8 ms·

Teleport 4.3: Modern Replacement for OpenSSH

65 points by gk1 6y ago

lucb1e 6y ago
Aside from shivering at the mention of "Web UI", I don't quite get what this does that SSH doesn't. The landing page is super useless, and the blog post doesn't exactly explain why a VPN service (since it "removes the need for VPN", it's a VPN) is a replacement for ssh. Like, "glorious portal radiating encrypted beams into all of your clouds and smart devices", umm yeah okay.
- mcpherrinm 6y ago
  Seems like this mainly notes changes in this release. https://gravitational.com/teleport https://gravitational.com/teleport is the landing page with more feature details. I think a short list of features interesting to me is: * SSH CA integrated with whatever SSO you have, removing need to distribute SSH authorized_keys files. * SSH Bastion & Server with audit logging. Record sessions, who did what. Needed for many security-sensitive environments. * Reverse-tunnel mode, where devices without public IPs (or a vpn) can connect to your bastion server. Useful if you're deploying computers "in the field" that you want remote access to, without needing additional VPN or port forwarding, etc.
  - stinkytaco 6y ago
    > Reverse-tunnel mode, where devices without public IPs (or a vpn) can connect to your bastion server. This may be a ridiculous question, but what's wrong with a VPN in this scenario? Or even a SOCKS proxy, which is already widely deployed and supported? You say "without needing additional VPN or port forwarding", but I'm curious what advantages it offers over using a VPN.
    - mcpherrinm 6y ago
      Just extra pieces to manage. With a VPN, now you need to start worrying about firewall rules (do you isolate clients? What internal resources do they get access to?), IP assignment (now you need to run a DHCP server, or handle static IP allocations). What subnets do you use for your VPN, and what happens if they conflict with the network at some of your locations? Or maybe buy a VPN appliance to do that for you. Then you need to handle VPN authentication... Lots of that is largely un-needed effort. If you just want to be able to SSH into computers, it's simpler to just have your ssh server connect back. At small scale, where an ops team can keep track of all the computers individually? yeah, VPN is probably fine, especially if you've already got one. But I think these days, a lot of people are looking at avoiding VPNs outright.
      - jon-wood 6y ago
        These complications are particularly relevant if you're managing a fleet of devices on networks you don't control, such as on-prem versions of SaaS systems, or consumer IoT devices. In that situation you definitely don't want the device to be sitting around with a back door into your network, and subnet conflicts are often impossible to resolve.
    - acdha 6y ago
      VPNs are a huge security risk: you’re installing a lot of complex code and configuration into a secure context listening on an open network port, and you almost certainly open more traffic than just SSH so an attacker who compromises a VPN client can attack those services, too. They have advantages, too, but it’s not a simple decision. A reverse tunnel where the server has an agent which opens an outbound connection to receive requests over cuts a bunch of risks out of your environment and it’s less work to operate, too.
  - lucb1e 6y ago
    > devices without public IPs (or a vpn) can connect to your bastion server How does it punch through NAT? Or does the NATted device connect similarly to using ssh -R 1234:localhost:22 (just like CAs and session recording work with SSH as well, but I guess this project might make it more integrated and user-friendly with a nice GUI)?
    - cronos 6y ago
      The NATted device dials out to the bastion (a.k.a. proxy) and maintains a persistent tunnel. The proxy then sends all the connections to this device inside that tunnel.
  - birdyrooster 6y ago
    OpenSSH can already do all of these things that you listed.
    - cronos 6y ago
      Yes, but it's rarely how companies use OpenSSH because it takes a ton of work to set up. Teleport gives you all this functionality by default out of the box. So it's not inventing anything new, just provides better UX.
      - number6 6y ago
        Its not a ton of work, most works out of the box and requires just a command line argument
        cronos 6y ago
        A "ton" of work may have been an exaggeration. Maintaining a CA (and dealing with cert rotation) is some work. Other things are indeed just a flag or config option (like jumphosts). But it takes work for a sysadmin/devops to educate all engineers in the company and make sure everyone uses the correct setup and doesn't end up dropping authorized_keys around random servers. It's not that difficult technically as it is socially.
        number6 6y ago
        Yeah, you are right about this. Just thought about a personal setup, but getting it all up and running in enterprise scape will be more work than just a few flags
    - mcpherrinm 6y ago
      None of these features are supported by openssh without external code. You can manually sign certs for users and hosts with ssh-keygen but there's no distribution or automation included with openssh. There's a half dozen SSH CA solutions around for this, but none as polished as what teleport has. Teleport's session logging is unrivaled by anything you can do with openssh and is one of the key reasons I'm looking to adopt it. The reverse tunnel mode could be accomplished with autossh to manage a reverse tunnel, but that's also not out of the box.
akerro 6y ago
Why is this "modern replacement for OpenSSH" when people use ssh specifically because it's so simple and doesn't have webui? There have been many ssh webuis in the last decade, none of them were "replacements" of ssh, just wrappers for people scared of terminals. What exactly does it do that 20 other ssh wrappers (or even portainer for containers) don't?
- chucky_z 6y ago
