How to set the host_sudoers and default bash for ssh?

[MoonsuCha]

Hi Team.

We are using GitHub SSO for user login in Teleport and assigning roles accordingly. However, we are facing two issues:

1. create_host_user_default_shell: Even though we have set the default shell to bash, users are still logging in with the sh shell on their first login.

2. host_sudoers: We have configured host_sudoers for user roles, but it does not seem to apply when users log in.

Could you please guide us on how to properly configure these settings to ensure that users log in with bash as their default shell and that the host_sudoers settings are applied correctly?

[MoonsuCha]

Additionally, we have observed that these issues seem to occur when users have multiple roles assigned. If a user has only one role, the issues do not arise.

Could you also advise on the best way to configure settings in Teleport when users have multiple roles? It appears that having multiple roles might be causing the problems with both the create_host_user_default_shell and host_sudoers settings.

[webvictim]

Can you share the full YAML content of each role you have assigned to the affected users?

Getting logs from the running Teleport ssh_service process on the machine at DEBUG level and sharing them here when a user tries to log in would also be useful. You can adjust the log level of a running Teleport process with this command:

sudo teleport debug set-log-level DEBUG

[eriktate]

Could you also advise on the best way to configure settings in Teleport when users have multiple roles? It appears that having multiple roles might be causing the problems with both the create_host_user_default_shell and host_sudoers settings.

When you have multiple roles that apply to the same host, it's important to make sure their host user creation configurations do not interfere with each other. For example, if at least one role fails to specify either create_host_user_mode or create_host_user, host user management will not run.

If you're able to provide the YAML configurations and logs @webvictim asked for, then we can better diagnose what might be going wrong.