Add "third-party" openssh servers

[crile]

I follow the guide to add an openssh server to teleport but it required to control the remote ssh server.
The configuration of sshd must be modified to add the teleport CA in the Trusted list.

My use case is that I have several openssh servers with my key in .ssh/authorized_keys but I do not have control over the sshd configuration. My idea is to add these servers to teleport and handle all of them for my team.

Can teleport is a good option to handle these SSH connections ?

[webvictim]

If you have control over what goes into ~/.ssh/authorized_keys, you should be able to add the output of tctl auth export --type=user to that file to allow any Teleport user to log in as that one UNIX user.

If you can't control the contents of the remote files at all, there is no way to use Teleport with sshd. Teleport does not support traditional SSH keypairs, only SSH certificates.

[crile]

Thanks for your answer.
The public key provides with tctl auth export --type=user doesn't work.
I try to copy my user public key (/home/user/.tsh/keys/hostname/user.pub) and it works.
./tsh --proxy=mx ssh --port=22 user@host
Did I miss something ?

[benarent]

I recently made a video on this topic, PTAL and let me know if this fills in some of the gaps. https://www.youtube.com/watch?v=x0eYFUEIOrM

[webvictim]

If I put the output of tctl auth export --type=user (starting with cert-authority ssh-rsa...) in my /home/gus/.ssh/authorized_keys file and then connect using Teleport (tsh ssh --port 22 gus@host) it works.

@crile What version of Teleport are you running, and what is the sshd version on the server you're trying to connect to?

I ask because initially, I did get an error initially indicating that my sshd no longer supported the older ssh-rsa algorithm:

gus@artemis:~$ ssh -V
OpenSSH_8.2p1 Ubuntu-4ubuntu0.2, OpenSSL 1.1.1f  31 Mar 2020

Apr  9 13:24:48 artemis sshd[2145470]: userauth_pubkey: certificate signature algorithm ssh-rsa: signature algorithm not supported [preauth]
Apr  9 13:24:48 artemis sshd[2145470]: Connection closed by authenticating user gus 192.168.64.254 port 60892 [preauth]

You can check what CA signature algorithm you're using with a command like this:

$ ssh-keygen -Lf ~/.tsh/keys/<proxy>/<username>-cert.pub | grep using
        Signing CA: RSA SHA256:jshyEv8jcvqd3ySpnqETnupSOTNbkWZL9pD7PrhwVVE (using ssh-rsa)

If it says using ssh-rsa and the sshd version on the server is 8.2+, there are two possible solutions to this problem:

1. Change the Teleport auth server's config file:

teleport:
  ca_signature_algo: "rsa-sha2-512"

After this, restart Teleport and then rotate the certificate authority with tctl auth rotate --grace-period=1m (note that this will cause existing certificates to become invalid after the grace period expires)

Once the rotation is complete, get the new output of tctl auth export --type=user, write this to ~/.ssh/authorized_keys and try again. The server should accept the newer certificate authority.

2. Edit the /etc/ssh/sshd_config file to add this and restart sshd:

CASignatureAlgorithms ^ssh-rsa

[crile]

Thanks, it works