{"id":11870,"date":"2022-03-19T22:11:38","date_gmt":"2022-03-19T19:11:38","guid":{"rendered":"https:\/\/kifarunix.com\/?p=11870"},"modified":"2024-03-09T11:03:52","modified_gmt":"2024-03-09T08:03:52","slug":"setup-secure-ssh-access-on-linux-servers-using-teleport","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/setup-secure-ssh-access-on-linux-servers-using-teleport\/","title":{"rendered":"Setup Secure SSH Access on Linux Servers using Teleport"},"content":{"rendered":"\n<p>In this tutorial, you will learn how to setup secure SSH access on Linux servers using Teleport. In our previous guide, we learnt how to install and setup Teleport access plan on Linux, specifically Ubuntu 20.04 system.<\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/install-and-setup-teleport-access-plane-on-linux\/\" target=\"_blank\" rel=\"noreferrer noopener\">Install and Setup Teleport Access Plane on Linux<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Setup Secure SSH Access on Linux Servers using Teleport<\/h2>\n\n\n\n<p>To install Teleport;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Add Remote SSH Server to Teleport Cluster Server<\/h3>\n\n\n\n<p>There are two ways in which you can add remote ssh Linux servers into the Teleport cluster server to enable you to securely SSH into them:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><a href=\"#add-automatically\">Automatically add SSH servers into Teleport Cluster Server<\/a><\/li>\n\n\n\n<li><a href=\"#add-manually\">Manually add SSH servers into Teleport Cluster Server<\/a><\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"add-automatically\">Automatically add SSH servers into Teleport Cluster Server<\/h4>\n\n\n\n<p>On the Teleport server, you can generate a script that can be executed on an SSH server you want to add to Teleport server.<\/p>\n\n\n\n<p>The script will automatically install Teleport client and automatically enrolls the remote SSH server into the Teleport server.<\/p>\n\n\n\n<p>To get the script, login to Teleport server web interface and click <strong>Add Server<\/strong> under the servers menu tab.<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-add-server.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1894\" height=\"507\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-add-server.png\" alt=\"Setup Secure SSH Access on Linux Servers using Teleport\" class=\"wp-image-11879\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-add-server.png?v=1647716662 1894w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-add-server-768x206.png?v=1647716662 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-add-server-1536x411.png?v=1647716662 1536w\" sizes=\"(max-width: 1894px) 100vw, 1894px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>You will then see such a wizard with a script that is valid for 4 hours generated.<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-add-server-script.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1909\" height=\"736\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-add-server-script.png\" alt=\"Setup Secure SSH Access on Linux Servers using Teleport\" class=\"wp-image-11880\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-add-server-script.png?v=1647716751 1909w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-add-server-script-768x296.png?v=1647716751 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-add-server-script-1536x592.png?v=1647716751 1536w\" sizes=\"(max-width: 1909px) 100vw, 1909px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>Copy the script and execute on the remote host to add to the Teleport cluster Server.<\/p>\n\n\n\n<p>Ensure that you can connect to Teleport server remotely.<\/p>\n\n\n\n<p>For example, on my remote Ubuntu server, check connection to Teleport server port;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nc -vz teleport.kifarunix-demo.com 443<\/code><\/pre>\n\n\n\n<p>Sample command output;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Connection to teleport.kifarunix-demo.com 443 port &#91;tcp\/*] succeeded!<\/code><\/pre>\n\n\n\n<p>Next, execute the command generated on the Teleport server on the host to add it to the server;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo bash -c \"$(curl -fsSL https:\/\/teleport.kifarunix-demo.com\/scripts\/4c4562439fe63111bf439011960aaa3d\/install-node.sh)\"<\/code><\/pre>\n\n\n\n<p>If you are using Self-signed SSL certs, be sure to disable certificate peer verify by adding option <strong><code>-k\/--insecure<\/code><\/strong> to curl command.