How do I log into a cluster on a remote environment with no browser access?

Type:

How-To

Question/Problem:

How do I log into a cluster on a remote environment with no browser access?

Solution:

This solution requires port forwarding. To accomplish this you will first want to run the tsh login command with the --browser=none flag on the remote, browserless host so that it doesn't try to open a browser. This will produce a login link:

▶ tsh login --proxy example.proxy.com:443 --browser=none

Use the following URL to authenticate:
http://127.0.0.1:61634/932bce95-6453-47bf-bb69-6e7b4ea783be

You will then want to navigate to your local machine and run the following in the CLI to establish forwarding:

tsh ssh -L 61634:127.0.0.1:61634 username@10.0.0.1

(10.0.0.1 is the IP of the remote host without browser on which you ran the tsh login command earlier)

After that you will open the URL locally in a browser and authenticate as you would normally. Once you've authenticated everything should be updated on the remote host as expected.

From here you can then use tsh from the remote host without issue.

Note:: you can also do the same forwarding with ssh -L instead of tsh ssh -L if the remote instance is not accessible as a node from your existing Teleport Cluster.