securecrt and teleport.

[johandeclercqdemocon]

Hi,
how can I use teleport with securecrt on ubuntu ?
The thing is I need to connect to a cluster and then from there do ssh to a host.
Is there somebody who managed to do that already ?
I tried with tunneling but I don't get authenticated. Issue is that connectoin to the proxy and then to the cluster is from terminal => not global to the system. So how can I then open an ssh connection to the intended host via secure crt ?

[webvictim]

I don't believe SecureCRT supports SSH host certificates which would be required for it to work with Teleport.

We do have support for PuTTY (which does support all the necessary certificate types) coming soon.

[johandeclercqdemocon]

Can you elaborate a bit more on SSH host certificates ? Then I will open a feature request at Van Dyke. Op ma 24 apr 2023 om 17:18 schreef Gus Luxton ***@***.***>:

…

I don't believe SecureCRT supports SSH host certificates which would be required for it to work with Teleport. We do have support for PuTTY (which does support all the necessary certificate types) coming soon. — Reply to this email directly, view it on GitHub <#24965 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKDSPWMJ7M3LVVUHAQNY6ODXC2KTNANCNFSM6AAAAAAXGWKTE4> . You are receiving this because you authored the thread.Message ID: ***@***.*** com>

[johandeclercqdemocon]

Is it this that you mean ? SSH certificate support - VanDyke Software Forums <https://forums.vandyke.com/showthread.php?t=13980> Op ma 24 apr 2023 om 17:18 schreef Gus Luxton ***@***.***>:

…

I don't believe SecureCRT supports SSH host certificates which would be required for it to work with Teleport. We do have support for PuTTY (which does support all the necessary certificate types) coming soon. — Reply to this email directly, view it on GitHub <#24965 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKDSPWMJ7M3LVVUHAQNY6ODXC2KTNANCNFSM6AAAAAAXGWKTE4> . You are receiving this because you authored the thread.Message ID: ***@***.*** com>

[webvictim]

Yes, that's the one.

[johandeclercqdemocon]

Is this the functionality on putty that you are refering to. https://www.chiark.greenend.org.uk/~sgtatham/quasiblog/putty-certificates/ When this is implemented in putty, then I can put speed up things at van dyke.

…

On 24/04/2023 17:18, Gus Luxton wrote: I don't believe SecureCRT supports SSH host certificates which would be required for it to work with Teleport. We do have support for PuTTY (which does support all the necessary certificate types) coming soon. — Reply to this email directly, view it on GitHub <#24965 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKDSPWMJ7M3LVVUHAQNY6ODXC2KTNANCNFSM6AAAAAAXGWKTE4>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[webvictim]

Yes. This is already implemented in PuTTY 0.78 and works today with Teleport.

[Atroskelis]

Hello, sorry for bumping this but did you ever get it to work? I can complete the proxy(firewall action) but not the certificate part.

[webvictim]

Pretty sure there's been no movement on this. You'd have to check in directly with the authors (Van Dyke software)

[Atroskelis]

Hello, sorry for bumping this but did you ever get it to work? I can complete the proxy(firewall action) but not the certificate part.

@johandeclercqdemocon I've contacted Van Dyke Software about this and they gave me a pre-release of SecureCRT version 9.6.0 where Teleport works, previous versions do not work as SSH CA certs are not accepted.

Support said that it usually takes a maximum 3-4 months for them to release the official 9.6.0. You can enable mail notifications to get notified.

[johandeclercqdemocon]

My customer dropped teleport. Anyway let me know how it goes.

…

On Fri, 31 May 2024, 10:38 Atroskelis, ***@***.***> wrote: Hello, sorry for bumping this but did you ever get it to work? I can complete the proxy(firewall action) but not the certificate part. @johandeclercqdemocon <https://github.com/johandeclercqdemocon> I've contacted Van Dyke Software about this and they gave me a pre-release of SecureCRT version 9.6.0 where Teleport works, previous versions do not work as SSH CA certs are not accepted. Support said that it usually takes a maximum 3-4 months for them to release the official 9.6.0. You can enable mail notifications to get notified. — Reply to this email directly, view it on GitHub <#24965 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKDSPWMJW3X2WCLSBG6W5ZTZFAZIDAVCNFSM6AAAAAAXGWKTE6VHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TMMJVG4YTS> . You are receiving this because you were mentioned.Message ID: ***@***.*** com>

[whatthejay]

@Atroskelis Could you please share more detail on how you made it work? I got the pre-release 9.6.0.0 from Vandyke support for evaluation, but it is not working for me.

Here's how I did the steps:

1. Configure firewall with "Proxy command" type in SCRT to execute tsh.exe login --proxy={my_proxy} --auth={my_auth} --login={my_login_name} {hostname}

2. Configure Credentials to use the identity file automatically generated by Teleport

However connection fails with message below:

[LOCAL] : Stream has closed [CLOSE_TYPE_NONSPECIFIC] : The client has disconnected from the server. Reason: Unable to authenticate using any of the configured authentication methods.

[whatthejay]

By the way, there are a few pub/priv keys under the directory:
C:\Users{username}.tsh\keys{teleport-proxy-hostname}\

Which key is valid for SecureCRT? I tried all of them but nothing worked.

[Atroskelis]

Hello! I did try a lot of methods. Securecrt does not digest easily most stuff in the .tsh folder.

You can try using a tool to extract the private key from the ppk in a format securecrt likes
Also try viewing trace logs when you connect. Basically you need the ppk for private and the generic pub in the proxy folder

Ultimately the machine which I tested with is in service, and ill only have aceess to it next week

In the end and even now ( with royal ts) im unable to make connections work without tsh puttyconfig on all jumps. Never knew why

[webvictim]

@whatthejay Your proxy command should be:

tsh.exe --proxy={my_proxy} --auth={my_auth} --login={my_login_name} proxy ssh {hostname}

You will likely need to configure other settings in order to make SecureCRT trust Teleport-issued host certificates, however.

I don't have access to SecureCRT at all (let alone the pre-release build with support for certificates) so I can't currently be much help.

@Atroskelis tsh puttyconfig does a number of things when run, but the most important here is probably that it adds the public key of Teleport's host CA (used to sign the certificates issued to hosts running Teleport) to PuTTY's registry key, and also updates the list of hostnames that the public key should be trusted for connecting to. This is needed because PuTTY uses an "allowlist" of authorised hostnames and won't permit connections to any host not added to this list.