  It's really slick, and provides a client/server architecture with a bunch of extra security on-top. It generates 1:1 certificates between the api layer and the clients, using a full auth service. I deployed it at a previous position and stopped SSH across all hosts entirely, and just used this. It rotated all it's own certificates every 4 hours, and each SSH connection used a unique certificate. I never had any issues with it, and I had the web UI straight up exposed to the internet. It enforces TOTP and user management with the OSS stuff is pretty trivial. It also did something really cool, which is that I had multiple bastions federated together through a single API, instead of having singular multiple bastions. This meant no configuration to access hosts between prod/stage/test, all a single entry point, it was awesome. I don't use it today in my current position for a number of reasons, but if I were to go back to a smaller company and had the choice, I would deploy it with no hesitation.
johnklos 6y ago
There's little more than marketing bull on that site. Web user interface? No need for VPN? They precisely miss the whole reason for ssh. It's as if they have no clue what ssh is or does.
- adamzegelin 6y ago
  > It's as if they have no clue what ssh is or does. It's marketing speak geared towards managers who have no idea what SSH is or does.
scarygliders 6y ago
Why!?!? Why do people do this!? If I want to ssh, I'll use ssh. I do not want or need a "web UI" in or for my ssh client. Is it because I'm getting old? Do I not understand why these darn kids do what they do? Or has my 51 years on this planet taught me that the KISS principle reigns supreme and that "those who don't learn from history, are doomed to repeat it"? Is it, in fact, just me who is mildly abhorred by this? Grimacing like Clint Eastwood from Gran Torino?
- atonse 6y ago
  You’re not the customer. Any organization that has sufficiently large has a need to know who is accessing what, and when. Tools like this help manage all that when you could have hundreds of logins a day.
  - scarygliders 6y ago
    Pardon my 51yo brain, but I seem to remember that every ssh login is logged? Yes, auth.log if my memory serves.
    - mcpherrinm 6y ago
      auth.log is way primitive compared to what teleport has. It logs the actual session data, and if "enhanced" recording is enabled, it uses BPF tracing to record all processes executions and files that were opened. fwiw, the web ui is optional. Nobody's taking away your ssh client.
    - kohtatsu 6y ago
      https://gravitational.com/teleport/how-it-works/audit-logging-for-ssh-and-kubernetes/ https://gravitational.com/teleport/how-it-works/audit-loggin... Their audit log can include a lot more in a more structured format, including wire activity and even std{in,out,err}.
    - benarent 6y ago
      This can only get you so far. We invested a lot time into getting more from system access event using eBPF to take n unstructured SSH session and outputs a stream of structured events. https://gravitational.com/blog/enhanced-session-recording/ https://gravitational.com/blog/enhanced-session-recording/
rob-olmos 6y ago
I wish RBAC was part of core rather than a paid addon. Oh well.
- benarent 6y ago
  Hey Rob, We are considering this. Send me mail, it would be good to get more feedback ben@gravitational.com
jon-wood 6y ago
For all the people complaining about the web UI, it’s optional, Teleport also has a CLI and if you really want to you can use OpenSSH as the client. Teleport’s benefit isn’t really the web UI, it’s the fact it manages a certificate authority for authentication, hooked into the same authentication used for other things, and full audit logging of what people are doing via SSH.
benarent 6y ago
Hey HN! I Director of Product for Teleport, and that does include CLI and YAML experience. This is a bumper release, with a bunch of fixes https://github.com/gravitational/teleport/releases/tag/v4.3.0 https://github.com/gravitational/teleport/releases/tag/v4.3.... . Even for OpenSSH users using Teleport in Recording Proxy mode. As always I love some HN comments. While you do need a running proxy. You can use Teleport without ever having to use the UI. Here to answer any questions.
- skratlo 6y ago
  Hey, tell your marketing people that they did a really poor job. Taking a stab at everyone's beloved ssh? Calling your offering a replacement for it?! Daring! No wonder you're getting all that hate here on HN
  - benarent 6y ago
    We love OpenSSH, and you can even setup Teleport in Recording mode. https://gravitational.com/teleport/docs/architecture/teleport_proxy/#recording-proxy-mode https://gravitational.com/teleport/docs/architecture/telepor... but there are many good reasons to use the Teleport Library. https://gravitational.com/blog/openssh-vs-teleport/ https://gravitational.com/blog/openssh-vs-teleport/
deleted 6y ago
[deleted]
solotronics 6y ago
Is this compatible with SCP?
- benarent 6y ago
  Yes https://gravitational.com/teleport/docs/user-manual/#copying-files https://gravitational.com/teleport/docs/user-manual/#copying... but beware of SCP https://gravitational.com/blog/scp-familiar-simple-insecure-slow/ https://gravitational.com/blog/scp-familiar-simple-insecure-...
  - solotronics 6y ago
    Interesting. Thanks!
AshamedCaptain 6y ago
"modern replacement for X" looks to me like about the worst title one could choose for advertising a product. In networking (and a bit everywhere in engineering) people seem to associate "modern" with negatives, at least as a first impression; so if the tagline you try to sell your product is only "Modern replacement of X", it likely starts at -1 in the minds of most of your targets.
jle17 6y ago
For those who are looking for a simple ssh bastion but have no need for all of Teleport features, there is also https://github.com/moul/sshportal https://github.com/moul/sshportal. Administration and registration is done through ssh, with no need for a special client or a web ui, and the whole thing is just a single binary which stores its configuration in sqlite (by default).
markhahn 6y ago
bleah. solving made-up problems.
- webvictim 6y ago
  The problems are very real if you work at any large organisation which has compliance requirements.

65 points by gk1 6y ago

Aside from shivering at the mention of "Web UI", I don't quite get what this does that SSH doesn't. The landing page is super useless, and the blog post doesn't exactly explain why a VPN service (since it "removes the need for VPN", it's a VPN) is a replacement for ssh. Like, "glorious portal radiating encrypted beams into all of your clouds and smart devices", umm yeah okay.

mcpherrinm 6y ago
Seems like this mainly notes changes in this release. https://gravitational.com/teleport https://gravitational.com/teleport is the landing page with more feature details. I think a short list of features interesting to me is: * SSH CA integrated with whatever SSO you have, removing need to distribute SSH authorized_keys files. * SSH Bastion & Server with audit logging. Record sessions, who did what. Needed for many security-sensitive environments. * Reverse-tunnel mode, where devices without public IPs (or a vpn) can connect to your bastion server. Useful if you're deploying computers "in the field" that you want remote access to, without needing additional VPN or port forwarding, etc.
- stinkytaco 6y ago
  > Reverse-tunnel mode, where devices without public IPs (or a vpn) can connect to your bastion server. This may be a ridiculous question, but what's wrong with a VPN in this scenario? Or even a SOCKS proxy, which is already widely deployed and supported? You say "without needing additional VPN or port forwarding", but I'm curious what advantages it offers over using a VPN.
  - mcpherrinm 6y ago
    Just extra pieces to manage. With a VPN, now you need to start worrying about firewall rules (do you isolate clients? What internal resources do they get access to?), IP assignment (now you need to run a DHCP server, or handle static IP allocations). What subnets do you use for your VPN, and what happens if they conflict with the network at some of your locations? Or maybe buy a VPN appliance to do that for you. Then you need to handle VPN authentication... Lots of that is largely un-needed effort. If you just want to be able to SSH into computers, it's simpler to just have your ssh server connect back. At small scale, where an ops team can keep track of all the computers individually? yeah, VPN is probably fine, especially if you've already got one. But I think these days, a lot of people are looking at avoiding VPNs outright.
    - jon-wood 6y ago
      These complications are particularly relevant if you're managing a fleet of devices on networks you don't control, such as on-prem versions of SaaS systems, or consumer IoT devices. In that situation you definitely don't want the device to be sitting around with a back door into your network, and subnet conflicts are often impossible to resolve.
  - acdha 6y ago
    VPNs are a huge security risk: you’re installing a lot of complex code and configuration into a secure context listening on an open network port, and you almost certainly open more traffic than just SSH so an attacker who compromises a VPN client can attack those services, too. They have advantages, too, but it’s not a simple decision. A reverse tunnel where the server has an agent which opens an outbound connection to receive requests over cuts a bunch of risks out of your environment and it’s less work to operate, too.
- lucb1e 6y ago
  > devices without public IPs (or a vpn) can connect to your bastion server How does it punch through NAT? Or does the NATted device connect similarly to using ssh -R 1234:localhost:22 (just like CAs and session recording work with SSH as well, but I guess this project might make it more integrated and user-friendly with a nice GUI)?
  - cronos 6y ago
    The NATted device dials out to the bastion (a.k.a. proxy) and maintains a persistent tunnel. The proxy then sends all the connections to this device inside that tunnel.
- birdyrooster 6y ago
