494 lines
18 KiB
Text
494 lines
18 KiB
Text
|
# 📊 **Comparatif Bastions SSH – avec compatibilité Windows/Linux**
|
|||
|
|
|
|||
|
|
| Feature | Bastillion | OVH The Bastion | JumpServer | HashiCorp Boundary | **StrongDM*- | **Teleport OSS*- |
|
|||
|
|
|:-------------------------------- |:--------------- |:-------------------- |:--------------- |:----------------------|:------------- |:-----------------|
|
|||
|
|
| **Open Source*- | Oui | Oui | Oui | Oui | (commercial) | Oui |
|
|||
|
|
| **Web UI SSH*- | Oui | Non (CLI only) | Oui | Oui (via plugins) | Oui | Oui |
|
|||
|
|
| **Support LDAP/AD*- | Oui | Oui | Oui | Oui (OIDC/LDAP) | Oui | Enterprise only |
|
|||
|
|
| **MFA/2FA intégré*- | (manuel) | Partiel (SSO externe) | Oui | Oui | Oui | Oui (TOTP) |
|
|||
|
|
| **RDP support (Remote Desktop)*- | Non | Non | Oui | (plugins uniquement) | Oui | Non |
|
|||
|
|
| **Vault de mots de passe*- | Non | Non | Oui | (via Vault) | Oui | Non |
|
|||
|
|
| **Audit SSH (logs texte)*- | Oui | Oui | Oui | Oui | Oui | Oui |
|
|||
|
|
| **Audit SSH (rejeu vidéo)*- | Non | Non | Oui | Non | Oui | Oui |
|
|||
|
|
| **Contrôle d’accès RBAC avancé** | Basique | Oui | Oui | Oui | Oui | Oui |
|
|||
|
|
| **Accès Kubernetes*- | Non | Non | (basique) | Oui | Oui | Oui |
|
|||
|
|
| **Accès base de données*- | Non | Non | (plugins) | Oui | Oui | Oui |
|
|||
|
|
| **Zero Trust Access*- | Non | Oui | Basique | Oui | Oui | Oui |
|
|||
|
|
| **SSO OAuth2/SAML*- | Non | Partiel | Oui (LDAP, SSO) | Oui (OAuth, OIDC) | Oui | Enterprise only |
|
|||
|
|
| **Installation Complexité*- | Facile | Moyenne | Moyenne | Difficile | SaaS only | Moyenne |
|
|||
|
|
| **Licence commerciale*- | Non | Non | Non | Cloud payant possible | Oui | Non |
|
|||
|
|
| **Support entreprise*- | Communautaire | (par OVH) | Communautaire | Oui | Oui | (payant) |
|
|||
|
|
| **Serveur Linux requis*- | Oui | Oui | Oui | Oui | (Cloud) | Oui |
|
|||
|
|
| **Client Windows/Linux compatible*- | Oui (Web browser SSH) | Oui (SSH CLI) | Oui (Web SSH + RDP) | Oui (Web/CLI) | Oui (Web SSH/RDP) | Oui Web/SSH |
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# 🧠 **Notes importantes**
|
|||
|
|
|
|||
|
|
- **Serveur*- : tous (sauf StrongDM) doivent être installés sur un système Linux.
|
|||
|
|
- **Clients utilisateurs*- (personnes qui se connectent) :
|
|||
|
|
- Pour **Bastillion*- : Web browser (Chrome/Firefox) depuis Linux, Windows ou Mac.
|
|||
|
|
- Pour **OVH The Bastion*- : uniquement via terminal SSH (Linux, macOS, Windows avec Putty, mobaxterm ou terminal WSL).
|
|||
|
|
- Pour **JumpServer*- : Web UI moderne, compatible SSH ET RDP (donc parfait pour utilisateurs Windows aussi).
|
|||
|
|
- Pour **HashiCorp Boundary*- : via CLI ou Web (nécessite configuration supplémentaire pour RDP).
|
|||
|
|
- Pour **StrongDM*- : client léger à installer ou Web access.
|
|||
|
|
- Pour **Teleport*- : navigateur Web ou SSH natif (`ssh` CLI).
