Teleport conf file

[eliohann]

Hi,

I've got many question on teleport conf.
Some context here :

• We have setup a root bastion and some leaf bastion (dev, rct, prod for example)
• We use community edition with only local users set up on root bastion
• We want to set up some restrictions for users :

1. We don't want user to be able to type user name in the "enter login name" box for ssh connexions
2. We want to hide bastions nodes (we don't want them to even view that there is a server for bastion)
3. We don't want users to be able to download or upload files (so hide the 2 arrows buttons that permits it)

I already found a solution to authorize user only on some clusters (dev and rct for example), but I can't find solutions for these rules.

Can someone help me ?

[stevenGravy]

For 1. the user should be restricted to their user name allowed for the role matching. There's not a method right now to remove that showing.

For 2 this is labeling of the resources and matching with labels or expressions. If you are planning for users to go through bastion nodes there isn't a hide but use flow. If you have a node_labels with env: dev then ssh servers with env: dev is available.

For 3 see the access controls ref for the ssh_file_copy option. Note this currently shuts off all upload/download for any nodes for the user.