News for hackers. Stuff that matters.

A comment on Teleport 4.3: Modern Replacement for OpenSSH. Parent comment

Re:Teleport 4.3: Modern Replacement for OpenSSH by scarygliders on Thursday July 09, 2020 @05:48PM (#23785627)
Pardon my 51yo brain, but I seem to remember that every ssh login is logged?

Yes, auth.log if my memory serves.

[ Parent | on HN ]
Re:Teleport 4.3: Modern Replacement for OpenSSH by benarent on Thursday July 09, 2020 @06:05PM (#23785779)
This can only get you so far. We invested a lot time into getting more from system access event using eBPF to take n unstructured SSH session and outputs a stream of structured events. https://gravitational.com/blog/enhanced-session-recording/
[ Parent | on HN ]
Re:Teleport 4.3: Modern Replacement for OpenSSH by kohtatsu on Thursday July 09, 2020 @06:22PM (#23785943)
I was (naturally) skeptical at first as well, but this looks great.

I saw on another page that audit logs are sent off server, presumably append-only, but can Teleport pause execution until after log replication is verified?

For plain logs this would be straightforward, but for enhanced logging I suppose it'd be a matter of deciding when to pause execution, e.g. after downloading a file.

[ Parent | on HN ]
Re:Teleport 4.3: Modern Replacement for OpenSSH by mcpherrinm on Thursday July 09, 2020 @05:53PM (#23785676)
auth.log is way primitive compared to what teleport has.

It logs the actual session data, and if "enhanced" recording is enabled, it uses BPF tracing to record all processes executions and files that were opened.

fwiw, the web ui is optional. Nobody's taking away your ssh client.

[ Parent | on HN ]
Re:Teleport 4.3: Modern Replacement for OpenSSH by kohtatsu on Thursday July 09, 2020 @05:56PM (#23785704)
https://gravitational.com/teleport/how-it-works/audit-loggin...

Their audit log can include a lot more in a more structured format, including wire activity and even std{in,out,err}.

[ Parent | on HN ]