teleport

by gravitational

19.7Kstars

2.0Kforks

232watchers

Updated about 2 months ago

About

Teleport is a unified, secure access platform that provides certificate-based authentication, access controls, and audit logging for infrastructure across SSH, Kubernetes, databases, and internal web apps.

The easiest, and most secure way to access and protect all of your infrastructure.

Primary Use Case

Teleport is designed for organizations needing secure, identity-aware access to cloud and on-premises infrastructure without managing shared secrets. It is ideal for DevOps, security teams, and system administrators who require centralized access control, session auditing, and zero trust principles across diverse environments.

Key Features

Certificate-based authentication with short-lived certificates for SSH, Kubernetes, databases, and web apps
Single sign-on (SSO) integration with GitHub, OpenID Connect, and SAML providers like Okta and Microsoft Entra ID
Mutual TLS (mTLS) endpoints to protect access to cloud and on-prem services
Role-Based Access Control (RBAC) with access request workflows enforcing least privilege
Audit logging with session recording and replay for multiple protocols
Tunneling system to access resources behind NATs and firewalls
Two-factor authentication (2FA) support for all access
Unified access proxy and certificate authority (CA) in a single Go binary

Installation

Download the Teleport binary from https://goteleport.com/download
Install Teleport as a Linux daemon following https://goteleport.com/docs/admin-guides/deploy-a-cluster/linux-demo
Alternatively, deploy Teleport on Kubernetes using Helm charts per https://goteleport.com/docs/admin-guides/deploy-a-cluster/helm-deployments
Configure Teleport with your identity provider for SSO (GitHub supported in open source)
Enroll SSH nodes, Kubernetes clusters, databases, web apps, and Windows hosts as resources
Start the Teleport service to begin managing access and auditing

Usage

>_ teleport start

Starts the Teleport daemon to run the access proxy, certificate authority, and audit log

>_ tsh login --proxy=example.com --auth=github

Authenticate to the Teleport proxy using GitHub SSO

>_ tsh ssh user@node

Connect to a remote SSH node managed by Teleport

>_ tsh db login

Authenticate and retrieve short-lived certificates for database access

>_ tsh kube login

Authenticate to Kubernetes clusters via Teleport

>_ tsh app login

Authenticate to internal web applications proxied by Teleport

>_ tsh sessions ls

List active sessions with audit logs and recordings

Security Frameworks

Initial Access

Persistence

Defense Evasion

Credential Access

Collection

Usage Insights

Integrate Teleport with SIEM tools to enhance audit log analysis and anomaly detection.
Leverage Teleport's short-lived certificates to minimize risk from credential theft during red team exercises.
Use Teleport's RBAC and access request workflows to enforce least privilege and improve compliance posture.
Automate onboarding/offboarding processes with Teleport's access controls to reduce human error.
Combine Teleport with vulnerability scanners to validate secure access post-remediation.