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo bash -c \"$(curl -kfsSL https:\/\/teleport.kifarunix-demo.com\/scripts\/4c4562439fe63111bf439011960aaa3d\/install-node.sh)\"<\/code><\/pre>\n\n\n\n<p>When you run the script, this is the sample output;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\n2022-03-19 20:30:03 CET [teleport-installer] TELEPORT_VERSION: 9.0.1\n2022-03-19 20:30:03 CET [teleport-installer] TARGET_HOSTNAME: teleport.kifarunix-demo.com\n2022-03-19 20:30:03 CET [teleport-installer] TARGET_PORT: 443\n2022-03-19 20:30:03 CET [teleport-installer] JOIN_TOKEN: 86fe4487700dd68963947575a0ab1061\n2022-03-19 20:30:03 CET [teleport-installer] CA_PIN_HASHES: sha256:d16c9ee6fd3188787d04b80905a5607ac0c38f7d6c12f3a29bd9962762914065\n2022-03-19 20:30:03 CET [teleport-installer] Checking TCP connectivity to Teleport server (teleport.kifarunix-demo.com:443)\n2022-03-19 20:30:03 CET [teleport-installer] Connectivity to Teleport server (via nc) looks good\n2022-03-19 20:30:03 CET [teleport-installer] Detected host: linux-gnu, using Teleport binary type linux\n2022-03-19 20:30:03 CET [teleport-installer] Detected arch: x86_64, using Teleport arch amd64\n2022-03-19 20:30:03 CET [teleport-installer] Detected distro type: debian\n2022-03-19 20:30:03 CET [teleport-installer] Using Teleport distribution: deb\n2022-03-19 20:30:03 CET [teleport-installer] CrCETed temp dir \/tmp\/teleport-v4FsTm6AhJ\n2022-03-19 20:30:03 CET [teleport-installer] Downloading Teleport deb release 9.0.1\n2022-03-19 20:30:03 CET [teleport-installer] Running curl -fsSL --retry 5 --retry-delay 5 https:\/\/get.gravitational.com\/teleport_9.0.1_amd64.deb\n2022-03-19 20:30:03 CET [teleport-installer] Downloading to \/tmp\/teleport-v4FsTm6AhJ\/teleport_9.0.1_amd64.deb\n2022-03-19 20:31:00 CET [teleport-installer] Downloaded file size: 92653228 bytes\n2022-03-19 20:31:00 CET [teleport-installer] Will use shasum -a 256 to validate the checksum of the downloaded file\n2022-03-19 20:31:02 CET [teleport-installer] The downloaded file's checksum validated correctly\n2022-03-19 20:31:02 CET [teleport-installer] Using dpkg to install \/tmp\/teleport-v4FsTm6AhJ\/teleport_9.0.1_amd64.deb\nSelecting previously unselected package teleport.\n(Reading database ... 104426 files and directories currently installed.)\nPreparing to unpack ...\/teleport_9.0.1_amd64.deb ...\nUnpacking teleport (9.0.1) ...\nSetting up teleport (9.0.1) ...\n2022-03-19 20:31:20 CET [teleport-installer] Found: Teleport v9.0.1 git:v9.0.1-0-g7bbe6f15c go1.17.7\n2022-03-19 20:31:20 CET [teleport-installer] Writing Teleport node service config to \/etc\/teleport.yaml\n2022-03-19 20:31:20 CET [teleport-installer] Host is using systemd\n2022-03-19 20:31:20 CET [teleport-installer] Starting Teleport via systemd. It will automatically be started whenever the system reboots.\n\nTeleport has been started.\n\nView its status with 'sudo systemctl status teleport.service'\nView Teleport logs using 'sudo journalctl -u teleport.service'\nTo stop Teleport, run 'sudo systemctl stop teleport.service'\nTo start Teleport again if you stop it, run 'sudo systemctl start teleport.service'\n\nYou can see this node connected in the Teleport web UI or 'tsh ls' with the name 'cms.kifarunix-demo.com'\nFind more details on how to use Teleport here: https:\/\/goteleport.com\/docs\/user-manual\/\n<\/code><\/pre>\n\n\n\n<p>If you are using self-signed SSL\/TLS certs, be sure to update the Teleport service unit file to disable peer certificate verification when running Teleport service.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sed -i 's\/start\/start --insecure\/' \/lib\/systemd\/system\/teleport.service<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl daemon-reload<\/code><\/pre>\n\n\n\n<p>Restart the Teleport agent;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl restart teleport.service<\/code><\/pre>\n\n\n\n<p>Check the status;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl status teleport.service<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\n\u25cf teleport.service - Teleport SSH Service\n   Loaded: loaded (\/lib\/systemd\/system\/teleport.service; enabled; vendor preset: enabled)\n   Active: active (running) since Sat 2022-03-19 20:40:36 EAT; 2s ago\n Main PID: 2599 (teleport)\n    Tasks: 9 (limit: 2317)\n   CGroup: \/system.slice\/teleport.service\n           \u2514\u25002599 \/usr\/local\/bin\/teleport start --insecure --pid-file=\/run\/teleport.pid\n\nMar 19 20:40:36 cms.kifarunix-demo.com teleport[2599]: 2022-03-19T20:40:36+03:00 INFO [AUDIT:1]   Creating directory \/var\/lib\/teleport\/log\/upload. service\/service.go:2115\nMar 19 20:40:36 cms.kifarunix-demo.com teleport[2599]: 2022-03-19T20:40:36+03:00 INFO [AUDIT:1]   Creating directory \/var\/lib\/teleport\/log\/upload\/sessions. service\/service.