Home

The net/teleport port

teleport-18.11.1p3 – reverse-proxy with built-in authentication and auditing (cvsweb github mirror)

Description

Teleport provides connectivity, authentication, access controls and
audit for infrastructure.

You might use Teleport to:

* Set up single sign-on (SSO) for all of your cloud and on-prem
  infrastructure.
* Protect access to servers, Kubernetes clusters, databases, Windows
  desktops, web applications, and cloud APIs without long-lived keys or
  passwords.
* Establish secure tunnels to reach resources behind NATs and firewalls
  without VPNs or bastion hosts.
* Record and audit activity across SSH, Kubernetes, database, RDP, and
  web sessions.
* Apply consistent Role-Based and Attribute-Based Access Control 
  (RBAC/ABAC) across users, machines, workloads, and resource types.
* Enforce least privilege and Just-in-Time (JIT) access requests for
  elevated roles or sensitive systems.
* Maintain a single identity and access layer for both human users and
  workloads.

Teleport works with SSH, Kubernetes, databases, RDP, cloud consoles,
internal web services, Git repositories, and Model Context Protocol
(MCP) servers.
WWW: https://goteleport.com

Readme

+-------------------------------------------------------------------------------
| Running ${PKGSTEM} on OpenBSD
+-------------------------------------------------------------------------------

Official documentation
======================

See the Teleport documentation at https://goteleport.com/docs/

A quick introduction to Teleport Community Edition is available at:

  https://goteleport.com/docs/get-started/deploy-community/

Usage
=====

The following programs are installed by the ${PKGSTEM} package.

Read the official documentation and run the built-in 'help' command of
each tool for further information.

teleport
--------

The main Teleport binary that runs the Web UI, Auth Service, Proxy
Service, and Teleport Agent services.

The rc.d(8) script provided with the teleport package assumes the
configuration file location: /etc/teleport/teleport.yaml

Some Teleport features require files from the Teleport CDN, which are
distributed under the Teleport Community license:

  https://goteleport.com/blog/teleport-community-license/

To accept this licence and make use of Teleport's CDN, add a login-class
for teleport to login.conf(5) which sets the TELEPORT_CDN_BASE_URL
environment variable to the URL of Teleport's CDN:

teleport:\
        :setenv=TELEPORT_CDN_BASE_URL="https://cdn.teleport.dev":\
        :tc=daemon:

By default, the Teleport server is run with the _teleport user account.
The Teleport server might print a message which claims that it requires
root access because Teleport uses "/var/lib/teleport", which is false.
Another message might suggest to run "sudo teleport start". which is
wrong.  Use "rcctl enable teleport && rcctl start teleport" instead.

Running Teleport as root is only needed in certain use cases, such as
when Teleport will act as an SSH server on the system where Teleport is
running.  To run Teleport as root, set "teleport_user=root" in
/etc/rc.conf.local.

tctl
----

tctl is the administrative command-line interface for managing a
Teleport cluster. It allows administrators to configure roles, manage
users, and work with resources such as tokens, trusted clusters, and
audit logs.

tsh
---

tsh is the command-line tool used by Teleport users to authenticate,
connect to infrastructure resources, and manage active sessions.  It
supports SSH, Kubernetes, databases, and applications.


Making teleport reachable on port 443
=====================================

When teleport runs as a non-root user it cannot listen on privileged
network ports, such as port 443. In this case, pf(4) can be used to
make teleport reachable on privileged ports.

In the proxy service section of /etc/teleport/teleport.yaml, configure
an unprivileged port number above 1023 for Teleport to listen on, for
example port 4443:

proxy_service:
  enabled: "yes"
  web_listen_addr: "0.0.0.0:4443"
  public_addr: teleport.example.com

In /etc/pf.conf, incoming connections to port 443 can be redirected to
the unprivileged port:

pass in inet proto tcp from any to self port 443 rdr-to 127.0.0.1 port 4443


Managing SSL certificates for Teleport
======================================

Teleport needs a valid TLS certificate to function. It is possible
to use self-signed certificates but their use is discouraged by
the official documentation.

Teleport contains a built-in ACME client which can be used, but
it is also possible to run acme-client(1) and httpd(8) to obtain
a certificate for Teleport.

In /etc/httpd.conf, use:

server "teleport.example.com" {
        listen on * port 80

        block

        location "/.well-known/acme-challenge/*" {
                root "/acme"
                request strip 2
                pass
        }
}

Enable and start httpd:

  rcctl enable httpd && rcctl start httpd

In /etc/acme-client.conf, use

teleport.example.com {
        domain key "/etc/ssl/private/teleport.example.com.key"
        domain full chain certificate "/etc/ssl/teleport.example.com.fullchain.pem"
        # Test with the staging server to avoid aggressive rate-limiting.
        #sign with letsencrypt-staging
        sign with letsencrypt
}

Run acme-client to obtain a certificate:

  acme-client teleport.example.com

Copy the certificate obtained by acme-client to the /etc/teleport/ directory
and allow the _teleport user to read the private key:

 cp -p /etc/ssl/teleport.example.com.fullchain.pem /etc/teleport/
 cp -p /etc/ssl/private/teleport.example.com.key /etc/teleport/
 chgrp _teleport /etc/teleport/teleport.example.com.key
 chmod g+r /etc/teleport/teleport.example.com.key

The crontab(5) entry which updates the certificate needs to copy the
updated certificate to /etc/teleport and restart teleport:

~ * * * * -n -s acme-client teleport.example.com && cp -p /etc/ssl/teleport.example.com.fullchain.pem /etc/teleport/ && rcctl restart teleport

In the proxy service section of /etc/teleport/teleport.yaml, point
teleport at the TLS certificate and disable the built-in ACME client:

proxy_service:
  enabled: "yes"
  web_listen_addr: "0.0.0.0:4443"
  public_addr: teleport.example.com
  https_keypairs:
  - key_file: /etc/teleport/teleport.example.com.key
    cert_file: /etc/teleport/teleport.example.com.fullchain.pem
  https_keypairs_reload_interval: 0s
  acme: {}

Maintainer

Stefan Sperling

Only for arches

aarch64 amd64

Categories

lang/go lang/rust net security

Library dependencies

Build dependencies

Files

Search