposing it to the Internet is fine. yeah this is a bad idea in general. If you have critical stuff you need to SSH into from the public internet, keep it all in private IP space and have an openvpn gateway (or IPSEC VPN) with a public interface, and a private interface facing inwards towards the hosts. you should not even be able to route to the IP of the thing you want to SSH to unless you've authenticated to the VPN and your client device has been handed out an IP in your RFC1918 IP space. a machine like an openvpn gateway can also serve the purpose of getting you access into an OOB network (example: a public facing IP on a 100Mbps DIA circuit you've bought from a totally diverse ISP in the same colo, with a static /30), which has access into internal IP space devices such as serial console servers and ssh bastion hosts. authenticate the clients by a unique public/private key pair per client device. Easy to revoke a specific device's key from the server side if needed.
      - alexk 10y ago
        > yeah this is a bad idea in general. If you have critical stuff you need to SSH into from the public internet, keep it all in private IP space and have an openvpn gateway This is not a bad idea in general. In fact, teleport proxy implements this exact model you have just described, where only proxy is available and acts as a jump host to the set of machines available only on the private net. The only difference is that instead of open VPN gateway it uses SSH jumphost model. Teleport proxy uses OpenSSH cert auth, in addition to that teleport node also does cert auth. Not everyone needs to always set up VPN, sometimes jumphosts + cert auth are perfectly fine.
- qmarchi 10y ago
  What's Enterprise pricing look like for a small deployment? <10 systems
  - twakefield 10y ago
    qmarchi - we have some different options that are dependent on support needed. If you fill out the contact form on gravitational.com I can go into more detail. Or email info@.
    - canadaduane 10y ago
      When I see "contact us" as a pricing model, I mentally note that this is likely a "we charge as much as we can, depending on who you are" model. I know that's probably not what you intend. If you could give some general parameters on price, it would help me avoid that association with companies that do this.
      - iamacynic 10y ago
        i'll save you both some time. "contact us" means at least $10k. if you don't want to spend $10k, they probably don't want you as a customer either.
        kordless 10y ago
        This is a completely irrational thing to say (and is speaking for others) when you really have no idea what the facts of the matter are one way or the other.
        dexterdog 10y ago
        Well, he is a cynic.
        damm 10y ago
        It's completely honest. When I tried to get an Elasticsearch license (when it was cheaper) sales refused to respond to my emails for a bit. Bugging someone on irc I finally got someone to respond and got a nice trial license but they /REFUSED/ to take my money. I would have dropped the money in their pocket if they would have responded. But I wasn't asking for a license for a company but for myself... so they got stupid
- nikolay 10y ago
  Any CloudFormation template to launch this on AWS?
  - russjones 10y ago
    Hi nikolay, we don't have a CloudFormation template, but we do have a containerized version of Teleport that is fully configured with multiple clusters that you can use to test with. https://github.com/gravitational/teleport/tree/master/docker https://github.com/gravitational/teleport/tree/master/docker
giantahead 10y ago
This is awesome! Much interested to read audit results.
robotmay 10y ago
This is a very timely post for me, as I may have a very good use for Teleport and I hadn't heard about it before :)
- mdekkers 10y ago
  have a look at jumpcloud
puzzle 10y ago
I seem to remember that the features now available as Enterprise-only were not listed as such during development. Even if that's not the case, it's still a bummer. And it really sucks having to go through a salesperson's spiel just to get an idea of the costs. I hate it when companies don't post list prices on their site. I'm also looking at you, Hashicorp, and your Vault Enterprise.
- deleted 10y ago
  [deleted]
- desdiv 10y ago
  >I hate it when companies don't post list prices on their site. Same here. If SpaceX can openly advertise their prices, then so can you. [0] http://www.spacex.com/about/capabilities http://www.spacex.com/about/capabilities
- alexk 10y ago
  To be honest, it takes one email to get our pricing, and we mostly use it to stay in touch and understand your use-case better. Thanks for feedback though, we will work on making it easier to get the pricing and explain the split between enterprise and OSS parts of teleport better.
  - puzzle 10y ago
    And to be clear: it is your product and it's your choice how to develop it or make it available on the market. The only reason that I took the time to vent is that I actually like Teleport a lot. You won't see me complain about Oracle or Symantec pricing details. :-)
  - artellectual 10y ago
    Actually by not posting your price upfront, is actually wasting time for both you and the client. You see if I have a budget for a solution of 60USD and your solution starts at 6000USD I know to look elsewhere. But if you don't what will happen is you will collect my email to "stay in touch" about a product I have no use for, increasing my spam by 1. My email address in your mailing list is wasting my inbox space and your time. In fact your mailing list is probably what you use to give your sales person. But it's counter productive instead of having 100 potential customer who have accepted your pricing for your product, now you have 10000 people who may or may not be interested. So now your sales staff have to spend time chasing up cold leads instead of focusing on 100 customers whom they have a higher chance of closing. So you see by not posting the price you are causing harm to your own sales pipeline and one more person to make you as a spammer.