\nMar 19 20:40:36 cms.kifarunix-demo.com teleport[2599]: 2022-03-19T20:40:36+03:00 INFO [AUDIT:1]   Creating directory \/var\/lib\/teleport\/log\/upload\/sessions\/default. service\/\nMar 19 20:40:36 cms.kifarunix-demo.com teleport[2599]: 2022-03-19T20:40:36+03:00 INFO [AUDIT:1]   Creating directory \/var\/lib\/teleport\/log. service\/service.go:2115\nMar 19 20:40:36 cms.kifarunix-demo.com teleport[2599]: 2022-03-19T20:40:36+03:00 INFO [AUDIT:1]   Creating directory \/var\/lib\/teleport\/log\/upload. service\/service.go:2115\nMar 19 20:40:36 cms.kifarunix-demo.com teleport[2599]: 2022-03-19T20:40:36+03:00 INFO [AUDIT:1]   Creating directory \/var\/lib\/teleport\/log\/upload\/streaming. service\/service\nMar 19 20:40:36 cms.kifarunix-demo.com teleport[2599]: 2022-03-19T20:40:36+03:00 INFO [AUDIT:1]   Creating directory \/var\/lib\/teleport\/log\/upload\/streaming\/default. service\nMar 19 20:40:36 cms.kifarunix-demo.com teleport[2599]: 2022-03-19T20:40:36+03:00 INFO [NODE:1]    Service is starting in tunnel mode. service\/service.go:2025\nMar 19 20:40:36 cms.kifarunix-demo.com teleport[2599]: 2022-03-19T20:40:36+03:00 INFO [PROC:1]    The new service has started successfully. Starting syncing rotation status\nMar 19 20:40:36 cms.kifarunix-demo.com teleport[2599]: 2022-03-19T20:40:36+03:00 [NODE:PROX] INFO Connected. addr:192.168.100.131:60784 remote-addr:192.168.100.129:443 leas...\n<\/code><\/pre>\n\n\n\n<p>Your remote server should now be available under servers tab on Teleport server.<\/p>\n\n\n\n<p>Note that if you had created Teleport user with no defined usernames that they can use to login to remote servers (<code><strong>tctl users add --roles=editor,access kifarunix-admin<\/strong><\/code>), the servers wont show up on the servers tab.<\/p>\n\n\n\n<p>Hence, navigate to <strong>Team &gt; Roles<\/strong>. Under <strong>access<\/strong> role, click <strong>OPTIONS<\/strong> and <strong>edit<\/strong> the role.<\/p>\n\n\n\n<p>Under the <strong>logins<\/strong> option, you need to define all the users that the user can use to login to remote systems with. See screenshot below.<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/update-user-logins.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1640\" height=\"786\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/update-user-logins.png\" alt=\"Setup Secure SSH Access on Linux Servers using Teleport\" class=\"wp-image-11881\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/update-user-logins.png?v=1647716790 1640w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/update-user-logins-768x368.png?v=1647716790 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/update-user-logins-1536x736.png?v=1647716790 1536w\" sizes=\"(max-width: 1640px) 100vw, 1640px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>Save the changes when done. Refresh the servers tab again.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"add-manually\">Manually add SSH servers into Teleport Cluster Server<\/h4>\n\n\n\n<p>On the remote Linux nodes you want to secure SSH to, login and install Teleport.<\/p>\n\n\n\n<p>In this example setup, we have two remote Linux systems for demo. One is an Ubuntu system and the other is Rocky Linux system.<\/p>\n\n\n\n<p>To install Teleport on an Ubuntu\/Debian systems;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Install Teleport Repositories<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>wget -qO- https:\/\/deb.releases.teleport.dev\/teleport-pubkey.asc \\\n| gpg --dearmor &gt; \/etc\/apt\/trusted.gpg.d\/teleport.gpg<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>echo \"deb https:\/\/deb.releases.teleport.dev\/ stable main\" &gt; \/etc\/apt\/sources.list.d\/teleport.list<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Run system package cache and install Teleport on Ubuntu\/Debian systems<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>apt update<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>apt