Teleport Server Installation & Configuration

Overview

The open source access platform used by DevSecOps teams for SSH, Kubernetes, databases, internal web applications and Windows. Teleport prevents phishing by relying on biometrics and machine identity, stops attacker pivots with the Zero Trust architecture, is compatible with everything you have, comes as a cloud service or a self-hosted option and doesn't get in the way of an engineer's productivity.

How Teleport Works

Teleport provides secure access to SSH or Windows servers, Windows desktops, Kubernetes clusters, databases, and web applications. Teleport is trivial to set up as a Linux daemon or in a Kubernetes pod.

Teleport is a certificate authority and identity-aware, multi-protocol access proxy which implements protocols such as SSH, RDP, HTTPS, Kubernetes API, and a variety of SQL and NoSQL databases. It is completely transparent to client-side tools and designed to work with everything in today's DevOps ecosystem.

Settings

Install and configure your own Teleport server as follows:

1. The server should run Ubuntu 24.04 or later.
2. The server needs a static IP address and a domain name, for example remote.yourdomain.com.
3. Run the following commands to install Teleport:

   curl https://goteleport.com/static/install.sh | bash -s 16.3.0
   export TELEPORT_PKG=teleport
   export TELEPORT_VERSION=v16
   export TELEPORT_CHANNEL=stable/${TELEPORT_VERSION?}
   source /etc/os-release

4. Optionally, install the following troubleshooting tools:

   apt install net-tools mc ngrep

5. Add a firewall rule that allows inbound traffic to ports 80 and 443 on this server. Logsign connects to the Teleport server over TCP port 443, so this port must also be reachable from your Logsign instances.
6. Create the Teleport configuration file /etc/teleport.yaml. Replace remote.yourdomain.com with your domain and admin@yourdomain.com with the e-mail address used for the ACME (Let's Encrypt) certificate. YAML is indentation sensitive, so keep the indentation exactly as shown:

   echo -n '
   version: v3
   teleport:
     nodename: "remote.yourdomain.com"
     data_dir: /var/lib/teleport
     log:
       output: stderr
       severity: INFO
   
   auth_service:
     enabled: "yes"
     listen_addr: 0.0.0.0:3025
     cluster_name: remote.yourdomain.com
     proxy_listener_mode: multiplex
     session_recording: off
   
   ssh_service:
     enabled: "no"
   
   proxy_service:
     enabled: "yes"
     web_listen_addr: 0.0.0.0:443
     public_addr: remote.yourdomain.com:443
   
     acme:
       enabled: yes
       email: admin@yourdomain.com
   
     https_keypairs: []
     https_keypairs_reload_interval: 0s
   ' > /etc/teleport.yaml

7. Start Teleport and enable it at boot:

   systemctl start teleport
   systemctl enable teleport

8. Open https://remote.yourdomain.com in a browser and make sure you see the login page.
9. Add a Teleport user and open the link in the command output:

   sudo tctl users add testuser --roles=editor,access --logins=root

10. Go to the link and set a password and 2FA for the user.
11. Click the Enroll New Resource button, choose the Ubuntu 14.04 option and copy the ID from the generated command.

    For example, https://remote.yourdomain.com/scripts/11xxxx11xx1111x1x111111x111xxx1x/install-node.sh

    

    

    

12. Use this ID as the Support Ticket ID on any Logsign instance, as described in the next section.

Configure On Logsign

Connect a Logsign instance to your Teleport server as follows. The Start and Stop actions are available only to super admin users.

1. Log in to the Logsign UI.
2. Click Settings > Maintenance > Remote Support.

   

3. Define the settings as follows:
   • Support Ticket ID: The ID you copied from Teleport.
   • Remote Server: The domain name of your Teleport server, for example remote.yourdomain.com. Enter the host name only, without a port; Logsign always connects on TCP port 443. The field is filled with remotes.logsign.com (Logsign's own remote support server) by default, so replace it with your server.
4. Click Start and enter your password in the verification window. Logsign writes the Teleport agent configuration, starts the service and shows the latest Teleport service logs in the console area below the form. A Connected message is shown when the connection succeeds, and the Status indicator turns green.

To end the remote support session, open the same page, click Stop and verify your password again.