...
It can be used as a replacement for the ecAccess SSH service, and is being evaluated by the CD Apps team and User Support.
Please read all the introductory "understanding" sections (even if you think you know them), so that the presentation of Teleport makes sense in context.
Understanding ecAccess
A user outside of ECMWF wishes to ssh to one of the Centre's clusters, batch farms, or workstations. This can be done by running:
| Code Block | ||
|---|---|---|
| ||
ssh sy0@ecaccess.ecmwf.int |
| Note |
|---|
Since 2016 the ecAccess ssh module has required custom configuration on the ssh client end to enable known-insecure ciphers. The replacement of this service will of course bring an up-to-date ssh implementation without this issue. |
The user is prompted for a password, which happens to be the one-time code from an ActivID token.
...
The destination server or workstation must run the ecauth binary which is installed "setuid root" (which enables switching to so it can become any user).
ecauth receives the TCP/IP connection from ecAccess and spawns a shell as the original user (sy0, in this example).
Understanding our SSH Proxy service
When servers or workstations inside the Centre wish to ssh to the Internet (not the RMDCN), we tell the client to use our SSH Proxy service.
The Proxy sits in the DMZ and allows transit of the TCP/IP connection from ssh client to server. It does not interrupt the encryption in any way.
| Info |
|---|
The need for the SSH Proxy is mostly to support a network setup where the Centre is dual-homed on both RMDCN and Internet. In the near future (BOND timeframe) the network will be redesigned and this need will go away, so all outgoing proxy services are to be retired. |
Clients inside the Centre use the openssh ProxyCommand setting to direct the connection via our Proxy:
| Code Block |
|---|
ProxyCommand /usr/bin/connect -H proxy.ecmwf.int:2222 %h %p |
This is a commonly used behaviour in ssh, and in fact new openssh clients and servers support the ProxyJump setting, to simplify configuration even further.
Understanding Teleport
Teleport functions somewhat like a combination of ecAccess, and the SSH Proxy service which staff use to connect outside of ECMWF from within the Centre, with additional features relating to role-based access control and single sign-on.
Clients outside of the Centre use the openssh ProxyCommand or ProxyJump settings to ask their client to connect to the destination server or workstation via the Teleport gatewayconfigure their clients to use Teleport as a proxy service for the destination host or server. That is, it's a bit like the reverse of systems inside ECMWF connecting to the Internet.
Like ecAccess, Teleport can have its own binary installed on the destination server or workstation. This is not required, however, However, this is optional, and standard openssh server works too.
| Info |
|---|
Teleport is open source, hosted on GitHub, written in Go, and the Enterprise edition is licensed (at modest cost) to gain support and allow use of the single sign-on feature. |
The notable difference between Teleport and our current services is that a specific command-line application, called tsh, is required to do the single sign-on function (once per day).