  OpenSSH can already do all of these things that you listed.
  - cronos 6y ago
    Yes, but it's rarely how companies use OpenSSH because it takes a ton of work to set up. Teleport gives you all this functionality by default out of the box. So it's not inventing anything new, just provides better UX.
    - number6 6y ago
      Its not a ton of work, most works out of the box and requires just a command line argument
      - cronos 6y ago
        A "ton" of work may have been an exaggeration. Maintaining a CA (and dealing with cert rotation) is some work. Other things are indeed just a flag or config option (like jumphosts). But it takes work for a sysadmin/devops to educate all engineers in the company and make sure everyone uses the correct setup and doesn't end up dropping authorized_keys around random servers. It's not that difficult technically as it is socially.
        number6 6y ago
        Yeah, you are right about this. Just thought about a personal setup, but getting it all up and running in enterprise scape will be more work than just a few flags
  - mcpherrinm 6y ago
    None of these features are supported by openssh without external code. You can manually sign certs for users and hosts with ssh-keygen but there's no distribution or automation included with openssh. There's a half dozen SSH CA solutions around for this, but none as polished as what teleport has. Teleport's session logging is unrivaled by anything you can do with openssh and is one of the key reasons I'm looking to adopt it. The reverse tunnel mode could be accomplished with autossh to manage a reverse tunnel, but that's also not out of the box.

akerro 6y ago

Why is this "modern replacement for OpenSSH" when people use ssh specifically because it's so simple and doesn't have webui? There have been many ssh webuis in the last decade, none of them were "replacements" of ssh, just wrappers for people scared of terminals. What exactly does it do that 20 other ssh wrappers (or even portainer for containers) don't?

chucky_z 6y ago
It's really slick, and provides a client/server architecture with a bunch of extra security on-top. It generates 1:1 certificates between the api layer and the clients, using a full auth service. I deployed it at a previous position and stopped SSH across all hosts entirely, and just used this. It rotated all it's own certificates every 4 hours, and each SSH connection used a unique certificate. I never had any issues with it, and I had the web UI straight up exposed to the internet. It enforces TOTP and user management with the OSS stuff is pretty trivial. It also did something really cool, which is that I had multiple bastions federated together through a single API, instead of having singular multiple bastions. This meant no configuration to access hosts between prod/stage/test, all a single entry point, it was awesome. I don't use it today in my current position for a number of reasons, but if I were to go back to a smaller company and had the choice, I would deploy it with no hesitation.

johnklos 6y ago

There's little more than marketing bull on that site. Web user interface? No need for VPN? They precisely miss the whole reason for ssh. It's as if they have no clue what ssh is or does.

adamzegelin 6y ago
> It's as if they have no clue what ssh is or does. It's marketing speak geared towards managers who have no idea what SSH is or does.

scarygliders 6y ago

Why!?!? Why do people do this!? If I want to ssh, I'll use ssh. I do not want or need a "web UI" in or for my ssh client. Is it because I'm getting old? Do I not understand why these darn kids do what they do? Or has my 51 years on this planet taught me that the KISS principle reigns supreme and that "those who don't learn from history, are doomed to repeat it"? Is it, in fact, just me who is mildly abhorred by this? Grimacing like Clint Eastwood from Gran Torino?

