Teleport is software which provides an SSH Jump Host (or Bastion host) service in a secure, modern way, with support for role-based access control and single sign-on.
It is a replacement for the ecAccess SSH service, and is operated by the CD Apps team and User Services.
This service is under development. Please continue to use the existing ecAccess service! |
Visit the Teams channel for this service to discuss and provide feedback! |
The Teleport service provides:
The single sign-on step is performed using an application called "tsh
", every 12 hours.
After that you use standard ssh or scp to connect to systems inside ECMWF.
tsh
tsh
application is required to perform user authentication once every 12 hours.
tsh
is open source, very portable, and has minimal dependencies.
$PATH
The binary is available for Linux 32-bit, 64-bit, and ARM, as well as Windows 64-bit and a signed package for MacOS.
MacOS users can also use homebrew for installation (brew install teleport
).
Once every 12 hours, you will need to refresh your tokens by logging in to the ECMWF website.
SSH connections can remain active for longer than 12 hours, but new ones will require re-authentication. |
Run tsh
, giving the location of our gateway:
tsh login --proxy=shell.ecmwf.int:443 |
Your default web browser will open and you should login with your email address, workstation password, and then HID Token code.
If you're already logged in to the ECMWF website, or have recently logged in to this service, the password prompt might be skipped. |
tsh login |
Windows users should skip to our Guide for Windows SSH to ECMWF. |
OpenSSH 7.3 or later has a simple command line option to connect via our gateway (shell.ecmwf.int
) to the destination-host
:
ssh -J username@shell.ecmwf.int username@destination-host |
For example, if your username is ab0
and you wish to connect to ecgate
:
ssh -J ab0@shell.ecmwf.int ab0@ecgate |
The OpenSSH configuration setting for this is named ProxyJump
:
Host ecgate User ab0 ProxyJump ab0@shell.ecmwf.int |
See the Legacy Configuration note below if your ssh client is older than 7.3.
If your connection fails after working for some time, it could be because your tokens have expired. You can check them:
$ tsh status > Profile URL: https://shell.ecmwf.int:443 Logged in as: firstname.lastname@ecmwf.int Cluster: shell.ecmwf.int Roles: * Logins: ab0 Valid until: 2020-06-22 23:26:30 +0100 BST [EXPIRED] Extensions: permit-agent-forwarding, permit-port-forwarding, permit-pty |
The hosts directly available through the Teleport gateway are:
To access any other host, the ProxyJump
feature allows chaining by using a comma, like so:
ssh -J ab0@shell.ecmwf.int,ab0@workstation ab0@lxc |
With the initial configuration you may be prompted for a password at the destination-host
.
For login without a password, add the Teleport certificate authority to your ~/.ssh/authorized_keys
file:
curl -fs https://nexus.ecmwf.int/repository/internal-teleport-configs/prod/teleport_user_ca.pub >> ~/.ssh/authorized_keys |
This configuration will allow access to any host which mounts the same |
There are various ways to initiate SSH from Windows 10, so it depends on your system and your preferences.
We recommend using the Windows Subsystem for Linux if you can (on your own machine), followed by starting the SSH Agent and then connecting as for Linux/MacOS systems. |
Alternatively, you can use:
|
|
If you have logged in but ssh fails to connect, it may be that your SSH agent is not running.
The Agent can be started and tokens refreshed this way:
eval $(ssh-agent -s) tsh logout tsh login |
And this will make sure the Agent continues to run in your environment:
echo 'eval $(ssh-agent -s)' >> ~/.bash_profile |
SCP, Agent forwarding, X11 forwarding, and Port forwarding (including SOCKS proxy), all work through the Teleport gateway.
For OpenSSH clients older than 7.3, the following configuration can be used:
# ~/.ssh/config file: Host ecgate User ab0 ProxyCommand /usr/bin/ssh -q -W %h:%p ab0@shell.ecmwf.int |
You might not be able to download and run tsh
, or access our web login service, or run the SSH Agent, from where you wish to use ssh.
Instead you can use (or copy) the identity files which tsh
stores in $HOME
:
# ~/.ssh/config file: Host ecgate User ab0 IdentityFile ~/.tsh/keys/shell.ecmwf.int/firstname.lastname@ecmwf.int ProxyCommand /usr/bin/ssh -q -i ~/.tsh/keys/shell.ecmwf.int/firstname.lastname@ecmwf.int -W %h:%p ab0@shell.ecmwf.int |
This is a good way to access Teleport credentials via a shared file system from any host.