3 ms·
> At the end of a successful login, tsh login command now sends the SSH certificate to an active SSH agent. Will it ever be able to create, and use, a DIFFEREN
by mfontani 9y ago
> At the end of a successful login, tsh login command now sends the SSH certificate to an active SSH agent.
Will it ever be able to create, and use, a DIFFERENT agent?
I use https://github.com/ccontavalli/ssh-ident https://github.com/ccontavalli/ssh-ident in order to have a different agent per "kind" of hosts, so that if I mistakenly ssh to Mallory's ssh server with my default agent, they won't be able to, say, also pull all my private Github repos.
To use teleport as securely, I'd have to - again - concoct a script or something to "pass through ssh-ident". This is tiresome :|
- alexk 9y agowhen connecting to the agent teleport uses `SSH_AUTH_SOCK` environment variable, so as long as you set the right variable, tsh login should work, unless I'm missing something.
- old-gregg 9y agoAs you probably know, the agent is defined via environment variables, so you're right the same inconvenience would exist. BTW, have you looked into configuring different per-host (or per-environment) credentials via `~/.ssh/config`? Agent forwarding in general is often seen as a weak mechanism to propagate trust and from Teleport's team perspective it's a backward compatibility feature. Speaking generally, Teleport solves the similar problem (trust propagation and role based access control for SSH) by not using public keys at all, and instead issuing role-based certificates, i.e. enforcing corporate policies like "developers must never touch production data" or cross-organizational policies like "these contractors can only touch this sandbox).