How do you list nodes on another server using the proxy server?

[speeltronics]

Is there a way to list all the connected nodes on another server?

I can list nodes using: tctl --auth-server=myserver.example.com: nodes ls
This does not require me to login. However, this requires having the auth port open.

I tried with the proxy using: sudo tctl --auth-server=proxy.myserver.example.com: nodes ls
This gives me an error saying: Cannot connect to the auth server: Get https://teleport.cluster.local/v2/configuration/name: x509: certificate is valid for *.myserver.example.com, not <id?>.teleport.cluster.local.

Is there a way to list nodes using the proxy using tctl or some other way maybe with the token?

[klizhentas]

You can use tctl as a client to any auth server. However it needs credentials to talk to the target server. tctl --identity=identity.pem --auth-server=target-server.pem will tell tctl to connect to the target auth server with the right certificate.

You can issue certificate with tctl auth sign:

https://goteleport.com/teleport/docs/user-manual/#ssh-certificates-for-automation

[webvictim]

Also, if you have access to the Enterprise versions of tctl and teleport, you can log in with tsh login --proxy=teleport.example.com and then run things like tctl nodes ls directly via the proxy using your tsh certs with Enterprise tctl.

This feature isn't in Teleport OSS yet as it relies on some RBAC primitives which are only present in the Enterprise version, but we're hoping to be able to add it in the future.