Skip to content

Commit

Permalink
Fix spacings in admin-guide.md [docs] (gravitational#3435)
Browse files Browse the repository at this point in the history 
Co-authored-by: Ben Arent <[email protected]>
  • Loading branch information
@benarent
Lisa Kim and benarent authored Mar 12, 2020
1 parent 6b16835 commit 9b74254
Showing 1 changed file with 35 additions and 35 deletions.
70 changes: 35 additions & 35 deletions docs/4.2/admin-guide.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -73,15 +73,15 @@ document will be referring to:

|Concept | Description
|----------|------------
|Node | Synonym to "server" or "computer", something one can "SSH to". A node must be running the [ `teleport` ](cli-docs.md#teleport) daemon with "node" role/service turned on.
|Node | Synonym to "server" or "computer", something one can "SSH to". A node must be running the [`teleport`](cli-docs.md#teleport) daemon with "node" role/service turned on.
|Certificate Authority (CA) | A pair of public/private keys Teleport uses to manage access. A CA can sign a public key of a user or node, establishing their cluster membership.
|Teleport Cluster | A Teleport Auth Service contains two CAs. One is used to sign user keys and the other signs node keys. A collection of nodes connected to the same CA is called a "cluster".
|Cluster Name | Every Teleport cluster must have a name. If a name is not supplied via `teleport.yaml` configuration file, a GUID will be generated.**IMPORTANT:** renaming a cluster invalidates its keys and all certificates it had created.
|Cluster Name | Every Teleport cluster must have a name. If a name is not supplied via `teleport.yaml` configuration file, a GUID will be generated. **IMPORTANT:** renaming a cluster invalidates its keys and all certificates it had created.
|Trusted Cluster | Teleport Auth Service can allow 3rd party users or nodes to connect if their public keys are signed by a trusted CA. A "trusted cluster" is a pair of public keys of the trusted CA. It can be configured via `teleport.yaml` file.

## Teleport Daemon

The Teleport daemon is called [ `teleport` ](cli-docs.md#teleport) and it supports
The Teleport daemon is called [`teleport`](cli-docs.md#teleport) and it supports
the following commands:

|Command | Description
Expand All @@ -92,8 +92,8 @@ the following commands:
|status | Shows the status of a Teleport connection. This command is only available from inside of an active SSH session.
|help | Shows help.

When experimenting, you can quickly start [ `teleport` ](cli-docs.md#teleport)
with verbose logging by typing [ `teleport start -d` ](cli-docs.md#teleport-start)
When experimenting, you can quickly start [`teleport`](cli-docs.md#teleport)
with verbose logging by typing [`teleport start -d`](cli-docs.md#teleport-start)
.

!!! danger "WARNING"
Expand Down Expand Up @@ -175,8 +175,8 @@ of them is configurable.
## Configuration

You should use a [configuration file](#configuration-file) to configure the
[ `teleport` ](cli-docs.md#teleport) daemon. For simple experimentation, you can
use command line flags with the [ `teleport start` ](cli-docs.md#teleport-start)
[`teleport`](cli-docs.md#teleport) daemon. For simple experimentation, you can
use command line flags with the [`teleport start`](cli-docs.md#teleport-start)
command. Read about all the allowed flags in the [CLI
Docs](cli-docs.md#teleport-start) or run `teleport start --help`

Expand Down Expand Up @@ -522,13 +522,13 @@ following use cases:
## Authentication

Teleport uses the concept of "authentication connectors" to authenticate users
when they execute [ `tsh login` ](cli-docs.md#tsh-login) command. There are three
when they execute [`tsh login`](cli-docs.md#tsh-login) command. There are three
types of authentication connectors:

### Local Connector

Local authentication is used to authenticate against a local Teleport user
database. This database is managed by [ `tctl users` ](cli-docs.md#tctl-users-add)
database. This database is managed by [`tctl users`](cli-docs.md#tctl-users-add)
command. Teleport also supports second factor authentication (2FA) for the local
connector. There are three possible values (types) of 2FA:

Expand Down Expand Up @@ -681,9 +681,9 @@ Let's look at this table:
|bob | bob | Teleport user 'bob' can login into member nodes only as OS user 'bob'
|ross | | If no OS login is specified, it defaults to the same name as the Teleport user.

To add a new user to Teleport, you have to use the [ `tctl` ](cli-docs.md#tctl)
To add a new user to Teleport, you have to use the [`tctl`](cli-docs.md#tctl)
tool on the same node where the auth server is running, i.e.
[ `teleport` ](cli-docs.md#teleport) was started with `--roles=auth` .
[`teleport`](cli-docs.md#teleport) was started with `--roles=auth` .

``` bsh
$ tctl users add joe joe,root
Expand Down Expand Up @@ -734,7 +734,7 @@ $ tctl users rm joe
## Editing Users

Users entries can be manipulated using the generic [resource
commands](#resources) via [ `tctl` ](cli-docs.md#tctl) . For example, to see the
commands](#resources) via [`tctl`](cli-docs.md#tctl) . For example, to see the
full list of user records, an administrator can execute:

``` yaml
Expand Down Expand Up @@ -799,7 +799,7 @@ A more secure way to add nodes to a cluster is to generate tokens as they are
needed. Such token can be used multiple times until its time to live (TTL)
expires.

