How to reduce Teleport session recording time in Teleport version 16.x?

[nintech-sudo]

Hello,

How can I reduce the session recording duration in Teleport version 16.x?

In version 14.x, the session recording time was very short as it only logged system I/O events. Even though the SSH session duration was long, the record only included events, reducing the duration significantly.

However, in version 16.x, the session recording duration matches the SSH session duration. Even during periods where the SSH session is idle with no actions, Teleport still records that idle time, making the session recording unnecessarily long.

In version 16.x, I’m not sure where to configure this. I’ve searched through many of your documents but haven’t been able to resolve it. I would greatly appreciate your assistance.

Below is my config file, can you tell me what configuration I need to add/edit?

/etc/teleport.yaml

version: v3

teleport:

  nodename: teleport.domain.com

  data_dir: /var/lib/teleport

  log:

    output: /var/lib/teleport/teleport.log

    # 'stdout', 'stderr' and 'syslog'. Possible severity values are DEBUG, INFO (default), WARN,

    # and ERROR.

    severity: ERROR

    format:

      output: text

      extra_fields: [level, timestamp, component, caller]

  ca_pin: ""

  diag_addr: ""

  connection_limits:

    max_connections: 100

    max_users: 50

  storage:

    type: sqlite

    path: /var/lib/teleport/backend/

    sync: FULL

    auto_scaling: true

    continuous_backups: true

    retention_period: 365d

  ciphers:

    - aes128-ctr

    - aes192-ctr

    - aes256-ctr

    - [email protected]

    - [email protected]

    - [email protected]

  kex_algos:

    - curve25519-sha256

    - [email protected]

    - ecdh-sha2-nistp256

    - ecdh-sha2-nistp384

    - ecdh-sha2-nistp521

    - diffie-hellman-group14-sha256

  mac_algos:

    - [email protected]

    - [email protected]

    - hmac-sha2-256

    - hmac-sha2-512

  ciphersuites:

      - tls-ecdhe-rsa-with-aes-128-gcm-sha256

      - tls-ecdhe-ecdsa-with-aes-128-gcm-sha256

      - tls-ecdhe-rsa-with-aes-256-gcm-sha384

      - tls-ecdhe-ecdsa-with-aes-256-gcm-sha384

      - tls-ecdhe-rsa-with-chacha20-poly1305

      - tls-ecdhe-ecdsa-with-chacha20-poly1305

auth_service:

  enabled: "yes"

  listen_addr: 0.0.0.0:3025

  cluster_name: teleport.domain.com

  proxy_listener_mode: multiplex

  session_recording: "node-sync"

ssh_service:

  enabled: "yes"

  pam:

    enabled: true

  enhanced_recording:

    enabled: true

  labels:

    role: admin

    ip: xxx.xxx.xxx.xxx

  commands:

  - name: hostname

    command: [/usr/bin/hostname]

    period: 1m0s

proxy_service:

  enabled: "yes"

  web_listen_addr: 0.0.0.0:443

  public_addr: teleport.domain.com:443

  https_keypairs:

  - key_file: /etc/teleport/ssl/teleport.domain.com.key

    cert_file: /etc/teleport/ssl/teleport.domain.com.pem

  https_keypairs_reload_interval: 0s

  acme: {}

[zmb3]

Teleport doesn't record any more data than it ever has. The behavior you're noting has to do with some changes to unify how Teleport plays session recordings.

To skip over idle time in a recording, you can use tsh play --skip-idle-time.

You can also increase the speed of playback with the --speed flag.

These options are currently only available in tsh - there is not a web UI equivalent exposed.

[nintech-sudo]

Thanks for your helpful reply