install teleport<\/code><\/pre>\n\n\n\n<p>To install Teleport on an RHEL systems;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Install Teleport on Rocky Linux\/CentOS<\/li>\n<\/ul>\n\n\n\n<p>On Rocky Linux and newer distros;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>dnf config-manager --add-repo https:\/\/rpm.releases.teleport.dev\/teleport.repo<\/code><\/pre>\n\n\n\n<p>On CentOS 7 or other older distros;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>yum-config-manager --add-repo https:\/\/rpm.releases.teleport.dev\/teleport.repo<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Install Teleport on Rocky Linux\/CentOS systems;<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>yum install teleport<\/code><\/pre>\n\n\n\n<p>Next, on the main Teleport Cluster Web interface, navigate to Server menu  &gt; click add server &gt; <strong>manually<\/strong> and copy the generated teleport start command.<\/p>\n\n\n\n<p>Execute the command on the remote SSH nodes you want to securely connect to Teleport Server.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>teleport start --roles=node --token=1c6c4165d4e3667704cacf79844cc24b --auth-server=teleport.kifarunix-demo.com:443 <\/code><\/pre>\n\n\n\n<p>If you are using self signed ssl certs, be sure to use <strong><code>--insecure<\/code><\/strong> option.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>teleport start --insecure --roles=node --token=1c6c4165d4e3667704cacf79844cc24b --auth-server=teleport.kifarunix-demo.com:443 <\/code><\/pre>\n\n\n\n<p>When executed, sample output;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\nINFO [PROC:1]    Joining the cluster with a secure token. service\/connect.go:382\nWARNING: You are using insecure connection to SSH proxy https:\/\/teleport.kifarunix-demo.com:443\nINFO [PROC:1]    Node has obtained credentials to connect to the cluster. service\/connect.go:416\nINFO [PROC:1]    The process successfully wrote the credentials and state of Node to the disk. service\/connect.go:457\nINFO [PROC:1]    Node: features loaded from auth server: Kubernetes:true App:true DB:true Desktop:true  service\/connect.go:71\nINFO [AUDIT:1]   Creating directory \/var\/lib\/teleport\/log. service\/service.go:2115\nINFO [AUDIT:1]   Creating directory \/var\/lib\/teleport\/log\/upload. service\/service.go:2115\nINFO [AUDIT:1]   Creating directory \/var\/lib\/teleport\/log\/upload\/sessions. service\/service.go:2115\nINFO [AUDIT:1]   Creating directory \/var\/lib\/teleport\/log\/upload\/sessions\/default. service\/service.go:2115\nINFO [AUDIT:1]   Creating directory \/var\/lib\/teleport\/log. service\/service.go:2115\nINFO [AUDIT:1]   Creating directory \/var\/lib\/teleport\/log\/upload. service\/service.go:2115\nINFO [AUDIT:1]   Creating directory \/var\/lib\/teleport\/log\/upload\/streaming. service\/service.go:2115\nINFO [AUDIT:1]   Creating directory \/var\/lib\/teleport\/log\/upload\/streaming\/default. service\/service.go:2115\nINFO [NODE:1]    Service is starting in tunnel mode. service\/service.go:2025\nINFO [PROC:1]    The new service has started successfully. Starting syncing rotation status with period 10m0s. service\/connect.go:469\n<\/code><\/pre>\n\n\n\n<p>The remote server should now show up on Teleport server servers tab.<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-agents.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1906\" height=\"618\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-agents.png\" alt=\"Setup Secure SSH Access on Linux Servers using Teleport\" class=\"wp-image-11882\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-agents.png?v=1647716842 1906w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-agents-768x249.png?v=1647716842 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-agents-1536x498.png?v=1647716842 1536w\" sizes=\"(max-width: 1906px) 100vw, 1906px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>To run the Teleport agent as a service, press ctrl+c to stop the start command above.<\/p>\n\n\n\n<p>Next, create Teleport configuration file by running the command below and updating the <strong>token<\/strong> and <strong>nodename<\/strong> values accordingly.