atonse 6y ago
You’re not the customer. Any organization that has sufficiently large has a need to know who is accessing what, and when. Tools like this help manage all that when you could have hundreds of logins a day.
- scarygliders 6y ago
  Pardon my 51yo brain, but I seem to remember that every ssh login is logged? Yes, auth.log if my memory serves.
  - mcpherrinm 6y ago
    auth.log is way primitive compared to what teleport has. It logs the actual session data, and if "enhanced" recording is enabled, it uses BPF tracing to record all processes executions and files that were opened. fwiw, the web ui is optional. Nobody's taking away your ssh client.
  - kohtatsu 6y ago
    https://gravitational.com/teleport/how-it-works/audit-logging-for-ssh-and-kubernetes/ https://gravitational.com/teleport/how-it-works/audit-loggin... Their audit log can include a lot more in a more structured format, including wire activity and even std{in,out,err}.
  - benarent 6y ago
    This can only get you so far. We invested a lot time into getting more from system access event using eBPF to take n unstructured SSH session and outputs a stream of structured events. https://gravitational.com/blog/enhanced-session-recording/ https://gravitational.com/blog/enhanced-session-recording/

rob-olmos 6y ago

I wish RBAC was part of core rather than a paid addon. Oh well.

benarent 6y ago
Hey Rob, We are considering this. Send me mail, it would be good to get more feedback ben@gravitational.com

jon-wood 6y ago

For all the people complaining about the web UI, it’s optional, Teleport also has a CLI and if you really want to you can use OpenSSH as the client. Teleport’s benefit isn’t really the web UI, it’s the fact it manages a certificate authority for authentication, hooked into the same authentication used for other things, and full audit logging of what people are doing via SSH.

benarent 6y ago

Hey HN! I Director of Product for Teleport, and that does include CLI and YAML experience. This is a bumper release, with a bunch of fixes https://github.com/gravitational/teleport/releases/tag/v4.3.0 https://github.com/gravitational/teleport/releases/tag/v4.3.... . Even for OpenSSH users using Teleport in Recording Proxy mode. As always I love some HN comments. While you do need a running proxy. You can use Teleport without ever having to use the UI. Here to answer any questions.

skratlo 6y ago
Hey, tell your marketing people that they did a really poor job. Taking a stab at everyone's beloved ssh? Calling your offering a replacement for it?! Daring! No wonder you're getting all that hate here on HN
- benarent 6y ago
  We love OpenSSH, and you can even setup Teleport in Recording mode. https://gravitational.com/teleport/docs/architecture/teleport_proxy/#recording-proxy-mode https://gravitational.com/teleport/docs/architecture/telepor... but there are many good reasons to use the Teleport Library. https://gravitational.com/blog/openssh-vs-teleport/ https://gravitational.com/blog/openssh-vs-teleport/

deleted 6y ago

[deleted]

solotronics 6y ago

Is this compatible with SCP?

benarent 6y ago
Yes https://gravitational.com/teleport/docs/user-manual/#copying-files https://gravitational.com/teleport/docs/user-manual/#copying... but beware of SCP https://gravitational.com/blog/scp-familiar-simple-insecure-slow/ https://gravitational.com/blog/scp-familiar-simple-insecure-...
- solotronics 6y ago
  Interesting. Thanks!

AshamedCaptain 6y ago

"modern replacement for X" looks to me like about the worst title one could choose for advertising a product. In networking (and a bit everywhere in engineering) people seem to associate "modern" with negatives, at least as a first impression; so if the tagline you try to sell your product is only "Modern replacement of X", it likely starts at -1 in the minds of most of your targets.

jle17 6y ago

For those who are looking for a simple ssh bastion but have no need for all of Teleport features, there is also https://github.com/moul/sshportal https://github.com/moul/sshportal. Administration and registration is done through ssh, with no need for a special client or a web ui, and the whole thing is just a single binary which stores its configuration in sqlite (by default).

markhahn 6y ago

bleah. solving made-up problems.

webvictim 6y ago
The problems are very real if you work at any large organisation which has compliance requirements.