search

gravitational / teleport

The easiest, and most secure way to access and protect all of your infrastructure.
https://goteleport.com
GNU Affero General Public License v3.0
17.29k stars 1.74k forks source link

Authenticating SSH Proxy Tunnel #43073

Open AdamMalina opened 2 months ago

AdamMalina commented 2 months ago

What would you like Teleport to do? There are many tools that use SSH (eg. SSH clients such as MobaXterm or some basic python scripts made by software devs/providers), but either don't support certificates or requires manual certificate import (which is problematic, because Teleport certificates have a very short expiration time).

I would like to suggest adding a ssh proxy command that works just like "tsh proxy db --tunnel". It setups a local SSH server and you can connect to it without certificates.

Preferably (if technically possible in Teleport) it will be awesome if target username and hostname can be provided by the client as SSH username (eg. root%node1 opens the terminal that tsh ssh root@node1 would open). I have seen this being an option in many commercial PAM systems, so I hope that it will be possible to implement in Teleport as well.

What problem does this solve? Being able to connect SSH Clients that doesn't support SSH Certificates - MobaXTerm, some basic python scripts, etc...

If a workaround exists, please include it. It doesn't exist

RobyCollibra commented 1 month ago

+1 ! The way I understand the request it would then function similar to the Banyan app where I could launch banyanproxy.exe -l 8888 myServer.myCompany.com myPort and it would create a tunnel between my machine and the remote server, right? When I then ran ssh myUsername@127.0.0.1:8888 it would give me ssh access to myServer.

Note: Even if you can't pass username to it, it would still be a boon to have; you'd simply have to start a new tunnel per user/hostname listening on a different port.

strideynet commented 1 month ago

FWIW, the recently introduced tbot SSH multiplexer, supports at least Go, Ruby and Python. For these it provides an implementation of an SSH agent to provide the credentials and then offers a ProxyCommand which can be invoked to open the connection to the target server.

An authenticating SSH proxy tunnel is a nice idea for supporting languages which do not have a SSH library which supports ProxyCommand or manually passing in an opened connection. I'm not sure where this will fall on our roadmap - what I'd definitely encourage is also opening issues with these libraries to request that they support ProxyCommand/Agent based authentication. These are fairly core features that have existed in OpenSSH for a while and whilst we can certainly work-around their lack of support, it is a less optimal solution.