Identity Security#

• Short-lived certificates instead of long-lived SSH keys.
• Eliminates shadow access and standing privileges.
• Strengthens RBAC-based access control.

Unified Access Plane#

• All access enters through the Proxy Service.
• Supports SSO, MFA, and Device Trust.
• Centralized recording of all sessions and audit logs.

1. Secure SSH Access#

• Use short-lived certificates instead of long-lived SSH keys
• Session recording and playback
• Centralized access control
• Compatible with traditional SSH tooling (via tsh)

2. Kubernetes Access Control#

• Use Teleport identities and RBAC to centrally manage multiple K8s clusters
• Audit kubectl sessions
• Access multiple clusters without managing individual kubeconfig files

3. Database Access#

• Supports PostgreSQL, MySQL, etc.
• Database connections are proxied through Teleport Proxy
• Audit database queries
• No need to store static DB credentials locally

4. Internal Application and Desktop Access#

• Application Service can proxy internal web applications
• Desktop Service can proxy RDP to provide secure Windows desktop access

5. Workload Identity#

• Automatically issues short-lived certificates/JWTs for service-to-service calls
• Follows the SPIFFE standard
• Supports automatic rotation

1. Prepare Configuration Directories#

1
mkdir -p teleport/data teleport/config teleport/certs

2. Generate the Teleport Configuration File#

1
docker run --hostname localhost --rm \
2
  --entrypoint=/usr/local/bin/teleport \
3
  public.ecr.aws/gravitational/teleport-distroless:17.4.8 \
4
  configure --roles=proxy,auth > ./teleport/config/teleport.yaml

Modify the proxy_service section as needed:

1
proxy_service:
2
  enabled: "yes"
3
  web_listen_addr: 0.0.0.0:3080
4
  tunnel_listen_addr: 0.0.0.0:3024
5
  listen_addr: 0.0.0.0:3023
6
  public_addr:
7
    - localhost:3080
8
  https_key_file: /etc/teleport/certs/server-key.pem
9
  https_cert_file: /etc/teleport/certs/server.pem
10
  acme: {}

If you need TLS, you can generate certificates yourself using cfssl.

3. Start the Teleport Service#

1
docker run -d --restart=always \
2
  --hostname localhost --name teleport \
3
  -v ~/Applications/teleport/config:/etc/teleport \
4
  -v ~/Applications/teleport/data:/var/lib/teleport \
5
  -v ~/Applications/teleport/certs:/etc/teleport/certs \
6
  -p 3025:3025 -p 3080:3080 -p 3023:3023 \
7
  public.ecr.aws/gravitational/teleport-distroless:17.4.8

4. Check Status#

1
docker exec teleport tctl status

5. Create the First User#

1
docker exec teleport tctl users add admin \
2
  --roles=editor,access \
3
  --logins=root,ubuntu

Copy the invitation link from the output and open it in your browser to set the password and MFA.

6. Log in to the Teleport Web UI#

1
https://<server-ip>:3080

Browsers will warn about self-signed certificates; you can ignore this in test environments.

Method 1: Generate Script from the Web UI (Recommended)#

1. Open the Teleport Web UI
2. Click Add Resource / Enroll New Server
3. Copy the generated script, for example:

1
sudo bash -c "$(curl -kfsSL https://<IP>:3080/scripts/<token>/install-node.sh)"

Run this script on the target node to automatically join it to the cluster.

Method 2: Manually Generate a Token with tctl#

1
docker exec teleport tctl nodes add --ttl=5m --roles=node --format=json

Then install Teleport on the target node and configure the token and auth_server address manually.

Verify that Nodes Have Joined#

In the Web UI, or by running:

1
tsh ls

You should now see the newly enrolled server resources and be able to SSH into them directly.