Teleport 2.0 Released: Modern SSH for clusters and teams

http://gravitational.com/blog/teleport_2.0_released/

133 72 9 years ago

twakefield2• 9 years ago

Hey HN, we (gravitational) are pretty excited about this release. We'll be monitoring the thread in case you have any questions.

atonse2• 9 years ago

Hi twakefield, congrats on the release!

So does this seem like a typical use in an AWS VPC:

- SSH bastion server with public IP with security groups for each user

- Every other server only has private IPs, only allowing access between each other and then the bastion server

How do you generate and store keys? Are you using something like Hashicorp's Vault?

russjones4• 9 years ago

Hi atonse, Russell from Gravitational here.

As far as configuring your VPC having the bastion (Proxy) as the only server with a public address is reasonable. One of the nice things about Teleport is that the Teleport Proxy itself doesn't have access to much, so exposing it to the Internet is fine. The Auth Server is the one that holds sensitive information and we recommend you create a security group for it and only allow it to be accessed from Teleport Proxies or Teleport Nodes.

With respect to keys, they are stored and accessed via the Auth Server in Teleport. We recommend you have strong access controls on the Auth Server. If you are using the default backend (BoltDB) or directory based backend that's all you need to do. If you are using etcd we recommend you have strong access controls on the server that runs etcd as well as etcd itself, we have an example in our Teleport repo for etcd configuration if you're interested[1]. If you are using DynamoDB, we recommend having a strong IAM policy. We are not using Vault at the moment.

[1] https://github.com/gravitational/teleport/tree/master/exampl...

qmarchi• 9 years ago

What's Enterprise pricing look like for a small deployment? <10 systems

twakefield2• 9 years ago

qmarchi - we have some different options that are dependent on support needed. If you fill out the contact form on gravitational.com I can go into more detail. Or email info@.

nikolay• 9 years ago

Any CloudFormation template to launch this on AWS?

russjones4• 9 years ago

Hi nikolay, we don't have a CloudFormation template, but we do have a containerized version of Teleport that is fully configured with multiple clusters that you can use to test with.

https://github.com/gravitational/teleport/tree/master/docker

robotmay• 9 years ago

This is a very timely post for me, as I may have a very good use for Teleport and I hadn't heard about it before :)

mdekkers2• 9 years ago

have a look at jumpcloud

puzzle2• 9 years ago

I seem to remember that the features now available as Enterprise-only were not listed as such during development. Even if that's not the case, it's still a bummer. And it really sucks having to go through a salesperson's spiel just to get an idea of the costs. I hate it when companies don't post list prices on their site. I'm also looking at you, Hashicorp, and your Vault Enterprise.

desdiv• 9 years ago

I hate it when companies don't post list prices on their site.

Same here. If SpaceX can openly advertise their prices, then so can you.

[0] http://www.spacex.com/about/capabilities

alexk7• 9 years ago

To be honest, it takes one email to get our pricing, and we mostly use it to stay in touch and understand your use-case better.

Thanks for feedback though, we will work on making it easier to get the pricing and explain the split between enterprise and OSS parts of teleport better.

artellectual• 9 years ago

Actually by not posting your price upfront, is actually wasting time for both you and the client. You see if I have a budget for a solution of 60USD and your solution starts at 6000USD I know to look elsewhere. But if you don't what will happen is you will collect my email to "stay in touch" about a product I have no use for, increasing my spam by 1. My email address in your mailing list is wasting my inbox space and your time. In fact your mailing list is probably what you use to give your sales person. But it's counter productive instead of having 100 potential customer who have accepted your pricing for your product, now you have 10000 people who may or may not be interested. So now your sales staff have to spend time chasing up cold leads instead of focusing on 100 customers whom they have a higher chance of closing. So you see by not posting the price you are causing harm to your own sales pipeline and one more person to make you as a spammer.

raesene6• 9 years ago

So just to chime in on this, I'd echo others in saying that "call for pricing" or any variants thereof, are a huge turnoff to me in terms of buying software.

It instantly makes me think "this will be expensive" and "if I call and it's not right for me, I'll be getting hassled by sales people forever more"

Now, neither of these things may be true for your software, but people who've experienced the pain of buying "enterprise" software before will likely be put off by this approach.

It also gives the impression that pricing isn't fixed and that the sales process will involve lots of haggling, which also puts people who don't like haggling off.

puzzle2• 9 years ago

And to be clear: it is your product and it's your choice how to develop it or make it available on the market. The only reason that I took the time to vent is that I actually like Teleport a lot. You won't see me complain about Oracle or Symantec pricing details. :-)

Arcsech• 9 years ago

"Contact us for pricing" means "unless price is no object, forget about it" in my experience. Every time I've followed up with a "contact for pricing" product, the reply has been for 10-100x what I was expecting.

If you're selling to only Fortune 100s, that's fine. If you're aiming a little lower than that, not giving a public price of some kind up front is driving away a lot of potential customers.

quillo• 9 years ago

On the topic of enterprise features and specifically, Hashicorp Vault, I did ask Hashicorp sales if it was possible to trial Vault Enterprise (for the UI) without the pre-sales dance and was flatly told "no".

This kind of attitude really rubs me the wrong way. On follow up from their sales I simply told them I opted for an open source UI from Github.