SEJeff 10y ago
Here is a question for teleport developers: Why teleport over kerberos + ssh? What can this provide that RHEL7 + a kerberized LDAP like IPA + sssd already provides?
- old-gregg 10y ago
  Well, with enough in-house expertise everything is possible using a set of the tools you're an expert at. But with ever-growing complexity and volume of the infrastructure, the expertise required and time to manage these things are in short supply. Teleport is mainly the opinionated and simplified way to deliver SSH best practices. Additionally, it has a few neat usability features (like a nice Web UI) and directly addresses the use case of managing the infrastructure that's not yours (MSP use case) where you can have multiple clusters owned by different organizations where you can set up cross-cluster trust via certificate authorities (CA)s [1], well... that's just what's on top of my head. There's more here: http://gravitational.com/teleport/ http://gravitational.com/teleport/ or feel free to reach out and chat, we're a friendly bunch! :) [1] That's our use case, Teleport was originally built to set up and manage Kubernetes clusters on infrastructure located behind firewalls, see our flagship here: http://gravitational.com/telekube/ http://gravitational.com/telekube/
  - SEJeff 10y ago
    Ah the MSP use case is what I missed, that makes a ton of sense. Perfect.
  - rsync 10y ago
    "But with ever-growing complexity and volume of the infrastructure, the expertise required and time to manage these things are in short supply. Teleport is mainly the opinionated and simplified way to deliver SSH best practices." We're talking about the ssh command here, right ? And associated key generation and config files ? Are there people who are "experts" at that ? Like, the same way there are people who are "experts" at can openers and chip clips ? "Additionally, it has a few neat usability features (like a nice Web UI) and directly addresses the use case of managing the infrastructure that's not yours (MSP use case) where you can have multiple clusters owned by different organizations where you can set up cross-cluster trust via certificate authorities (CA)s [1], well... that's just what's on top of my head." You just wrote slide #3 in a future blackhat presentation.
bogomipz 10y ago
Has anyone else used Teleport in production? I would be curious to hear any feedback?
- Operyl 10y ago
  I tried it during the 1.x phase, and at rest the daemons would eat a core :/.
  - russjones 10y ago
    Hi Operyl, Russell from Gravitational here. We've made improvements in resource utilization for Teleport 2.0 and hunting down any further resource utilization issues is definitely one of my focus areas for Teleport 2.x. If you run into issues like this again please reach out and send us your teleport.yaml, we want to run these issues down and resolve them.
    - Operyl 10y ago
      Just difficult to want to deploy it all again, I guess. Especially since you guys _still_ lack basic packages for common distributions.
      - bogomipz 10y ago
        That's unfortunate, thanks for the response.
pwarner 10y ago
Is there an architecture overview for this case? > Software vendors: they like Teleport for providing remote support of their products. Teleport can be used as a “remote control” to assist their customers with any issues of their software installed and running on-premise. How does the customer control access to the app deployed on their premise? Thanks!
- alexk 10y ago
  Here's the overview of the feature we call "Trusted clusters" http://gravitational.com/teleport/docs/2.0/admin-guide/#trusted-clusters http://gravitational.com/teleport/docs/2.0/admin-guide/#trus...
  - pwarner 10y ago
    Thanks, this is perfect. Will try it out!
rsync 10y ago
Did you know that you can do this: ssh -t user@machineB ssh user@machineA That is, you can execute an ssh client command, over ssh. The '-t' option is required.
- alexk 10y ago
  For the folks who are interested in such things: "SSH, The Secure Shell: The Definitive Guide" is an amazing book with lots of great info and nice tricks/SSH solutions http://shop.oreilly.com/product/9780596008956.do http://shop.oreilly.com/product/9780596008956.do
- X-Istence 10y ago
  The -t creates a terminal on the remote host, so in essence it is the same as SSH'ing to machineB and then running the ssh command. Even cooler is the use of SSH tunneling to set up a ProxyCommand.
  - secure 10y ago
    To expand on this, the reason why it’s “even cooler” is because you can use keys to login (as opposed to password) without forwarding your ssh-agent (which is a security risk). I wrote more about this technique at https://michael.stapelberg.de/Artikel/ssh-conditional-tunneling https://michael.stapelberg.de/Artikel/ssh-conditional-tunnel... In a nutshell: Host home Hostname home.zekjur.net ProxyCommand ssh -4 dualstack -W %h:%p Then, “ssh home” will log into “home.zekjur.net” via an IPv4 connection through “dualstack”. This is useful in environments where you don’t have IPv6 and your only use-case is SSH'ing home.
- dijit 10y ago
  Why would you recommend this over -W? ssh -W user@jumpHost user@destination
dagi3d 10y ago
Anyone using it in production? How does it differ from other possible products/solutions?
technofiend 10y ago
Have you guys considered buying Fox Technologies? Do you have a compare/contrast between their ssh replacement and yours?

