Deny non-interactive teleport command.

[lamth]

Hi Team,
Is there any way to prevent users from executing non-interactive command in remote host, like this:
tsh ssh node command
Thank you

[stevenGravy]

hi, no there isn't an option to require interactive sessions over commands. You can see available options for allowing or disallowing actions like scp here https://goteleport.com/docs/reference/access-controls/roles/.

[webvictim]

Can I ask what the reason would be for doing this?

Any commands executed in this way do not generate session recordings, but an audit log event will be generated with the command run - for example:

{
  "addr.local": "127.0.0.1:443",
  "addr.remote": "24.224.x.x:56958",
  "cluster_name": "purple",
  "code": "T3002I",
  "command": "hostname",
  "ei": 0,
  "event": "exec",
  "exitCode": "0",
  "login": "ubuntu",
  "namespace": "default",
  "private_key_policy": "none",
  "server_hostname": "ip-172-31-30-140",
  "server_id": "1c4cf287-b8eb-43ad-a49a-d102efff1d7e",
  "server_version": "16.4.3",
  "sid": "66591e0c-ff4c-4d46-afb7-acce390deb44",
  "time": "2024-10-23T13:17:46.665Z",
  "trusted_device": {
    "asset_tag": "RG0xxxxxxx",
    "credential_id": "eda45359-7377-40dc-9337-46076afc9ec3",
    "device_id": "8f4560f8-f1cf-43bf-a78e-049fff39bb8d"
  },
  "uid": "038bdaf9-10fd-4b27-b9fa-2bb52396b0f1",
  "user": "webvictim",
  "user_kind": 1
}

[lamth]

I have problem with session recordings, but if there is no way to deny non-interactive command, I will use audit logs instead.
Thank you!