Teleport 4.3: Modern Replacement for OpenSSH

Re:Teleport 4.3: Modern Replacement for OpenSSH by throw0101a on Thursday July 09, 2020 @06:14PM (#23785876)

> Teleport handles the auth at its entry point, so you don't need a keypair for every node in your cloud. Just one for Teleport.

From ssh(1):

     -J destination
             Connect to the target host by first making a ssh connection to
             the jump host described by destination and then establishing a
             TCP forwarding to the ultimate destination from there.  Multiple
             jump hops may be specified separated by comma characters.  This
             is a shortcut to specify a ProxyJump configuration directive.

Auth to the jump/bastion host and then have key(s) on that, or tunnel back the internal auth requests over to your desktop via ssh-agent(1) forwarding:

* http://www.unixwiz.net/techtips/ssh-agent-forwarding.html#fw...

* https://www.cloudsavvyit.com/25/what-is-ssh-agent-forwarding...

[ Parent | on HN ]

Re:Teleport 4.3: Modern Replacement for OpenSSH by cronos on Thursday July 09, 2020 @07:21PM (#23786418)

There are a few differences between an OpenSSH jump host and Teleport: - you have to actively manage authorized_keys for every person using openssh; Teleport manages a PKI and can be backed by your existing SSO - it hard to restrict any given user to a subset of hosts (e.g. only allow select few to access prod database); Teleport has RBAC - hosts with Teleport also get SSH certificates, so you don't need to trust-on-first-use (which everyone has been conditioned to ignore)

[ Parent | on HN ]