Use the [ `tctl` ](cli-docs.md#tctl) tool to register a new invitation token (or
Use the [`tctl`](cli-docs.md#tctl) tool to register a new invitation token (or
it can also generate a new token for you). In the following example a new token
is created with a TTL of 5 minutes:

Expand All @@ -808,7 +808,7 @@ $ tctl nodes add --ttl=5m --roles=node,proxy --token=secret-value
The invite token: secret-value
```

If `--token` is not provided, [ `tctl` ](cli-docs.md#tctl) will generate one:
If `--token` is not provided, [`tctl`](cli-docs.md#tctl) will generate one:

``` bsh
# generate a short-lived invitation token for a new node:
Expand Down Expand Up @@ -908,7 +908,7 @@ teleport:

The CA pin becomes invalid if a Teleport administrator
performs the CA rotation by executing
[ `tctl auth rotate` ](cli-docs.md#tctl-auth-rotate) .
[`tctl auth rotate`](cli-docs.md#tctl-auth-rotate) .

## Revoking Invitations

Expand Down Expand Up @@ -974,7 +974,7 @@ In addition to specifying a custom nodename, Teleport also allows for the
application of arbitrary key:value pairs to each node, called labels. There are
two kinds of labels:

1. `static labels` do not change over time, while [ `teleport` ](cli-docs.md#teleport)
1. `static labels` do not change over time, while [`teleport`](cli-docs.md#teleport)
process is running. Examples of static labels are physical location of nodes,
name of the environment (staging vs production), etc.

Expand Down Expand Up @@ -1187,7 +1187,7 @@ $ tctl auth export --type=user

To allow access to a single user, copy the above output to
`~/.ssh/authorized_keys` . To apply this for all users, remove "cert-authority"
from the start of [ `tctl` ](cli-docs.md#tctl) output and copy it to
from the start of [`tctl`](cli-docs.md#tctl) output and copy it to
`/etc/ssh/teleport_user_ca.pub` .

Add the following line to `/etc/ssh/sshd_config` :
Expand Down Expand Up @@ -1231,7 +1231,7 @@ HostKey /etc/ssh/teleport_host_key
HostCertificate /etc/ssh/teleport_host_key-cert.pub
```

Now you can use [ `tsh ssh [email protected]` ](cli-docs.md#tsh) to login
Now you can use [`tsh ssh [email protected]`](cli-docs.md#tsh) to login
into any `sshd` node in the cluster and the session will be recorded. If you
want to use OpenSSH `ssh` client for logging into `sshd` servers behind a proxy
in "recording mode", you have to tell the `ssh` client to use the jump host and
Expand Down Expand Up @@ -1298,14 +1298,14 @@ A Teleport administrator has two tools to configure a Teleport cluster:
* The [configuration file](#configuration) is used for static configuration like
the cluster name.

* The [ `tctl` ](cli-docs.md#tctl) admin tool is used for manipulating dynamic
* The [`tctl`](cli-docs.md#tctl) admin tool is used for manipulating dynamic
records like Teleport
users.

[ `tctl` ](cli-docs.md#tctl) has convenient subcommands for dynamic
[`tctl`](cli-docs.md#tctl) has convenient subcommands for dynamic
configuration, like `tctl users` or `tctl nodes` . However, for dealing with
more advanced topics, like connecting clusters together or troubleshooting
trust, [ `tctl` ](cli-docs.md#tctl) offers the more powerful, although
trust, [`tctl`](cli-docs.md#tctl) offers the more powerful, although
lower-level CLI interface called `resources` .

The concept is borrowed from the REST programming pattern. A cluster is composed
Expand All @@ -1324,9 +1324,9 @@ be manipulated with just 3 CLI commands:

| Command | Description | Examples |
|---------------|-----------------------------------------------------------------------|-----------------------------------------|
| [ `tctl get` ](cli-docs.md#tctl-get) | Get one or multiple resources | `tctl get users` or `tctl get user/joe` |
| [ `tctl rm` ](cli-docs.md#tctl-rm) | Delete a resource by type/name | `tctl rm user/joe` |
| [ `tctl create` ](cli-docs.md#tctl-create) | Create a new resource from a YAML file. Use `-f` to override / update | `tctl create -f joe.yaml` |
| [`tctl get`](cli-docs.md#tctl-get) | Get one or multiple resources | `tctl get users` or `tctl get user/joe` |
| [`tctl rm`](cli-docs.md#tctl-rm) | Delete a resource by type/name | `tctl rm user/joe` |
| [`tctl create`](cli-docs.md#tctl-create) | Create a new resource from a YAML file. Use `-f` to override / update | `tctl create -f joe.yaml` |

!!! warning "YAML Format"

Expand Down Expand Up @@ -1376,7 +1376,7 @@ spec:
only internally and are not meant to be changed. Others are reserved for
future use.
Here's the list of resources currently exposed via [ `tctl` ](cli-docs.md#tctl) :
Here's the list of resources currently exposed via [`tctl`](cli-docs.md#tctl) :

| Resource Kind | Description |
|---------------|----------------------------------------------------------------------------------------------------------------------------------------------|
Expand Down Expand Up @@ -1439,7 +1439,7 @@ $ tsh clusters

### Selecting the Default Cluster

To avoid using `--cluster` switch with [ `tsh` ](cli-docs.md#tsh) commands, you
To avoid using `--cluster` switch with [`tsh`](cli-docs.md#tsh) commands, you
can also specify which trusted cluster you want to become the default from the
start:

Expand Down Expand Up @@ -1554,7 +1554,7 @@ spec:
local: ["auditor"] # will be assigned "auditor" role when logging into "east"
```