133 points by craigkerstiens 10y ago

Hey HN, we (gravitational) are pretty excited about this release. We'll be monitoring the thread in case you have any questions.

atonse 10y ago
Hi twakefield, congrats on the release! So does this seem like a typical use in an AWS VPC: - SSH bastion server with public IP with security groups for each user - Every other server only has private IPs, only allowing access between each other and then the bastion server How do you generate and store keys? Are you using something like Hashicorp's Vault?
- russjones 10y ago
  Hi atonse, Russell from Gravitational here. As far as configuring your VPC having the bastion (Proxy) as the only server with a public address is reasonable. One of the nice things about Teleport is that the Teleport Proxy itself doesn't have access to much, so exposing it to the Internet is fine. The Auth Server is the one that holds sensitive information and we recommend you create a security group for it and only allow it to be accessed from Teleport Proxies or Teleport Nodes. With respect to keys, they are stored and accessed via the Auth Server in Teleport. We recommend you have strong access controls on the Auth Server. If you are using the default backend (BoltDB) or directory based backend that's all you need to do. If you are using etcd we recommend you have strong access controls on the server that runs etcd as well as etcd itself, we have an example in our Teleport repo for etcd configuration if you're interested[1]. If you are using DynamoDB, we recommend having a strong IAM policy. We are not using Vault at the moment. [1] https://github.com/gravitational/teleport/tree/master/examples/etcd https://github.com/gravitational/teleport/tree/master/exampl...
  - old-gregg 10y ago
    Speaking of Vault, AFAIK the community expressed a lot of interest in providing custom secret storage plugins, so the latest releases have had a much simpler storage interface to implement, which is how DynamoDB was added, someone just sent a PR: https://github.com/gravitational/teleport/tree/master/lib/backend/dynamo https://github.com/gravitational/teleport/tree/master/lib/ba...
  - atonse 10y ago
    Great, thanks for the info!
  - walrus01 10y ago
    > Teleport Proxy itself doesn't have access to much, so exposing it to the Internet is fine. yeah this is a bad idea in general. If you have critical stuff you need to SSH into from the public internet, keep it all in private IP space and have an openvpn gateway (or IPSEC VPN) with a public interface, and a private interface facing inwards towards the hosts. you should not even be able to route to the IP of the thing you want to SSH to unless you've authenticated to the VPN and your client device has been handed out an IP in your RFC1918 IP space. a machine like an openvpn gateway can also serve the purpose of getting you access into an OOB network (example: a public facing IP on a 100Mbps DIA circuit you've bought from a totally diverse ISP in the same colo, with a static /30), which has access into internal IP space devices such as serial console servers and ssh bastion hosts. authenticate the clients by a unique public/private key pair per client device. Easy to revoke a specific device's key from the server side if needed.
    - alexk 10y ago
      > yeah this is a bad idea in general. If you have critical stuff you need to SSH into from the public internet, keep it all in private IP space and have an openvpn gateway This is not a bad idea in general. In fact, teleport proxy implements this exact model you have just described, where only proxy is available and acts as a jump host to the set of machines available only on the private net. The only difference is that instead of open VPN gateway it uses SSH jumphost model. Teleport proxy uses OpenSSH cert auth, in addition to that teleport node also does cert auth. Not everyone needs to always set up VPN, sometimes jumphosts + cert auth are perfectly fine.
qmarchi 10y ago
What's Enterprise pricing look like for a small deployment? <10 systems
- twakefield 10y ago
  qmarchi - we have some different options that are dependent on support needed. If you fill out the contact form on gravitational.com I can go into more detail. Or email info@.
  - canadaduane 10y ago
    When I see "contact us" as a pricing model, I mentally note that this is likely a "we charge as much as we can, depending on who you are" model. I know that's probably not what you intend. If you could give some general parameters on price, it would help me avoid that association with companies that do this.
    - iamacynic 10y ago
      i'll save you both some time. "contact us" means at least $10k. if you don't want to spend $10k, they probably don't want you as a customer either.
      - kordless 10y ago
        This is a completely irrational thing to say (and is speaking for others) when you really have no idea what the facts of the matter are one way or the other.
        dexterdog 10y ago
        Well, he is a cynic.
        damm 10y ago
        It's completely honest. When I tried to get an Elasticsearch license (when it was cheaper) sales refused to respond to my emails for a bit. Bugging someone on irc I finally got someone to respond and got a nice trial license but they /REFUSED/ to take my money. I would have dropped the money in their pocket if they would have responded. But I wasn't asking for a license for a company but for myself... so they got stupid
nikolay 10y ago
Any CloudFormation template to launch this on AWS?
- russjones 10y ago
  Hi nikolay, we don't have a CloudFormation template, but we do have a containerized version of Teleport that is fully configured with multiple clusters that you can use to test with. https://github.com/gravitational/teleport/tree/master/docker https://github.com/gravitational/teleport/tree/master/docker