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# 📢 **Résumé très simple pour toi**
|
|||
|
|
|
|||
|
|
| Besoin principal | Solution recommandée |
|
|||
|
|
|:-----------------|:----------------------|
|
|||
|
|
| Bastion simple, rapide pour SSH LDAP | **Bastillion*- |
|
|||
|
|
| Bastion SSH ultra sécurisé CLI | **OVH The Bastion*- |
|
|||
|
|
| Bastion complet SSH+RDP+SSO gratuit | **JumpServer*- |
|
|||
|
|
| Bastion cloud-native sécurisé Zero Trust (plus complexe) | **HashiCorp Boundary*- |
|
|||
|
|
| Bastion ultra premium SaaS (payant) | **StrongDM*- |
|
|||
|
|
| Bastion SSH+DB+K8s moderne (audit vidéo) | **Teleport OSS*- |
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# 🚀 **Conclusion pour toi**
|
|||
|
|
|
|||
|
|
**➡️ Si tu veux : Web UI, SSH, RDP, LDAP gratuit, clients Windows/Linux, audit sessions ➔ JumpServer est clairement ton meilleur choix.*-
|
|||
|
|
|
|||
|
|
**(Bastillion est OK si tu veux vraiment ultra-simple et que SSH suffit sans RDP.)**
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
Veux-tu maintenant que je te prépare :
|
|||
|
|
- 📜 **Un plan d’installation JumpServer propre*- (Ubuntu 22.04 ou Debian 12) ?
|
|||
|
|
- 📋 **Un guide pour l’intégrer à ton LDAP*- directement ?
|
|||
|
|
- 🛡️ **Une checklist sécurité serveur*- (fail2ban, iptables, durcissement bastion) ?
|
|||
|
|
|
|||
|
|
**Veux-tu qu'on lance ça ?*- 🎯
|
|||
|
|
(Si oui, sur quelle distribution Linux comptes-tu l’installer ?) 🚀
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Excellente question — je vais être **direct**, **précis*- et **pratique*- :
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# 🎯 **Si tu veux en production :**
|
|||
|
|
- **Maximum de fonctionnalités*- (SSH, RDP, Web UI, LDAP/AD, MFA, audit des sessions),
|
|||
|
|
- **Gratuit (vraiment open source)**,
|
|||
|
|
- **Stable et éprouvé**,
|
|||
|
|
|
|||
|
|
**➔ alors la meilleure solution pour toi est clairement :**
|
|||
|
|
|
|||
|
|
# 🏆 **JumpServer**
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# 🛠️ **Pourquoi JumpServer est ton meilleur choix ?**
|
|||
|
|
|
|||
|
|
| Critère | Réponse |
|
|||
|
|
|:--------|:--------|
|
|||
|
|
| **Web UI SSH/RDP moderne*- | Oui (React.js frontend, usage agréable pour Windows et Linux) |
|
|||
|
|
| **LDAP/AD supporté gratuitement*- | Oui |
|
|||
|
|
| **MFA (2FA) intégré*- | Oui (TOTP, SMS possible) |
|
|||
|
|
| **Audit complet*- | Oui (enregistrement vidéo des sessions SSH et RDP) |
|
|||
|
|
| **RBAC avancé*- | Oui (contrôle fin des accès) |
|
|||
|
|
| **Vault de mots de passe*- | Oui |
|
|||
|
|
| **Accès Windows + Linux*- | Oui (Web browser + RDP/SSH) |
|
|||
|
|
| **Documentation correcte*- | Oui (en anglais) |
|
|||
|
|
| **Communauté et mises à jour*- | Actif (gros utilisateurs en Asie, adoption en Europe) |
|
|||
|
|
| **Licence open source*- | GPL v2, **100% gratuit*- |
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# ⚡ **Par rapport aux autres :**
|
|||
|
|
|
|||
|
|
| Comparé à | Pourquoi JumpServer est meilleur |
|
|||
|
|
|:----------|:---------------------------------|
|
|||
|
|
| **Bastillion*- | JumpServer a MFA, RDP, audit vidéo, vaults de mots de passe — Bastillion est trop basique. |
|
|||
|
|
| **OVH The Bastion*- | OVH The Bastion est très CLI et moins "user friendly" pour des utilisateurs Windows classiques. |
|
|||
|
|
| **Teleport OSS*- | Teleport OSS ne supporte pas LDAP/AD sans licence payante (problème pour toi). |
|
|||
|
|
| **HashiCorp Boundary*- | Très technique et manque des features clé comme RDP out-of-the-box. |
|
|||
|
|
| **StrongDM*- | StrongDM est très complet mais 100% **payant*- ($$$).
