mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-01 21:52:02 +08:00
Zac BergquistandAlex Fornuto
a5932e3244
* docs: remove references to old Teleport versions With the release of Teleport 12, the oldest supported version of Teleport will be Teleport 10. This commit removes some references to Teleport 7 and Teleport 8. The docs for those versions are no longer available on goteleport.com, so it's safe to assume that readers are on a more recent version. * Update docs/pages/management/guides/joining-nodes-aws-ec2.mdx --------- Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
86 lines
3.1 KiB
Plaintext
86 lines
3.1 KiB
Plaintext
---
|
|
title: Session Recording and Playback
|
|
description: Recording and Playing Back Teleport Desktop Access Sessions.
|
|
---
|
|
|
|
Teleport Desktop Access supports recording and playback of desktop sessions.
|
|
|
|
## Disabling session recording
|
|
|
|
Session recording is enabled by default, and can be disabled in one of two ways:
|
|
|
|
### Disable session recording at the cluster level
|
|
|
|
To disable session recording at the cluster level, edit your `teleport.yaml`
|
|
configuration file.
|
|
|
|
```yaml
|
|
teleport:
|
|
auth_service:
|
|
session_recording: off
|
|
```
|
|
|
|
<Admonition type="warning">
|
|
Disabling session recording at the cluster level applies to all types of
|
|
recordings. For example, this configuration would prevent Teleport from
|
|
recording SSH sessions as well as desktop sessions.
|
|
</Admonition>
|
|
|
|
The `session_recording` property can also be configured dynamically by using
|
|
`tctl` to edit the cluster's `session_recording_config` resource. This is the
|
|
required approach for Teleport Cloud users.
|
|
|
|
### Disable session recording via RBAC
|
|
|
|
Teleport's RBAC system allows more fine-grained control over which sessions are
|
|
recorded. By default, desktop session recording is enabled. To disable desktop
|
|
session recording for a particular user, add the following role option to all of
|
|
the user's roles:
|
|
|
|
```yaml
|
|
kind: role
|
|
version: v4
|
|
metadata:
|
|
name: no_desktop_recording
|
|
spec:
|
|
options:
|
|
record_session:
|
|
desktop: false
|
|
```
|
|
|
|
Because recording can be important for auditing and compliance concerns, the
|
|
presence of a single role with recording enabled will result in the session
|
|
being recorded. In other words, *all* of the roles applied to a user must
|
|
explicitly disable recording to prevent the session from being recorded.
|
|
|
|
See the
|
|
[Teleport Access Controls Reference](../../access-controls/reference.mdx)
|
|
for all possible settings in the `record_session` section.
|
|
|
|
## Playback
|
|
|
|
Recorded sessions can be viewed in the *Session Recordings* page. Desktop
|
|
recordings show a desktop icon in the first column to distinguish them from
|
|
SSH recordings.
|
|
|
|
|
|
|
|
Click the play button to open the player in a new tab. The desktop session
|
|
player supports toggling between play and pause, but does not support seeking to
|
|
a specific point in the stream, rewinding, or restarting playback when the end
|
|
of the stream is reached. To replay a session, refresh the page.
|
|
|
|
## Storage
|
|
|
|
Be aware, Desktop Access session recordings save PNGs of changing sections of the
|
|
screen, which means they take up significantly more disk space than SSH or Kubernetes
|
|
session recordings. When using async recording modes, ensure that the host running
|
|
Teleport's desktop service has sufficient disk space to store recordings that are
|
|
in progress. As a point of reference, when a full 1080p screen is redrawn (for example
|
|
when opening a new full-sized application window), you can expect about 250kb to be
|
|
saved to disk. If disk space is a concern, we recommend using sync recording and
|
|
configuring a cloud storage solution such as S3.
|
|
|
|
Refer to the `storage` section of the [Teleport Configuration Reference](../../reference/config.mdx)
|
|
for more information on session logging and recording management.
|