Teleport + ssh_config

[dgiorgio]

I want to create a ssh config, using the Teleport as a proxy.
How do I do it?

# Begin generated Teleport configuration for teleport.example.com.br by tsh

# Common flags for all teleport.example.com.br hosts
Host *.teleport.example.com.br teleport.example.com.br
    UserKnownHostsFile "/home/user/.tsh/known_hosts"
    IdentityFile "/home/user/.tsh/keys/teleport.example.com.br/douglasfim"
    CertificateFile "/home/user/.tsh/keys/teleport.example.com.br/douglasfim-ssh/teleport.example.com.br-cert.pub"
    PubkeyAcceptedAlgorithms [email protected]
    HostKeyAlgorithms [email protected],[email protected],[email protected]

# Flags for all teleport.example.com.br hosts except the proxy
Host *.teleport.example.com.br !teleport.example.com.br
    Port 3023
    ProxyCommand "/usr/bin/tsh" proxy ssh --cluster=teleport.example.com.br --proxy=teleport.example.com.br %r@%h:%p

# End generated Teleport configuration

Host *
  HostKeyAlgorithms +ssh-rsa*,rsa-sha2-512
  PubkeyAcceptedKeyTypes +ssh-rsa*
  ForwardAgent yes

Host teleport-tunnel
  Hostname teleport.example.com.br
  Port 3023
  RemoteCommand proxy:%r@%h:%p

Host valid3-tunnel
  HostName valid3
  Port 22
  User touch
  ProxyJump %r@teleport-tunnel

If I trying to access the valid3-tunnel host, everytime shows this warn message WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!

$ ssh -F ~/.ssh/config-teleport.touch valid3-tunnel
The authenticity of host 'valid3 (<no hostip for proxy command>)' can't be established.
RSA key fingerprint is SHA256:B9xXLhCQ9SVurGpeJxPurpe2zlzIAVH5I4fcoigYEAA.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'valid3' (RSA) to the list of known hosts.
[touch@valid-io ~]$ logout
Connection to valid3 closed.

$ ssh -F ~/.ssh/config-teleport.touch valid3-tunnel
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
SHA256:OXsLpot804LLlIs5nTuRdiGJl5Bo7p+0QPCVX7dNs6U.
Please contact your system administrator.
Add correct host key in /home/user/.ssh/known_hosts to get rid of this message.
Offending RSA key in /home/user/.ssh/known_hosts:495
You can use following command to remove the offending key:
ssh-keygen -R valid3 -f /home/user/.ssh/known_hosts
Host key for valid3 has changed and you have requested strict checking.
Host key verification failed.

But, if I use the HostKeyAlias config, this problem stops happening.

Host valid3-tunnel
  HostName valid3
  Port 22
  User touch
  ProxyJump %r@teleport-tunnel
  HostKeyAlias valid3.teleport.example.com.br

There is a some way to use, without the HostKeyAlias config?

[dgiorgio]

If I use this config, adding * on teleport config.
I have the same problem.

# Begin generated Teleport configuration for teleport.example.com.br by tsh

# Common flags for all teleport.example.com.br hosts
Host * *.teleport.example.com.br teleport.example.com.br
    UserKnownHostsFile "/home/user/.tsh/known_hosts"
    IdentityFile "/home/user/.tsh/keys/teleport.example.com.br/douglasfim"
    CertificateFile "/home/user/.tsh/keys/teleport.example.com.br/douglasfim-ssh/teleport.example.com.br-cert.pub"
    PubkeyAcceptedAlgorithms [email protected]
    HostKeyAlgorithms [email protected],[email protected],[email protected]

# Flags for all teleport.example.com.br hosts except the proxy
Host * *.teleport.example.com.br !teleport.example.com.br
    Port 3023
    ProxyCommand "/usr/bin/tsh" proxy ssh --cluster=teleport.example.com.br --proxy=teleport.example.com.br %r@%h:%p

# End generated Teleport configuration

Host *
  HostKeyAlgorithms +ssh-rsa*,rsa-sha2-512
  PubkeyAcceptedKeyTypes +ssh-rsa*
  ForwardAgent yes
  
Host valid3-tunnel2
  HostName valid3
  Port 22
  User touch

And again, it worked if using FQDN address.

Host valid3-tunnel2
  HostName valid3.teleport.example.com.br
  Port 22
  User touch

Host valid3-tunnel2
  HostName valid3
  Port 22
  User touch
  HostKeyAlias valid3.teleport.example.com.br

[dgiorgio]

In cases where I don't use a "teleport agent" on the host.
https://goteleport.com/docs/server-access/guides/openssh/

None of the above cases worked.
I already commented on this case in this thread. #15584 (comment)

Host valid1
  HostName 172.19.66.53
  Port 22
  User touch
  ProxyJump %r@teleport-tunnel

[dgiorgio]

Solved

# Begin generated Teleport configuration for teleport.example.com.br by tsh

# Common flags for all teleport.example.com.br hosts
Host *.teleport.example.com.br teleport.example.com.br
    UserKnownHostsFile "/home/user/.tsh/known_hosts"
    IdentityFile "/home/user/.tsh/keys/teleport.example.com.br/douglasfim"
    CertificateFile "/home/user/.tsh/keys/teleport.example.com.br/douglasfim-ssh/teleport.example.com.br-cert.pub"
    PubkeyAcceptedAlgorithms [email protected]
    HostKeyAlgorithms [email protected],[email protected],[email protected]

# Flags for all teleport.example.com.br hosts except the proxy
Host *.teleport.example.com.br !teleport.example.com.br
    Port 3023
    ProxyCommand "/usr/bin/tsh" proxy ssh --cluster=teleport.example.com.br --proxy=teleport.example.com.br %r@%h:%p

# End generated Teleport configuration

Host *
  HostKeyAlgorithms +ssh-rsa*,rsa-sha2-512
  PubkeyAcceptedKeyTypes +ssh-rsa*
  ForwardAgent yes

Host teleport-tunnel
  Hostname teleport.example.com.br
  Port 3023
  RemoteCommand proxy:%r@%h:%p

Host valid1
  HostName 172.19.66.53
  Port 22
  User touch
  ProxyJump %r@teleport-tunnel
  HostKeyAlias 172.19.66.53.teleport.example.com.br

Using the HostKeyAlias setting, also solves the HOST IDENTIFICATION issue for IP connection.