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# 📦 **Donc en résumé concret :**
|
|||
|
|
|
|||
|
|
> Pour **un vrai bastion de prod entreprise, stable, ultra-fonctionnel et gratuit**,
|
|||
|
|
> **➡️ JumpServer est aujourd'hui la meilleure option.**
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# 🧠 **Attention importante en prod**
|
|||
|
|
|
|||
|
|
Si tu déploies JumpServer en prod, prévois :
|
|||
|
|
|
|||
|
|
- Un serveur solide : **4 vCPU / 8 GB RAM / 80-100 GB SSD*- minimum recommandé.
|
|||
|
|
- Séparation possible entre modules (core / luna / koko / guacamole / mysql / redis).
|
|||
|
|
- Sécurisation HTTPS obligatoire (certificat SSL Let's Encrypt possible).
|
|||
|
|
- Durcissement Linux (fail2ban, iptables/nftables, authent SSH bastion).
|
|||
|
|
- Sauvegardes MySQL/Redis régulières.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# 🚀 **Veux-tu que je te prépare maintenant :**
|
|||
|
|
- **Un plan d’installation*- sur Debian ou Ubuntu ?
|
|||
|
|
- **Un schéma d'architecture simple*- ?
|
|||
|
|
- **Une checklist de sécurisation*- pour le mettre en prod sérieusement ?
|
|||
|
|
|
|||
|
|
**Sur quelle distro Linux veux-tu le faire (Ubuntu 22.04, Debian 12, Rocky Linux) ?*-
|
|||
|
|
**(Dis-moi et je te prépare tout de suite le guide parfait pour démarrer 👨💻🚀)**
|
|||
|
|
|
|||
|
|
Veux-tu aussi que je t'aide à prévoir la structure si tu veux séparer JumpServer sur plusieurs machines plus tard ? (Core, Koko, Guacamole séparés) ?
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
JumpServer semble être la meilleur option, c'est open source assez complet.
|
|||
|
|
Parmis les features intéressants:
|
|||
|
|
- Web UI SSH
|
|||
|
|
- support LDAP natif
|
|||
|
|
- MFA/2FA
|
|||
|
|
- RDP
|
|||
|
|
- vault de mdp
|
|||
|
|
- audit SSH (text + video)
|
|||
|
|
- RBAC
|
|||
|
|
- SSO/LDAP
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
accèdes à une machine (via SSH ou RDP) pas une ressource spécifique (bdd PostgreSQL). Pas de connecteur natif à PostgreSQL, Redis, Elasticsearch, Kubernetes, etc.
|
|||
|
|
|
|||
|
|
alternatives qui gère mieux ces points mais payantes :
|
|||
|
|
Teleport
|
|||
|
|
StrongDM
|
|||
|
|
Boundary (pas de RDP)
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Hashicorp Boundary seems to be the best option. The Community Edition seems enough for most use cases (except maybe multi-organization management), especially with the following features:
|
|||
|
|
- native LDAP support (SSO)
|
|||
|
|
- native Vault
|
|||
|
|
- audit events
|
|||
|
|
- native Zéro Trust
|
|||
|
|
- RBAC
|
|||
|
|
- ressource-level access
|
|||
|
|
- distributed deployment
|
|||
|
|
Entreprise edition adds:
|
|||
|
|
- audit video
|
|||
|
|
- manual approbation UI
|
|||
|
|
- SCIM
|
|||
|
|
- manage multiple organizations
|
|||
|
|
- Prometheus/Grafana integrations
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
JumpServer
|
|||
|
|
- LDAP, SSO supporté
|
|||
|
|
- Audit vidéo (SSH + RDP)
|
|||
|
|
- Audit texte (logs)
|
|||
|
|
- Audit événements
|
|||
|
|
- Self-hosted
|
|||
|
|
- RDP (via Guacamole)
|
|||
|
|
- CLI access
|
|||
|
|
|
|||
|
|
Ca semble être la seule solution open source et auto-hébergeable qui remplit tous nos critères, y compris RDP et audit vidéo.
|
|||
|
|
|
|||
|
|
Prix Entreprise:
|
|||
|
|
Non publique, il faut les contacter. Mais à prioris la version communautaire à l'air entièrement suffisante.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
HashiCorp Boundary (Community Edition)
|
|||
|
|
- SSO (OIDC, LDAP)
|
|||
|
|
- Audit texte (logs)
|
|||
|
|
- Audit événements
|
|||
|
|
- Self-hosted
|
|||
|
|
- CLI access
|
|||
|
|
Manque :
|
|||
|
|
- Audit vidéo réservé à l'Edition Enterprise
|
|||
|
|
- RDP pas nativement supporté mais possible intégration manuelle
|
|||
|
|
|
|||
|
|
Très intéressant côté SSO, Zero Trust, audit, et CLI/API, mais pas de RDP natif ni audit vidéo en version communautaire.
