Here is a question for teleport developers:
Why teleport over kerberos + ssh? What can this provide that RHEL7 + a kerberized LDAP like IPA + sssd already provides?
Why teleport over kerberos + ssh? What can this provide that RHEL7 + a kerberized LDAP like IPA + sssd already provides?
But with ever-growing complexity and volume of the infrastructure, the expertise required and time to manage these things are in short supply. Teleport is mainly the opinionated and simplified way to deliver SSH best practices.
Additionally, it has a few neat usability features (like a nice Web UI) and directly addresses the use case of managing the infrastructure that's not yours (MSP use case) where you can have multiple clusters owned by different organizations where you can set up cross-cluster trust via certificate authorities (CA)s [1], well... that's just what's on top of my head.
There's more here: http://gravitational.com/teleport/ or feel free to reach out and chat, we're a friendly bunch! :)
[1] That's our use case, Teleport was originally built to set up and manage Kubernetes clusters on infrastructure located behind firewalls, see our flagship here: http://gravitational.com/telekube/
We're talking about the ssh command here, right ? And associated key generation and config files ? Are there people who are "experts" at that ? Like, the same way there are people who are "experts" at can openers and chip clips ?
"Additionally, it has a few neat usability features (like a nice Web UI) and directly addresses the use case of managing the infrastructure that's not yours (MSP use case) where you can have multiple clusters owned by different organizations where you can set up cross-cluster trust via certificate authorities (CA)s [1], well... that's just what's on top of my head."
You just wrote slide #3 in a future blackhat presentation.
Vault also has SSH backends that you could find useful
Also make sure to deploy the ssh keys somewhere the users can't write for extra security. Don't allow them to control their own authorized_keys files! :-)