Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[v9] Backport #12110 #12158

Merged
merged 4 commits into from
Apr 22, 2022
Merged

[v9] Backport #12110 #12158

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1996c8e
docs: Add example for label usage with `tsh ssh` (#12110)
webvictim Apr 21, 2022
9982cd8
Merge branch 'branch/v9' into v9-backport-12110
webvictim Apr 22, 2022
984ad25
Merge branch 'branch/v9' into v9-backport-12110
webvictim Apr 22, 2022
d31cc48
Merge branch 'branch/v9' into v9-backport-12110
r0mant Apr 22, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions docs/pages/setup/reference/cli.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,7 @@ $ tsh ssh [<flags>] <[user@]host> [<command>...]
`<[user@]host> [<command>...]`

- `user` The login identity to use on the remote host. If `[user]` is not specified the user defaults to `$USER` or can be set with `--user`. If the flag `--user` and positional argument `[user]` are specified the arg `[user]` takes precedence.
- `host` A `nodename` of a cluster node or a
- `host` The `nodename` of a cluster Node or a label specification like `env=aws` to run on all matching hosts.
- `command` The command to execute on a remote host.

#### Flags
Expand Down Expand Up @@ -219,6 +219,8 @@ $ tsh ssh --proxy proxy.example.com --user teleport -d root@grav-00
# `tsh ssh` takes the same arguments as OpenSSH client:
$ tsh ssh -o ForwardAgent=yes root@grav-00
$ tsh ssh -o AddKeysToAgent=yes root@grav-00
# Run `hostname` on all nodes with the `env: aws` label
$ tsh ssh root@env=aws hostname
```

### tsh config
Expand Down Expand Up @@ -684,7 +686,7 @@ can be exported with `tctl auth sign` or `tsh login --out=<output-path>`.

Note that when a `tctl` command is run locally on an Auth Service, the audit
logs will show that it was performed by the Auth Service itself.

To properly audit admin actions at scale, it is important to limit direct SSH
access to the Auth Service with
[Access Controls](../../access-controls/introduction.mdx) and ensure that
Expand Down