|
|||
|
|
Éventuelllement à envisager en édition Entreprise
|
|||
|
|
|
|||
|
|
Prix Entreprise:
|
|||
|
|
$20–30/user/mois
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
Teleport OSS
|
|||
|
|
- Audit vidéo (SSH uniquement)
|
|||
|
|
- Audit texte (logs)
|
|||
|
|
- Audit événements
|
|||
|
|
- Self-hosted
|
|||
|
|
- CLI access
|
|||
|
|
Manque :
|
|||
|
|
- pas de SSO en COmmunity Edition (SAML/OIDC possible avec la version entreprise)
|
|||
|
|
- pas de RDP
|
|||
|
|
|
|||
|
|
Ne propose pas de SSO complet ni de RDP. Même avec l'édition entreprise il manque le RDP.
|
|||
|
|
|
|||
|
|
Prix Entreprise:
|
|||
|
|
$20–40/user/mois
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
Bastillion
|
|||
|
|
- Audit texte (logs)
|
|||
|
|
- Self-hosted
|
|||
|
|
Manque :
|
|||
|
|
- pas de SSO
|
|||
|
|
- pas d'audit vidéo
|
|||
|
|
- Audit événements trop basique
|
|||
|
|
- pas de RDP
|
|||
|
|
- pas de CLI access, Web-based shell uniquement
|
|||
|
|
|
|||
|
|
Trop limité. Ne répond pas à la plupart des attentes.
|
|||
|
|
|
|||
|
|
Prix Entreprise:
|
|||
|
|
pas de version payante
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
OVH The Bastion
|
|||
|
|
- Audit texte (logs)
|
|||
|
|
- Audit événements
|
|||
|
|
- Self-hosted
|
|||
|
|
- CLI access
|
|||
|
|
Manque :
|
|||
|
|
- pas de RDP
|
|||
|
|
- pas d'audit vidéo
|
|||
|
|
- SSO (LDAP, mais pas SAML/OIDC)
|
|||
|
|
|
|||
|
|
Ne répond pas à la plupart des attentes.
|
|||
|
|
|
|||
|
|
Prix Entreprise:
|
|||
|
|
pas de version payante
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# 🏆 **Synthèse finale – Ta meilleure option**
|
|||
|
|
|
|||
|
|
| Solution | Verdict final | Raisons |
|
|||
|
|
| -------------- | -------------------------- | ---------------------------------------------- |
|
|||
|
|
| **JumpServer*- | ✅ **RECOMMANDÉ*- | Coche **toutes les cases*- de ton besoin. |
|
|||
|
|
| Boundary | ❌ Non (pas RDP, pas vidéo) | Très technique, manque 2 fonctionnalités clés. |
|
|||
|
|
| Teleport OSS | ❌ Non (pas RDP, pas SSO) | Fort mais version libre trop limitée. |
|
|||
|
|
| StrongDM | ❌ Non (pas self-hosted) | Parfait mais uniquement en SaaS. |
|
|||
|
|
| OVH Bastion | ❌ Non (pas RDP, pas vidéo) | Ultra sécurisé, mais très restreint. |
|
|||
|
|
| Bastillion | ❌ Non (trop basique) | Inadapté à un besoin pro avancé. |
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
Souhaites-tu maintenant :
|
|||
|
|
|
|||
|
|
- 🧱 Un **guide complet d’installation*- de JumpServer ?
|
|||
|
|
- 🔒 Une **checklist de durcissement sécurité*- pour la prod ?
|
|||
|
|
- 🖼️ Un **diagramme d’architecture clair*- (modules, ports, dépendances) ?
|
|||
|
|
|
|||
|
|
Donne-moi la distro prévue (Ubuntu 22.04 / Debian 12 / Rocky Linux ?) et je te prépare ça maintenant.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Hi !
|
|||
|
|
|
|||
|
|
I'm currently evaluating JumpServer for my company.
|
|||
|
|
We need JumpServer to integrate with our existing enterprise identity system. Therefore, the Enterprise features would be required.
|
|||
|
|
So I'm asking you for a quote, or more details about your billing model.
|
|||
|
|
|
|||
|
|
I already evaluated the JumpServer Open-Source version, and it satisfy our infrastructure needs (installation would be on premise). So my main interest is to get a cost estimate to integrate JumpServer Enterprise, i.e. are you billing per user, per machine ?
|
|||
|
|
|
|||
|
|
Best regards,
|
|||
|
|
Nikola Milovanovic
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Subject: Request for Quote – JumpServer Enterprise
|
|||
|
|
|
|||
|
|
Hi,
|
|||
|
|
|
|||
|
|
I'm currently evaluating JumpServer for use within our company. We need JumpServer to integrate with our existing enterprise identity system. Therefore, the Enterprise features would be required.
|
|||
|
|
|
|||
|
|
I have already tested the Open Source version, which mostly meets our infrastructure requirements. We plan to deploy it on-premise, so at this stage, I'm primarily looking to understand the cost of the Enterprise edition.
|
|||
|
|
|
|||
|
|
Could you please provide a quote or more information about your billing model? Specifically, is pricing based on the number of users or managed machines ?
|
|||
|
|
|
|||
|
|
Best regards,
|
|||
|
|
Nikola Milovanovic
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
HTTP and websocket can go trough the same port apparently -----------------------TALAS-----------------------------
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Installation test de Teleport Community Edition
|
|||
|
|
test-infra utilisé :
|
|||
|
|
+------------------+---------+-----------------------+----------------------------------------------+-----------+-----------+
|
|||
|
|
| tlp-client | RUNNING | 10.184.116.14 (eth0) | fd42:4cb:ac26:e6e1:216:3eff:fedf:1088 (eth0) | CONTAINER | 0 |
|
|||
|
|
+------------------+---------+-----------------------+----------------------------------------------+-----------+-----------+
|
|||
|
|
| tlp-core | RUNNING | 10.184.116.67 (eth0) | fd42:4cb:ac26:e6e1:216:3eff:fe37:6c1e (eth0) | CONTAINER | 0 |
|
|||
|
|
+------------------+---------+-----------------------+----------------------------------------------+-----------+-----------+
|
|||
|
|
| tlp-target | RUNNING | 10.184.116.42 (eth0) | fd42:4cb:ac26:e6e1:216:3eff:fe0b:8184 (eth0) | CONTAINER | 0 |
|
|||
|
|
+------------------+---------+-----------------------+----------------------------------------------+-----------+-----------+
|
|||
|
|
|
|||
|
|
On every nodes (here all containers) we need to install Teleport :
|
|||
|
|
apt update && apt install -y curl
|
|||
|
|
curl https://cdn.teleport.dev/install.sh | bash -s "17.4.8" "oss"
|
|||
|
|
|
|||
|
|
As Teleport doesn't create his own configuration file, we need to do it. So on the bastion server (here tlp-core), we need to create /etc/teleport/teleport.yaml with this content:
|
|||
|
|
```
|
|||
|
|
version: v3
|
|||
|
|
|
|||
|
|
teleport:
|
|||
|
|
nodename: tlp-core
|
|||
|
|
data_dir: /var/lib/teleport
|
|||
|
|
log:
|
|||
|
|
output: stderr
|
|||
|
|
severity: INFO
|
|||
|
|
|
|||
|
|
auth_service:
|
|||
|
|
enabled: yes
|
|||
|
|
cluster_name: test-cluster
|
|||
|
|
|
|||
|
|
proxy_service:
|
|||
|
|
enabled: yes
|
|||
|
|
web_listen_addr: 0.0.0.0:3080
|
|||
|
|
public_addr: 10.184.116.67:3080
|
|||
|
|
listen_addr: 0.0.0.0:3023
|
|||
|
|
ssh_public_addr: 10.184.116.67:3023
|
|||
|
|
tunnel_listen_addr: 0.0.0.0:3024
|
|||
|
|
tunnel_public_addr: 10.184.116.67:3024
|
|||
|
|
|
|||
|
|
ssh_service:
|
|||
|
|
enabled: no
|
|||
|
|
```
|
|||
|
|
Then you can run Teleport on the host using this configuration file:
|
|||
|
|
```
|
|||
|
|
teleport start --config=/etc/teleport/teleport.yaml
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Still on the tlp-core host, we need to generate a token so other node can join the cluster (here named `test-cluster` as specified in the configuration file) :
|
|||
|
|
```
|
|||
|
|
tctl nodes add --roles=node --ttl=1h
|
|||
|
|
```
|
|||
|
|
you will see something as :
|
|||
|
|
```
|
|||
|
|
The invite token: 4d0ec5ddf9f5f91311f6b877e2d7f8df
|
|||
|
|
This token will expire in 60 minutes.
