search

gravitational / teleport

The easiest, and most secure way to access and protect all of your infrastructure.
https://goteleport.com
GNU Affero General Public License v3.0
17.64k stars 1.76k forks source link

v13 Agentless/OpenSSH guide permissions requirements not documented #25129

Closed GavinFrazar closed 1 year ago

GavinFrazar commented 1 year ago

Applies To

https://goteleport.com/docs/ver/13.x/server-access/guides/openssh/#step-15-add-a-node-resource-to-your-teleport-cluster

Details

When following this guide I was using tctl remotely. My user had roles access,editor,auditor. These roles do not have resource permission create/update for node resources.

The guide should explain that these permissions are necessary and explain how to grant them.

$ tctl create ~/teleport-config/resources/nodes/openssh.yaml
ERROR: access denied to perform action "create" on "node", access denied to perform action "update" on "node"
ptgott commented 1 year ago

@capnspacehook Should the preset editor role include this access? I can see that it doesn't, but there's an argument to be made that it's in the spirit of the editor role to be able to create Node resources. Was there a discussion around this? Thanks!

capnspacehook commented 1 year ago

Yes I think it should, I'll make a PR to do that