Certificate problems

[jdmedeiros]

I have been trying to get Teleport to work on this POC project, but it's just not happening. My latest attempt was to not use Let's Encrypt or any other CA. After the server started, I ran tctl tokens add --type=node, went to the node and did systemctl stop teleport followed by rm -fr /var/lib/teleport and created the following config file on the node:

[root@node1 ~]# cat /etc/teleport.yaml 
teleport:
  auth_token: "e9790e3dbfddda82f13ef0e0050b1048"
  auth_servers:
    - "172.31.89.116:3025"

When I run teleport start -d on the node I get:

ERRO [PROC:1]    Node failed to establish connection to cluster: Get "https://172.31.89.116:3025/v1/webapi/find": x509: cannot validate certificate for 172.31.89.116 because it doesn't contain any IP SANs. service/connect.go:63
ERRO [PROC:1]    Proxy failed to establish connection to cluster: Get "https://teleport.cluster.local/v2/domain": x509: certificate signed by unknown authority. service/connect.go:63

This was already a desperate attempt. Before, I created Let's Encrypt certificates for proxy.domain.com and *.proxy.domain.com and installed them in the server. Could never get the node to connect due to similar messages.

I am using 6.0.1 community image and would appreciate some help. Looks like a great product, but I need to demonstrate that.

[klizhentas]

@jdmedeiros feel free to join https://goteleport.com/slack to chat to us, but in general, I think if you add public_addr in the auth server section with the IP or the public addr of the auth server.

Auth server has to add SAN in the X.509 server, so nodes can verify it. This error is more about auth server's HTTPS x.509 internal cert rather than proxy's web server cert.

[jdmedeiros]

Found a solution. Sharing as it may be helpful to someone. When adding a new node, if I initially run:

teleport start \
   --roles=node \
   --token=fbae678ea06ad6592d7b73926a8cf3d7 \
   --ca-pin=sha256:88ca829d05a054ca60be1819dd94a4023ee6d110fa7679d135a29d1b2ccef05a \
   --auth-server=172.31.89.116:3025

and then Ctrl-c to stop it. I then create the file /etc/teleport.yaml with:

teleport:
  auth_token: "9786afaae84ff2ce17690d4fc6ecd158"
  ca_pin: "sha256:88ca829d05a054ca60be1819dd94a4023ee6d110fa7679d135a29d1b2ccef05a"
  auth_servers:
  - "172.31.89.116:3025"
ssh_service:
  enabled: true
auth_service:
  enabled: false
proxy_service:
  enabled: false

Works perfectly. I am able to run systemctl start, stop, restart, etc., without any problem. If I simple create the /etc/teleport.yaml file and run systemctl start teleport without ever running:

teleport start \
   --roles=node \
   --token=fbae678ea06ad6592d7b73926a8cf3d7 \
   --ca-pin=sha256:88ca829d05a054ca60be1819dd94a4023ee6d110fa7679d135a29d1b2ccef05a \
   --auth-server=172.31.89.116:3025

It does not work. Does not make sense, but that's what it is.

[webvictim]

What user are you running the teleport start command as? Which user owns /var/lib/teleport?

It's possible that the permissions on the directory aren't getting set up correctly by systemd, whereas running teleport start does so correctly.

How did you install Teleport?

[jdmedeiros]

Running teleport start as root and root owns /var/lib/teleport. Terraform from the teleport/examples/aws/terraform/starter-cluster. Thanks for the follow up.

[webvictim]

Your response makes sense given the config file you used at first. auth_service, proxy_service and ssh_service all default to enabled: true when nothing else is specified in the config.

If you only want to run ssh_service, you need to set auth_service and proxy_service to enabled: false as you described.

[webvictim]

See answer here: #6025 (reply in thread)