3

From a security standpoint is it safe to run Teleport instead of an SSH daemon?

  • 1
    The reasons why are outlined on their Readme. As for a security review, we can't really do that. – schroeder Sep 28 '16 at 21:08
  • @drewbenn Sorry for asking without doing enough research. – noob Sep 28 '16 at 22:19
5

For anything really sensitive, it's hard to justify using Teleport given how young it is.

OpenSSH is battle-tested and has had 10000's of developer hours spent on it, as well as countless audits.

OpenSSH is also guaranteed to be around for a long time to come.

  • 2
    OpenSSH being "battle-tested" isn't as structurally sound given how many CVEs have been cropping up for it lately. But I do agree 100%. – sethmlarson Sep 28 '16 at 21:19
  • @SethMichaelLarson - I guess that is side effect of more work being done on it. If you looks at the CVE list you see more CVEs in 2015 and 2016 but also a bigger number of openssl versions (1.0.0x, 1.0.1x, and now 1.0.2x). The versions (and the number of lines of code) are going up quicker than ever before. – grochmal Sep 28 '16 at 22:13
  • @SethMichaelLarson: that's the result of being battle-tested. I really doubt Teleport authors write significantly more secure code than OpenSSH authors. – George Y. Sep 29 '16 at 2:58
  • Being older means OpenSSH has had more testing; it also means it has much more accumulated cruft that could be vulnerable. – user253751 Sep 29 '16 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.