4 ms·

I quite like the idea of this, but it would be a very hard sell to most infra and security teams IMO. Installing a 3rd party agent that in some way permits shel

I quite like the idea of this, but it would be a very hard sell to most infra and security teams IMO. Installing a 3rd party agent that in some way permits shell access to a server and (I assume) needs to run constantly is definitely going to raise a few eyebrows especially when the benefit of using is actually fairly low. BUT! I would 100% use this as an interview tool; I run our more junior candidates through a couple of short troubleshooting scenarios that involve them SSH'ing to something and doing some basic Linux troubleshooting. This tool would make that process much much better especially now that our interviews are mostly remote.

kevin_nisbet 4y ago
> Installing a 3rd party agent that in some way permits shell access to a server and (I assume) needs to run constantly is definitely going to raise a few eyebrows especially when the benefit of using is actually fairly low. Yea, I wouldn't go this route to just get the pairing functionality, but Teleport does have other utility around audit, SSO integrations, etc. So there are companies that use Teleport as the primary SSH access if there needs match what Teleport offers. Disclosure: I'm a former employee of Teleport.
old-gregg 4y ago
> Installing a 3rd party agent that in some way permits shell access to a server and (I assume) needs to run constantly is definitely going to raise a few eyebrows especially when the benefit of using is actually fairly low. You're already running sshd. Teleport is a drop-in open source replacement, which offers some interesting features like certificate-only auth (removing the need for pubic/private keys), SSO integration, RBAC over SSH, support for protocols other than SSH (Kubernetes API and major OSS databases), and syscall level authorization and audit, so quite a few security teams have appreciated it lately. Disclaimer: I work at Teleport and have been a maintainer for the first 3 years.
- muppetman 4y ago
  SSHD has a proven track record. A program (open source or not) that replaces a proven bastion of security while offering "some interesting features" is exactly the sort of thing a security team will balk at. Software that's a "known quantity" that a lot of people can support is a big thing when it comes to security. I've not heard of Teleport until this post. Don't get me wrong, I'm sure Teleport is wonderful at what it does, probably more secure than SSHD etc. But it hasn't earned that trust amongst a wide base yet so people will be hesitate to use it. Hell even mosh can be hard to get as a trusted thing.
  - old-gregg 4y ago
    Could not agree more! Trust is easy to lose but it takes years to earn.

kevin_nisbet 4y ago

> Installing a 3rd party agent that in some way permits shell access to a server and (I assume) needs to run constantly is definitely going to raise a few eyebrows especially when the benefit of using is actually fairly low. Yea, I wouldn't go this route to just get the pairing functionality, but Teleport does have other utility around audit, SSO integrations, etc. So there are companies that use Teleport as the primary SSH access if there needs match what Teleport offers. Disclosure: I'm a former employee of Teleport.

old-gregg 4y ago

> Installing a 3rd party agent that in some way permits shell access to a server and (I assume) needs to run constantly is definitely going to raise a few eyebrows especially when the benefit of using is actually fairly low. You're already running sshd. Teleport is a drop-in open source replacement, which offers some interesting features like certificate-only auth (removing the need for pubic/private keys), SSO integration, RBAC over SSH, support for protocols other than SSH (Kubernetes API and major OSS databases), and syscall level authorization and audit, so quite a few security teams have appreciated it lately. Disclaimer: I work at Teleport and have been a maintainer for the first 3 years.

muppetman 4y ago
SSHD has a proven track record. A program (open source or not) that replaces a proven bastion of security while offering "some interesting features" is exactly the sort of thing a security team will balk at. Software that's a "known quantity" that a lot of people can support is a big thing when it comes to security. I've not heard of Teleport until this post. Don't get me wrong, I'm sure Teleport is wonderful at what it does, probably more secure than SSHD etc. But it hasn't earned that trust amongst a wide base yet so people will be hesitate to use it. Hell even mosh can be hard to get as a trusted thing.
- old-gregg 4y ago
  Could not agree more! Trust is easy to lose but it takes years to earn.