Accessing Windows systems (as teleport server)

[apiening]

Currently, there is only client support for MS Windows (see https://goteleport.com/teleport/download/).

In our environment we have several Windows Servers to be administered. So I would love to be able to log on to MS Windows instances via teleport. Preferably to an administrative Windows Powershell.
On Windows Server Core the command line is the only way to control the system anyway and most administrative tasks like managing users for example are pretty simple to do.
So it would be great to be able to benefit from the additional security features, the reverse tunneling and session recording capabilities that teleport offers.

I was too shy to open a feature request on this. Instead it seems better to me to discuss if this is even possible at all. And if so, what challenges would need to be resolved.
I took a look at the existing Issues and discussions but haven't found something related.
Since teleport is based on the Go language which has good support for the windows platform, I have some hope that it might be achievable.

Another feature that would be very, possibly even more nice to have, is RDP access with a browser based client. I noticed that there is already something in the making: #7824

I think theses features (or even one of them) would be able to let teleport grow from a supercharged SSH bastion server to a one stop server management gateway where unix and windows systems could be managed comfortably and securely with no need to install any software at all, just having a web browser as a requirement.

[webvictim]

As you say, we're working on RDP support. Windows Server administration support is not currently on the roadmap. Please do open a feature request if it's something you'd like to see - we use these to gauge public interest.

[clain23]

If you make Windows teleport-agent supporting regular SSH connection it would be enough to manage ServerCore via Powershell or plain cmd.

We successfully use OpenSSH on windows to provision our windows servers with Ansible.

[jmaerki]

Hmm, not having the teleport proxy function (TCP ports) available on Windows is kind of a bummer and eliminates Teleport out of the race for me. Would seem like low-hanging fruit given that the teleport app is written in Go.

[webvictim]

Do you mean being able to proxy access to arbitrary TCP ports to Windows machines? That is doable if you run a separate Linux process with app_service which has network access to the Windows machines.

The Teleport agent process doesn't run natively on Windows machines today, but it's something we're investigating. It isn't a simple cross-compile due to cgo and other dependencies.

[jmaerki]

Yes, that's what I was referring to. I'm aware of the possibility to run the proxy externally, thanks, but in the scenario I'm looking into for a potential client, that's not really an option (mostly a Windows shop only just warming up to Unix). It's also not really fun to expose some ports to the outside only to proxy them so you can guard access to them.

[webvictim]

Just in case it wasn't clear, you don't have to run the Windows Desktop service on the same machine as the proxy. You could keep it entirely inside your network on a Linux VM (or WSL) and have it establish a fully encrypted, mTLS authenticated reverse tunnel out to wherever your proxy is running.

I appreciate that it isn't as clean or secure as running directly on Windows, but it's still relatively secure as you'd only need to open up traffic ports to a single internal IP.

[scottpgallagher]

The issue w/ OpenSSH on Windows is that it only supports password and publickey authentication.