While I want to support the work Hashicorp are doing, I want to be treated as someone who understands that I don't need to spend money on the product. It's a concern to me that as these open source projects find ways to monetise they start to slowly make their way back to the type of ecosystem that I wanted to avoid in the first place.

giantahead• 9 years ago

This is awesome! Much interested to read audit results.

SEJeff3• 9 years ago

Here is a question for teleport developers:

Why teleport over kerberos + ssh? What can this provide that RHEL7 + a kerberized LDAP like IPA + sssd already provides?

old-gregg2• 9 years ago

Well, with enough in-house expertise everything is possible using a set of the tools you're an expert at.

But with ever-growing complexity and volume of the infrastructure, the expertise required and time to manage these things are in short supply. Teleport is mainly the opinionated and simplified way to deliver SSH best practices.

Additionally, it has a few neat usability features (like a nice Web UI) and directly addresses the use case of managing the infrastructure that's not yours (MSP use case) where you can have multiple clusters owned by different organizations where you can set up cross-cluster trust via certificate authorities (CA)s [1], well... that's just what's on top of my head.

There's more here: http://gravitational.com/teleport/ or feel free to reach out and chat, we're a friendly bunch! :)

[1] That's our use case, Teleport was originally built to set up and manage Kubernetes clusters on infrastructure located behind firewalls, see our flagship here: http://gravitational.com/telekube/

SEJeff3• 9 years ago

Ah the MSP use case is what I missed, that makes a ton of sense. Perfect.

rsync4• 9 years ago

"But with ever-growing complexity and volume of the infrastructure, the expertise required and time to manage these things are in short supply. Teleport is mainly the opinionated and simplified way to deliver SSH best practices."

We're talking about the ssh command here, right ? And associated key generation and config files ? Are there people who are "experts" at that ? Like, the same way there are people who are "experts" at can openers and chip clips ?

"Additionally, it has a few neat usability features (like a nice Web UI) and directly addresses the use case of managing the infrastructure that's not yours (MSP use case) where you can have multiple clusters owned by different organizations where you can set up cross-cluster trust via certificate authorities (CA)s [1], well... that's just what's on top of my head."

You just wrote slide #3 in a future blackhat presentation.

feld2• 9 years ago

Kerberos + ssh is amazing. I don't know why more people aren't aware of this holy grail setup.

alexk7• 9 years ago

there are a couple of nice SSH setups you can achieve with RADIUS and our friends at https://www.foxpass.com/

Vault also has SSH backends that you could find useful

SEJeff3• 9 years ago

My thoughts exactly, and it has years of production battle hardening + crypto validation.

edgan• 9 years ago

Kerberos is really complicated. I am currently setting up LDAP, and have it storing SSH keys. Which is a far simpler setup.

bogomipz2• 9 years ago

Has anyone else used Teleport in production? I would be curious to hear any feedback?

Operyl2• 9 years ago

I tried it during the 1.x phase, and at rest the daemons would eat a core :/.

russjones4• 9 years ago

Hi Operyl, Russell from Gravitational here.

We've made improvements in resource utilization for Teleport 2.0 and hunting down any further resource utilization issues is definitely one of my focus areas for Teleport 2.x.

If you run into issues like this again please reach out and send us your teleport.yaml, we want to run these issues down and resolve them.

pwarner2• 9 years ago

Is there an architecture overview for this case?

Software vendors: they like Teleport for providing remote support of their products. Teleport can be used as a “remote control” to assist their customers with any issues of their software installed and running on-premise.

How does the customer control access to the app deployed on their premise?

Thanks!

alexk7• 9 years ago

Here's the overview of the feature we call "Trusted clusters"

http://gravitational.com/teleport/docs/2.0/admin-guide/#trus...

pwarner2• 9 years ago

Thanks, this is perfect. Will try it out!

rsync4• 9 years ago

Did you know that you can do this:

  ssh -t user@machineB ssh user@machineA

That is, you can execute an ssh client command, over ssh. The '-t' option is required.

alexk7• 9 years ago

For the folks who are interested in such things: "SSH, The Secure Shell: The Definitive Guide" is an amazing book with lots of great info and nice tricks/SSH solutions

http://shop.oreilly.com/product/9780596008956.do

X-Istence• 9 years ago

The -t creates a terminal on the remote host, so in essence it is the same as SSH'ing to machineB and then running the ssh command.

Even cooler is the use of SSH tunneling to set up a ProxyCommand.

secure• 9 years ago

To expand on this, the reason why it’s “even cooler” is because you can use keys to login (as opposed to password) without forwarding your ssh-agent (which is a security risk).

I wrote more about this technique at https://michael.stapelberg.de/Artikel/ssh-conditional-tunnel...

In a nutshell:

    Host home
        Hostname home.zekjur.net
        ProxyCommand ssh -4 dualstack -W %h:%p

Then, “ssh home” will log into “home.zekjur.net” via an IPv4 connection through “dualstack”. This is useful in environments where you don’t have IPv6 and your only use-case is SSH'ing home.

dijit• 9 years ago

Why would you recommend this over -W?

ssh -W user@jumpHost user@destination

dagi3d• 9 years ago

Anyone using it in production? How does it differ from other possible products/solutions?

technofiend• 9 years ago

Have you guys considered buying Fox Technologies? Do you have a compare/contrast between their ssh replacement and yours?

Teleport 2.0 Released: Modern SSH for clusters and teams

Related Stories