Teleport: Windows tsh binary

[jaxxstorm]

Is there any plan to make a tsh binary, or at least have some way of using the client on windows?

[EDIT by @ekontsevoy] the discussion below suggests to implement only agent mode for Windows. Read the comments.

[EDIT by @webvictim] Anyone interested can download our WIndows tsh binary (which allows you to run tsh login to get a certificate) from our download portal: https://gravitational.com/teleport/download

[kontsevoy]

Status update: looks like Teleport (including tsh) has UNIX-only internal dependencies on 3rd party code, particularly around terminal control. Moving tsh to a native Windows binary is more involved, so the Web UI for now is the only client for Windows. Will keep the ticket open as we continue looking into it.

[jaxxstorm]

@kontsevoy I'd be happy enough with a cygwin based binary. Also, is it worth trying to build or use the binary on the new windows subsystem?

[kontsevoy]

We can put an engineer on it if needed.

[anjanb]

I'm more interested in the server. Many web application developers are getting used to using ssh given the cloud(and it's predominant os linux). If an enterprise developer wants to use ssh to login to their windows server, today, not many good(free/oss) options are available.

[kontsevoy]

@anjanb I don't think server will be easy though... Teleport uses a lot of UNIX-land constructs to create a remote session. It doesn't mean we won't look into it, but my gut tells me it won't happen soon.

[painhardcore]

i've interested.Windows 10 have some kind of unix shell.

[kontsevoy]

@painhardcore we're looking into it. Right now the issue is that some 3rd party libraries teleport is using. They don't compile on windows.

[itsnotvalid]

I think the most important part is to export an ssh-agent for windows, much like plink (of PuTTY) does for ssh.

[crdnl]

Setting it up as an ssh-agent will allow a large amount of programs to make use of tsh (and, by extension, teleport enabled servers) including Filezilla and DataGrip.

[ghost]

Getting a teleport ssh agent for windows would remove the final hurdle from adopting it for my infrastructure. The sad reality is that we do have windows users.

[wcc526]

https://github.com/jumpserver/jumpserver
https://github.com/jumpserver/jumpserver/blob/master/init.sh

I think can run teleport on linux server,PC can connect to the linux server by ssh,it will run teleport when login.

[tatsushid]

I very roughly wrote tsh Windows support code at
https://github.com/tatsushid/teleport/tree/feature/tsh-windows-support

I built a binary with

GOOS=windows GOARCH=amd64 go build -o tsh.exe -i -ldflags -w -ldflags '-w -s' ./tool/tss

and check its ssh command worked on my test env (Windows 2012R2) command prompt and PowerShell. I didn't test other commands and it shouldn't work on msys or Cygwin console.

I'm new to Teleport and not familiar with Windows so much but as I know and learned by writing the code, following should be done to support Windows

• Add logrus Eventlog logger plugin to use it instead of Syslog on Unix like system. I couldn't find it so wrote a simple thing but if anyone knows well tested one, using it is better.
• It is better to add something console abstraction layer to support both Unix like systems and Windows. My Windows support code looks not much clear and to support more parts (suspend/resume thread, msys/Cygwin console etc.), separating OS specific code would help.
• To support agent command, I guess using Windows named pipe instead of Unix domain socket and implementing Putty's Pageant (which is well supported by SSH clients on Windows) is needed.

My code is just a concept and again I'm not familiar with Windows so I hope someone Windows guru helps making the code better, correcting wrongs, giving idea etc.

[kontsevoy]

@tatsushid wow, very impressive. The HEAD in the master branch in your repo is what we should be looking at?

Also, why the need to specify GOOS=windows GOARCH=amd64? Aren't they set by default when compiling on Windows?

[tatsushid]

@kontsevoy It's in a feature/tsh-windows-support branch and the environment variables are needed if you build it on Linux/Mac, any other not Windows machine. Of course, as you mentioned, if you run it on Windows, these aren't needed.

[tatsushid]

To study what should be implemented to port tsh to Windows, I wrote a SSH client from scratch.
https://github.com/tatsushid/minssh
I learned many things from it.

• Windows 10 AU or later, Windows has its own ANSI escape sequence helper as console mode flags

  • https://msdn.microsoft.com/en-us/library/windows/desktop/mt638032(v=vs.85).aspx
  • https://msdn.microsoft.com/en-us/library/windows/desktop/ms686033(v=vs.85).aspx

  It makes writing console application like tsh much easier.



• In older Windows, the flags aren't so need to be implemented in each programs. For ANSI output emulation
  
  https://github.com/Azure/go-ansiterm/
  
  is a good implementation and for ANSI input emulation, it is not so difficult to write the functionality which is described in the MS doc above.


• In Cygwin/MSYS2 environment, usual Go program with Windows console doesn't work well but it is easily resolved by just wrapping a program by winpty. I think just mentioning to use it in such environment is enough.


• For console resizing, there is a way to get resizing event as an input but as far as I tested, it was not so much robust, reliable way. I think it is better polling console size periodically like for HTML console.