Then, use [ `tctl create` ](cli-docs.md#tctl-create) to add the file:
Then, use [`tctl create`](cli-docs.md#tctl-create) to add the file:

``` yaml
$ tctl create cluster.yaml
Expand Down Expand Up @@ -1709,7 +1709,7 @@ to [create and register an OAuth app](https://developer.github.com/apps/building
Be sure to set the "Authorization callback URL" to the same value as `redirect_url` in
the resource spec.

Finally, create the connector using [ `tctl` ](cli-docs.md#tctl)
Finally, create the connector using [`tctl`](cli-docs.md#tctl)
[resource](#resources) management command:

``` yaml
Expand Down Expand Up @@ -2069,9 +2069,9 @@ You can take advantage of the [Trusted Clusters](#trusted-clusters) feature of
Teleport to federate trust across multiple Kubernetes clusters.

When multiple trusted clusters are present behind a Teleport proxy, the
`kubeconfig` generated by [ `tsh login` ](cli-docs.md#tsh-login) will contain the
`kubeconfig` generated by [ `tsh login`](cli-docs.md#tsh-login) will contain the
Kubernetes API endpoint determined by the `<cluster>` argument to [`tsh
login`](cli-docs.md#tsh-login) .
login`](cli-docs.md#tsh-login).

* There are three Teleport/Kubernetes clusters: "main", "east" and "west". These
are the names set in `cluster_name` setting in their configuration files.
Expand Down Expand Up @@ -2540,8 +2540,8 @@ As covered in the [Graceful Restarts](#graceful-restarts) section, Teleport
supports graceful restarts. To upgrade a host to a newer Teleport version, an
administrator must:
1. Replace the Teleport binaries, usually [ `teleport` ](cli-docs.md#teleport)
and [ `tctl` ](cli-docs.md#tctl)
1. Replace the Teleport binaries, usually [`teleport`](cli-docs.md#teleport)
and [`tctl`](cli-docs.md#tctl)
2. Execute `systemctl restart teleport`
Expand Down Expand Up @@ -2576,15 +2576,15 @@ The `license_file` path can be either absolute or relative to the configured

## Troubleshooting

To diagnose problems you can configure [ `teleport` ](cli-docs.md#teleport) to
To diagnose problems you can configure [`teleport`](cli-docs.md#teleport) to
run with verbose logging enabled by passing it `-d` flag.

!!! tip "NOTE"

It is not recommended to run Teleport in production with verbose
logging as it generates a substantial amount of data.

Sometimes you may want to reset [ `teleport` ](cli-docs.md#teleport) to a clean
Sometimes you may want to reset [`teleport`](cli-docs.md#teleport) to a clean
state. This can be accomplished by erasing everything under `"data_dir"`
directory. Assuming the default location, `rm -rf /var/lib/teleport/*` will do.

Expand Down Expand Up @@ -2617,4 +2617,4 @@ If you need help, please ask on our [community forum](https://community.gravitat

For commercial support, you can create a ticket through the [customer dashboard](https://dashboard.gravitational.com/).

For more information about custom features, or to try our [Enterprise edition](enterprise/index.md) of Teleport, please reach out to us at [[email protected]](mailto:[email protected]).
For more information about custom features, or to try our [Enterprise edition](enterprise/index.md) of Teleport, please reach out to us at [[email protected]](mailto:[email protected]).

0 comments on commit 9b74254

Please sign in to comment.