giantahead 10y ago

This is awesome! Much interested to read audit results.

robotmay 10y ago

This is a very timely post for me, as I may have a very good use for Teleport and I hadn't heard about it before :)

mdekkers 10y ago
have a look at jumpcloud

puzzle 10y ago

I seem to remember that the features now available as Enterprise-only were not listed as such during development. Even if that's not the case, it's still a bummer. And it really sucks having to go through a salesperson's spiel just to get an idea of the costs. I hate it when companies don't post list prices on their site. I'm also looking at you, Hashicorp, and your Vault Enterprise.

deleted 10y ago
[deleted]
desdiv 10y ago
>I hate it when companies don't post list prices on their site. Same here. If SpaceX can openly advertise their prices, then so can you. [0] http://www.spacex.com/about/capabilities http://www.spacex.com/about/capabilities
alexk 10y ago
To be honest, it takes one email to get our pricing, and we mostly use it to stay in touch and understand your use-case better. Thanks for feedback though, we will work on making it easier to get the pricing and explain the split between enterprise and OSS parts of teleport better.
- puzzle 10y ago
  And to be clear: it is your product and it's your choice how to develop it or make it available on the market. The only reason that I took the time to vent is that I actually like Teleport a lot. You won't see me complain about Oracle or Symantec pricing details. :-)
- artellectual 10y ago
  Actually by not posting your price upfront, is actually wasting time for both you and the client. You see if I have a budget for a solution of 60USD and your solution starts at 6000USD I know to look elsewhere. But if you don't what will happen is you will collect my email to "stay in touch" about a product I have no use for, increasing my spam by 1. My email address in your mailing list is wasting my inbox space and your time. In fact your mailing list is probably what you use to give your sales person. But it's counter productive instead of having 100 potential customer who have accepted your pricing for your product, now you have 10000 people who may or may not be interested. So now your sales staff have to spend time chasing up cold leads instead of focusing on 100 customers whom they have a higher chance of closing. So you see by not posting the price you are causing harm to your own sales pipeline and one more person to make you as a spammer.

