Teleport is software which provides an SSH Jump Host (or Bastion host) service in a secure, modern , way, with support for role-based access control , and single sign-on. It is a replacement for the ecAccess SSH service, and is operated by the CD Apps team and User Services.

Overview

The Teleport used to access a number of services at ECMWF, including our Atos HPCF and ECS services. The service provides:

• Single SSH hop from client systems anywhere on the internet to servers inside ECMWF (ecGate, HPC, etc)
• Web single sign-on using ECMWF's website and the HID token
• Eight hour sessions allowing multiple connections between re-authenticationRe-authentication required only every 12 hours (usually once per working day)
• Integration with standard tools such as the OpenSSH ssh client, scp, and ssh-agent
• X11 and Port forwarding

The single sign-on step is performed using an application called "tsh", every eight hours.After . After that you use standard ssh or scp to connect to systems inside ECMWF.

Downloading tsh 

The tsh application is required to perform user authentication once every eight hours.

tsh is open source, very portable, and has minimal dependencies.

• Download from the Gravitational website and place into your $PATH 

The binary is available for Linux 32-bit, 64-bit, and ARM, as well as Windows 64-bit and a signed package for MacOS.

MacOS users can also use homebrew for installation (brew install teleport).

User Authentication

Once every eight hours, you will need to refresh your tokens by logging in to the ECMWF website.

First Time

Run tsh, giving the location of our gateway:

tsh login --proxy=shell.ecmwf.int:443

Your default web browser will open and you should login with your email address, workstation password, and then HID Token code.

Subsequent Occasions

tsh login

Connecting to hosts through the gateway

OpenSSH 7.3 or later has a simple command line option to connect via our gateway (shell.ecmwf.int) to the destination-host:

ssh -J username@shell.ecmwf.int username@destination-host

For example, if your username is ab0 and you wish to connect to ecgate:

ssh -J ab0@shell.ecmwf.int ab0@ecgate

The OpenSSH configuration setting for this is named ProxyJump:

Host ecgate
  User ab0
  ProxyJump ab0@shell.ecmwf.int

See the Legacy Configuration note below if your ssh client is older than 7.3.

If your connection fails after working for some time, it could be because your tokens have expired. You can check them:

$ tsh status
> Profile URL:  https://shell.ecmwf.int:443
  Logged in as: firstname.lastname@ecmwf.int
  Cluster:      shell.ecmwf.int
  Roles:        *
  Logins:       ab0
  Valid until:  2020-06-22 23:26:30 +0100 BST [EXPIRED]
  Extensions:   permit-agent-forwarding, permit-port-forwarding, permit-pty

Destination Hosts available

The hosts available through the Teleport gateway are:

• Linux VDI (both legacy OpenSUSE and CENTOS 8 beta)
• Physical office workstations
• ecGate
• HPC2020 TEMS

Configuring passwordless login

With the initial configuration you may be prompted for a password at the destination-host.

For login without a password, add the Teleport certificate authority to your ~/.ssh/authorized_keys file:

curl -fs https://nexus.ecmwf.int/repository/internal-teleport-configs/prod/teleport_user_ca.pub >> ~/.ssh/authorized_keys

Other Notes

SSH Agent is required

If you have logged in but ssh fails to connect, it may be that your SSH agent is not running.

The Agent can be started and tokens refreshed this way:

eval $(ssh-agent -s)
tsh logout
tsh login

And this will make sure the Agent continues to run in your environment:

echo 'eval $(ssh-agent -s)' >> ~/.bash_profile

SCP, X11, Agent, and Port Forwarding

scp, agent, and port forwarding will work through the Teleport gateway.

Legacy Configuration

For OpenSSH clients older than 7.3, the following configuration can be used:

# ~/.ssh/config file:
Host ecgate
  User ab0
  ProxyCommand /usr/bin/ssh -q -W %h:%p ab0@shell.ecmwf.int

Difficult client environments

You might not be able to download and run tsh, or access our web login service, from where you wish to use ssh.

Instead you can use (or copy) the identity file which tsh stores in $HOME:

# ~/.ssh/config file:
Host ecgate
  User ab0
  IdentityFile ~/.tsh/keys/shell.ecmwf.int/firstname.lastname@ecmwf.int
  ProxyCommand /usr/bin/ssh -q -i ~/.tsh/keys/shell.ecmwf.int/firstname.lastname@ecmwf.int -W %h:%p ab0@shell.ecmwf.int

This is a good way to access Teleport credentials via a shared file system from any host.

Windows Clients

There are various ways to initiate SSH from Windows 10, so it depends on your system and your preferences.

...

Here are the instructions on how to set it up depending on your platform:

• Teleport SSH Access - Mac configuration
• Teleport SSH Access - Linux configuration
• Teleport SSH Access - Windows Terminal and Powershell configuration
• Teleport SSH Access - Windows Subsystem for Linux (WSL)
• Teleport SSH Access - Windows MobaXterm configuration
• Teleport SSH Access - Windows Cygwin configuration

  
  

1. Install MobaXterm if it is not already on your system
2. Download tsh (you may need to instruct antivirus software to ignore the file)
3. Start MobaXterm
4. Login using tsh (you will always need to specify the --proxy setting)
5. Use the following in $HOME/.ssh/config (MobaXterm's home):

Host ecgate
  User ab0
  ProxyCommand ssh -q -i c:/users/ab0/.tsh/keys/shell.ecmwf.int/firstname.lastname@ecmwf.int -W %h:%p ab0@shell.ecmwf.int
  IdentityFile c:/users/ab0/.tsh/keys/shell.ecmwf.int/firstname.lastname@ecmwf.int

1. Start the Windows SSH Agent Service
2. Download tsh (you may need to instruct antivirus software to ignore the file)
3. Login using tsh (you will always need to specify the --proxy setting)
4. Use an SSH config as below:

# Windows currently has a bug, you need the full path to ssh or you will get:
# posix_spawn: No such file or directory

Host *.ecmwf.int
  User ab0
  ProxyCommand C:\Windows\System32\OpenSSH\ssh.exe -q -W %h:%p ab0@shell.ecmwf.int

# this assumes the SSH Agent is running, otherwise add:
# Host shell.ecmwf.int
#   IdentityFile ~/.tsh/keys/shell.ecmwf.int/firstname.lastname@ecmwf.int

The Windows 10 Terminal is a decent tabbed command line interface (albeit with no X support). New sessions can be configured following this example: