Teleport Server Access

Member form

First, confirm that you have filled out the Member Form with your Github information.

• You have accepted the WATonomous Github Org invite that gets sent to you. You can confirm if you have completed this step by finding yourself in the member list. If you don't see yourself in the member list, visit here to accept your invitation.
• (WATonomous team members only) You have merged the merged request that gets created for you
• (WATonomous team members only) The CI provision_teleport job that gets spawned by the merge action succeeded. You have gone into the job (example) and confirmed that your user-<username> role has been created.

Setup tsh

• Follow the guide for installing and using tsh, Teleport's CLI.
• The tsh login command you need to use is tsh login --proxy watonomous.teleport.sh --auth watonomous_github_connector. This will open up a webpage that will attempt to authenticate for server cluster access using Github. Make sure that you are authenticating with the same github account you provided in the membership form. If your browser has cached a different github login, this will not work.

Setup vscode

• There is an existing Teleport + VSCode guide. Make sure to read the entire guide word for word. Specifically, you will have to manually add a line like

Host delta-ubuntu1.watonomous.teleport.sh thor-ubuntu1.watonomous.teleport.sh tr-ubuntu1.watonomous.teleport.sh wato3-ubuntu1.watonomous.teleport.sh
    User rowan
    ForwardAgent yes

to your ~/.ssh/config file.

• macOS USERS: So far there is one issue we have run into with macOS (if you see Failed to parse remote port from server output in the log when the vscode connection fails look at this issue)

Installing Teleport for Window Users

1. Follow the guide for installing teleport. You will need to search for the Windows section. The commands shown there should be run in powershell. The commands from the Windows section were copied here below as well.

curl https://get.gravitational.com/teleport-v8.0.7-windows-amd64-bin.zip.sha256
curl -O teleport-v8.0.7-windows-amd64-bin.zip https://get.gravitational.com/teleport-v8.0.7-windows-amd64-bin.zip
echo $Env:Path # Edit PATH if necessary
certUtil -hashfile teleport-v8.0.7-windows-amd64-bin.zip SHA256

2. Extract the teleport-v8.0.7-windows-amd64-bin.zip file.
3. Once extraction is complete, move the teleport folder inside of the teleport-v8.0.7-windows-amd64-bin into C:\Program Files
4. Go to the settings and search for Edit the system environment variables
5. Go to Environment Variables then under System Variables, look for the Path Variable
6. Edit the Path variable by adding a new line with C:\Program Files\teleport so that teleport can be added to your path

FAQ

• As detailed in the tsh guide, tsh login has a TTL (time to live) on the certificates you obtain. The TTL is fully configurable. Use tsh status to view the TTL status as well as other things.

Debugging

Getting Permission Denied (publickey)

SSH Agent Not Started

Usually this means that your SSH agent hasn't been started, or that the Teleport SSH key hasn't been loaded into it.

Start your agent with eval "$(ssh-agent)" (Linux) or Start-Service ssh-agent (Windows PowerShell).

Once started, run tsh login <...> again to load your key, and verify that you see a Teleport key in the output of ssh-add -l.

RSA Disabled with OpenSSH

We have also seen this issue when the OpenSSH client that you have doesn't accept RSA keys (such as with OpenSSH 8.8).

If that is the case, follow the steps in the above link, or in this issue.

In short, add these additional lines into your ~/.ssh/config.

Host *.watonomous.teleport.sh watonomous.teleport.sh
    HostkeyAlgorithms [e-mail]
    PubkeyAcceptedAlgorithms [e-mail]