• For logging, finally I found Eventlog is not so good choice for a client program. It requires Administrator right to register logging info. Instead of it, it may be better adding logging file option like OpenSSH's -E flag and without it, ignoring log output in Windows


• To write a popular PuTTY's Pageant (ssh-agent in Windows) support, it needs more research. It is implemented with an application hidden window to communicate with a client, not just a socket or named pipe.

I hope these help someone to implement tsh Windows support and if I have time, I'd like to do it on my Teleport fork.

[apestel]

I've just tried tsh under WSL and it works flawlessly (https://msdn.microsoft.com/fr-fr/commandline/wsl/about).
Obviously it works only on Windows 10 but it provides (finally) a decent terminal.

[benarent]

👋 Hello Issue Watchers.

I'm going to resolve this issue for now. We provide a tsh client for Windows , that works well with the WSL. https://gravitational.com/teleport/download/

We are going to keep on improving the Windows experience, targeting these issues next.

• Sign tsh.exe https://github.com/gravitational/teleport/issues/3012
• Create 32bit binary https://github.com/gravitational/teleport/issues/2517

Other open Windows issues.
https://github.com/gravitational/teleport/issues?q=is%3Aissue+is%3Aopen+windows+label%3Awindows

[webvictim]

There's also a guide on how to use tsh under Windows with examples of ProxyCommand etc here: https://community.gravitational.com/t/how-to-connect-to-teleport-hosts-using-windows/559

[SvenMW]

I'm going to resolve this issue for now. We provide a tsh client for Windows , that works well with the WSL. https://gravitational.com/teleport/download/

hey, thanks for all the hard work, but this is really sad and a dealbraker for many corporate environments.

we have lots of ssh users on windows currently running putty.

It's really not an option to provide them all with the windows subsystem for linux.

I kindly ask to reconsider providing at least a native ssh client for windows (the webgui really isn't an option for powerusers too).

Thanks in advance

:edit: maybe to clarify my concerns:

WSL version 1 does not provide any security isolation at all, as explained here and is a gaping security hole, waiting for exploits:
https://research.checkpoint.com/2017/beware-bashware-new-method-malware-bypass-security-solutions/

[webvictim]

Hey @SvenMW - WSL isn't a mandatory thing at all, it's just a more Linux-like environment that some developers who are used to Linux might prefer.

Our tsh.exe Windows client works fine without any extra dependencies, it just doesn't have terminal support on Windows. On top of this, PuTTY does not support SSH certificates. To get around this, I would recommend installing OpenSSH for Windows and using this as a terminal client as per my guide above (https://community.gravitational.com/t/how-to-connect-to-teleport-hosts-using-windows/559)

I found that the whole experience works pretty well - running tsh.exe login writes your short-lived Teleport certificate to a local directory (C:\Users\Username\.tsh\keys\<proxyname>) as well as adding it to your ssh-agent which runs as a Windows service. You can configure your Windows SSH config file (C:\Users\Username\.ssh\config) to set up the use of Teleport as a bastion host so your experience can be as simple as typing ssh.exe user@host.

It's obviously slightly less smooth than tsh ssh user@host, but we did try writing Windows terminal support before and the differences between how things are implemented on *nix and Windows is just too large for us to consider supporting currently.

I hope you'll look at the guide and reconsider. Thanks.

[SvenMW]

Hi @webvictim ! Thanks for the detailed explanation! I will take a look at your guide!

I just read the official documentation which states:

https://gravitational.com/teleport/docs/architecture/teleport_architecture_overview/#teleport-services

Users can log in to a Teleport Node with all of the following clients:

OpenSSH: ssh
Teleport CLI client: tsh ssh
Teleport Proxy UI accessed via a web browser.

So it was not immediately clear how this was supposed to work on windows.

I also just can't find documentation in the adminguide regarding windows based clients.

I feel there is still much to do in terms of documentation for beginners or for deployments in non-developer centric workflows (see also my submitted issue about a broken link in the quickstart guide).

But I will check your guide, thanks!

[ollyg]

We have started testing with MobaXterm on Windows 10 as it includes a shell where tsh.exe can be run, can access the installed session keys, and then can make ssh sessions itself. Seems to work OK.

I will say the whole SSH Agent side of things on Win10 is confusing, with one in WSL, MobaXterm having another, and PuTTY having another, all with seemingly different socket interfaces, perhaps none of which tsh.exe will actually speak to. Still testing...

[howardkhl]

@ollyg can you clarify (or document) on how you get tsh.exe to work on MoboXterm? i ran the command tsh --proxy=teleport3.<hostname>.com login but the key is not saved to ssh-agent. tsh status says not logged in, and ssh-add -l does not show the entry.

[ollyg]

Hi @howardkhl, actually we never got any ssh agent working. What I meant was that we used the keys that are saved to ~/.tsh in the MobaXterm ssh client config, and that worked OK.

Separately we have opened a ticket so that ~/.tsh is relocatable which makes Windows management a bit easier: #3375