SEJeff 10y ago

Here is a question for teleport developers: Why teleport over kerberos + ssh? What can this provide that RHEL7 + a kerberized LDAP like IPA + sssd already provides?

old-gregg 10y ago
Well, with enough in-house expertise everything is possible using a set of the tools you're an expert at. But with ever-growing complexity and volume of the infrastructure, the expertise required and time to manage these things are in short supply. Teleport is mainly the opinionated and simplified way to deliver SSH best practices. Additionally, it has a few neat usability features (like a nice Web UI) and directly addresses the use case of managing the infrastructure that's not yours (MSP use case) where you can have multiple clusters owned by different organizations where you can set up cross-cluster trust via certificate authorities (CA)s [1], well... that's just what's on top of my head. There's more here: http://gravitational.com/teleport/ http://gravitational.com/teleport/ or feel free to reach out and chat, we're a friendly bunch! :) [1] That's our use case, Teleport was originally built to set up and manage Kubernetes clusters on infrastructure located behind firewalls, see our flagship here: http://gravitational.com/telekube/ http://gravitational.com/telekube/
- SEJeff 10y ago
  Ah the MSP use case is what I missed, that makes a ton of sense. Perfect.
- rsync 10y ago
  "But with ever-growing complexity and volume of the infrastructure, the expertise required and time to manage these things are in short supply. Teleport is mainly the opinionated and simplified way to deliver SSH best practices." We're talking about the ssh command here, right ? And associated key generation and config files ? Are there people who are "experts" at that ? Like, the same way there are people who are "experts" at can openers and chip clips ? "Additionally, it has a few neat usability features (like a nice Web UI) and directly addresses the use case of managing the infrastructure that's not yours (MSP use case) where you can have multiple clusters owned by different organizations where you can set up cross-cluster trust via certificate authorities (CA)s [1], well... that's just what's on top of my head." You just wrote slide #3 in a future blackhat presentation.

bogomipz 10y ago

Has anyone else used Teleport in production? I would be curious to hear any feedback?

Operyl 10y ago
I tried it during the 1.x phase, and at rest the daemons would eat a core :/.
- russjones 10y ago
  Hi Operyl, Russell from Gravitational here. We've made improvements in resource utilization for Teleport 2.0 and hunting down any further resource utilization issues is definitely one of my focus areas for Teleport 2.x. If you run into issues like this again please reach out and send us your teleport.yaml, we want to run these issues down and resolve them.
  - Operyl 10y ago
    Just difficult to want to deploy it all again, I guess. Especially since you guys _still_ lack basic packages for common distributions.
    - bogomipz 10y ago
      That's unfortunate, thanks for the response.

pwarner 10y ago

Is there an architecture overview for this case? > Software vendors: they like Teleport for providing remote support of their products. Teleport can be used as a “remote control” to assist their customers with any issues of their software installed and running on-premise. How does the customer control access to the app deployed on their premise? Thanks!

alexk 10y ago
Here's the overview of the feature we call "Trusted clusters" http://gravitational.com/teleport/docs/2.0/admin-guide/#trusted-clusters http://gravitational.com/teleport/docs/2.0/admin-guide/#trus...
- pwarner 10y ago
  Thanks, this is perfect. Will try it out!

rsync 10y ago

Did you know that you can do this: ssh -t user@machineB ssh user@machineA That is, you can execute an ssh client command, over ssh. The '-t' option is required.

alexk 10y ago
For the folks who are interested in such things: "SSH, The Secure Shell: The Definitive Guide" is an amazing book with lots of great info and nice tricks/SSH solutions http://shop.oreilly.com/product/9780596008956.do http://shop.oreilly.com/product/9780596008956.do
X-Istence 10y ago
The -t creates a terminal on the remote host, so in essence it is the same as SSH'ing to machineB and then running the ssh command. Even cooler is the use of SSH tunneling to set up a ProxyCommand.
- secure 10y ago
  To expand on this, the reason why it’s “even cooler” is because you can use keys to login (as opposed to password) without forwarding your ssh-agent (which is a security risk). I wrote more about this technique at https://michael.stapelberg.de/Artikel/ssh-conditional-tunneling https://michael.stapelberg.de/Artikel/ssh-conditional-tunnel... In a nutshell: Host home Hostname home.zekjur.net ProxyCommand ssh -4 dualstack -W %h:%p Then, “ssh home” will log into “home.zekjur.net” via an IPv4 connection through “dualstack”. This is useful in environments where you don’t have IPv6 and your only use-case is SSH'ing home.
dijit 10y ago
Why would you recommend this over -W? ssh -W user@jumpHost user@destination

dagi3d 10y ago

Anyone using it in production? How does it differ from other possible products/solutions?

technofiend 10y ago

Have you guys considered buying Fox Technologies? Do you have a compare/contrast between their ssh replacement and yours?