|
|||
|
|
|
|||
|
|
Run this on the new node to join the cluster:
|
|||
|
|
|
|||
|
|
> teleport start \
|
|||
|
|
--roles=node \
|
|||
|
|
--token=4d0ec5ddf9f5f91311f6b877e2d7f8df \
|
|||
|
|
--ca-pin=sha256:52a566530987abb03ce327925807adfd32d7c65249d7fcf52d271b926277e9c7 \
|
|||
|
|
--auth-server=10.184.116.67:3025
|
|||
|
|
|
|||
|
|
Please note:
|
|||
|
|
|
|||
|
|
- This invitation token will expire in 60 minutes
|
|||
|
|
- 10.184.116.67:3025 must be reachable from the new node
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Keep that token we'll need it right after to configure targets.
|
|||
|
|
|
|||
|
|
On the target host (here tlp-target) we need to create /etc/teleport/teleport.yaml with this content:
|
|||
|
|
```
|
|||
|
|
version: v3
|
|||
|
|
|
|||
|
|
teleport:
|
|||
|
|
nodename: tlp-target
|
|||
|
|
data_dir: /var/lib/teleport
|
|||
|
|
log:
|
|||
|
|
output: stderr
|
|||
|
|
severity: INFO
|
|||
|
|
|
|||
|
|
auth_server: 10.184.116.67:3025
|
|||
|
|
|
|||
|
|
join_params:
|
|||
|
|
method: token
|
|||
|
|
token_name: 4d0ec5ddf9f5f91311f6b877e2d7f8df #use the token we just generate on tlp-core
|
|||
|
|
|
|||
|
|
ssh_service:
|
|||
|
|
enabled: yes
|
|||
|
|
|
|||
|
|
auth_service:
|
|||
|
|
enabled: no
|
|||
|
|
|
|||
|
|
proxy_service:
|
|||
|
|
enabled: no
|
|||
|
|
```
|
|||
|
|
Then you can start Teleport on the target :
|
|||
|
|
```
|
|||
|
|
teleport start --config=/etc/teleport/teleport.yaml
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Go back on the tlp-core host and create a new temporary signup link:
|
|||
|
|
```
|
|||
|
|
tctl users add nmilovanovic --roles=access
|
|||
|
|
```
|
|||
|
|
you will see something like:
|
|||
|
|
```
|
|||
|
|
User "nmilovanovic" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
|
|||
|
|
https://10.184.116.67:3080/web/invite/ad1981bbee6f3fc6ecfce59814aac088
|
|||
|
|
|
|||
|
|
NOTE: Make sure 10.184.116.67:3080 points at a Teleport proxy which users can access.
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
When you user password is set, you can connect from the tlp-client host:
|
|||
|
|
```
|
|||
|
|
tsh login --proxy=10.184.116.67:3080 --user=nmilovanovic --insecure
|
|||
|
|
```
|
|||
|
|
you will see something like:
|
|||
|
|
```
|
|||
|
|
Enter password for Teleport user nmilovanovic:
|
|||
|
|
WARNING: You are using insecure connection to Teleport proxy https://10.184.116.67:3080
|
|||
|
|
Enter an OTP code from a device:
|
|||
|
|
> Profile URL: https://10.184.116.67:3080
|
|||
|
|
Logged in as: nmilovanovic
|
|||
|
|
Cluster: test-cluster
|
|||
|
|
Roles: access
|
|||
|
|
Logins: nmilovanovic, root
|
|||
|
|
Kubernetes: enabled
|
|||
|
|
Valid until: 2025-05-23 04:05:45 +0000 UTC [valid for 12h0m0s]
|
|||
|
|
Extensions: login-ip, permit-agent-forwarding, permit-port-forwarding, permit-pty, private-key-policy
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
you can then list available targets using :
|
|||
|
|
```
|
|||
|
|
tsh ls
|
|||
|
|
```
|
|||
|
|
wich will retun something like:
|
|||
|
|
```
|
|||
|
|
Node Name Address Labels
|
|||
|
|
------------ ------------------- ------
|
|||
|
|
tlp-target 10.184.116.42:3022
|
|||
|
|
```
|
|||
|
|
You can then connect to one of the host using :
|
|||
|
|
```
|
|||
|
|
tsh ssh nmilovanovic@tlp-target
|
|||
|
|
```
|