3 ms·

OpenSSH can already do all of these things that you listed.

• cronos 6y ago
  Yes, but it's rarely how companies use OpenSSH because it takes a ton of work to set up. Teleport gives you all this functionality by default out of the box. So it's not inventing anything new, just provides better UX.
  • number6 6y ago
    Its not a ton of work, most works out of the box and requires just a command line argument
    • cronos 6y ago
      A "ton" of work may have been an exaggeration. Maintaining a CA (and dealing with cert rotation) is some work. Other things are indeed just a flag or config option (like jumphosts). But it takes work for a sysadmin/devops to educate all engineers in the company and make sure everyone uses the correct setup and doesn't end up dropping authorized_keys around random servers. It's not that difficult technically as it is socially.
      • number6 6y ago
        Yeah, you are right about this. Just thought about a personal setup, but getting it all up and running in enterprise scape will be more work than just a few flags
• mcpherrinm 6y ago
  None of these features are supported by openssh without external code. You can manually sign certs for users and hosts with ssh-keygen but there's no distribution or automation included with openssh. There's a half dozen SSH CA solutions around for this, but none as polished as what teleport has. Teleport's session logging is unrivaled by anything you can do with openssh and is one of the key reasons I'm looking to adopt it. The reverse tunnel mode could be accomplished with autossh to manage a reverse tunnel, but that's also not out of the box.