tsh

Log in to Teleport cluster

$ tsh login --proxy=[teleport.example.com] --user=[username]

$ tsh ls

$ tsh ssh [user]@[hostname]

$ tsh kube ls

$ tsh kube login [cluster-name]

$ tsh db ls

$ tsh db connect [database-name]

$ tsh sessions ls

$ tsh logout

tsh [global-options] command [command-options] [args...]

tsh is the Teleport client CLI for accessing infrastructure protected by Teleport. It provides unified access to SSH servers, Kubernetes clusters, databases, and web applications with built-in audit logging and access controls.
Authentication via login stores credentials in ~/.tsh with automatic expiration (default 12 hours). Certificates support short-lived access aligned with zero-trust principles.
For SSH access, use ssh command or generate native SSH config with tsh config for use with standard ssh clients. Session recording enables play for audit review.
Kubernetes access with kube login configures kubectl credentials. Database access via db connect provides authenticated connections to PostgreSQL, MySQL, MongoDB, and other databases.
Access requests enable just-in-time privilege escalation with approval workflows. Create requests with request create for resources requiring elevated permissions.

--proxy address

Teleport proxy service address.

Teleport username.

Remote OS username for SSH.

Session credential TTL. Default: 12h.

Path to identity file.

Authentication connector name.

Skip TLS certificate verification.

Enable verbose debug logging.

SSH jump host.

Certificate format: standard or kubernetes.

Skip client/server version compatibility check.

login

Authenticate to Teleport cluster.

End session and remove credentials.

Show current login status.

List available SSH servers.

Start SSH session to a server.

Secure copy files.

Join an active session.

Replay a recorded session.

List active sessions.

Manage Kubernetes access.

Manage database access.

Manage application access.

Manage access requests.

Generate SSH config for native SSH client.

Show version information.

Requires Teleport cluster access configured by administrator. Some resources require role-based access or approval. Certificate TTL limits session duration. The --insecure flag should not be used in production.

Teleport was created by Gravitational (now Teleport) in 2016 to provide secure access to infrastructure with audit logging and identity-based access controls. The project implements certificate-based authentication following BeyondCorp/zero-trust principles. Teleport open-sourced the core product and has since expanded to cover Kubernetes, databases, and applications.

ssh(1), kubectl(1), tctl(1)