<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\ncat > \/etc\/teleport.yaml &lt;&lt; 'EOL'\nteleport:\n  nodename: rocky8\n  auth_token: 1c6c4165d4e3667704cacf79844cc24b\n  auth_servers:\n  - teleport.kifarunix-demo.com:443\n  log:\n    output: stderr\n    severity: INFO\nauth_service:\n  enabled: no\nssh_service:\n  enabled: yes\nproxy_service:\n  enabled: no\nEOL\n<\/code><\/pre>\n\n\n\n<p>Create Teleport agent systemd service unit file if not already existing;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\ncat > \/lib\/systemd\/system\/teleport.service << 'EOL'\n[Unit]\nDescription=Teleport SSH Service\nAfter=network.target\n\n[Service]\nType=simple\nRestart=on-failure\nEnvironmentFile=-\/etc\/default\/teleport\nExecStart=\/usr\/local\/bin\/teleport start --pid-file=\/run\/teleport.pid\nExecReload=\/bin\/kill -HUP $MAINPID\nPIDFile=\/run\/teleport.pid\nLimitNOFILE=8192\n\n[Install]\nWantedBy=multi-user.target\nEOL\n<\/code><\/pre>\n\n\n\n<p>If using self-signed TLS certs, update the service file by executing the command below;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sed -i 's\/start\/start --insecure\/' \/lib\/systemd\/system\/teleport.service<\/code><\/pre>\n\n\n\n<p>Reload systemd unit files and start and enable Teleport to run on boot;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl daemon-reload\nsystemctl enable --now teleport<\/code><\/pre>\n\n\n\n<p>You can also add the nodes manually from command line;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tctl nodes add --ttl=120m --roles=node<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">SSH to Remote Linux Servers using Teleport<\/h3>\n\n\n\n<p>Now that you have the remote servers added to the Teleport, you can securely SSH into them using the accounts assigned to the user you are logged into Teleport Server as.<\/p>\n\n\n\n<p>You can secure SSH into remote hosts from UI or from the command line;<\/p>\n\n\n\n<p>To login to remote system from Teleport server UI;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>click <strong>Servers<\/strong> menu tab and select server from the list.<\/li>\n\n\n\n<li>Click drop-down button on <strong>CONNECT<\/strong> and choose a user to login as.<\/li>\n\n\n\n<li>Example login interface to a remote system as user gentoo.<\/li>\n<\/ul>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-remote-ssh.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1322\" height=\"378\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-remote-ssh.png\" alt=\"\" class=\"wp-image-11883\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-remote-ssh.png?v=1647716889 1322w, https:\/\/kifarunix.com\/wp-content\/uploads\/2022\/03\/teleport-remote-ssh-768x220.png?v=1647716889 768w\" sizes=\"(max-width: 1322px) 100vw, 1322px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>To login to remote system from Teleport server command line;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Login to Teleport server on command line. Replace the proxy node and the user accordingly.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>tsh login --proxy=teleport.kifarunix-demo.com:443 --auth=local --user=kifarunix-admin<\/code><\/pre>\n\n\n\n<p>Sample output;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\nEnter password for Teleport user kifarunix-admin:\nEnter your OTP token:\n690485\nWARNING: You are using insecure connection to SSH proxy https:\/\/teleport.kifarunix-demo.com:443\n> Profile URL:        https:\/\/teleport.kifarunix-demo.com:443\n  Logged in as:       kifarunix-admin\n  Cluster:            kifarunix-demo.com\n  Roles:              access, editor\n  Logins:             root, kifarunix, gentoo\n  Kubernetes:         enabled\n  Valid until:        2022-03-20 06:49:39 +0000 UTC [valid for 12h0m0s]\n  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You can list the available servers using <code><strong>tsh ls<\/strong><\/code> command.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>tsh ls<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\nNode Name                   Address        Labels                                           \n--------------------------- -------------- ------------------------------------------------ \ncms.kifarunix-demo.com      \u27f5 Tunnel                                                        \nrocky8                      \u27f5 Tunnel                                                        \nteleport.kifarunix-demo.com 127.0.0.1:3022 env=example,hostname=teleport.kifarunix-demo.com\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Next, login to remote server<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>tsh ssh kifarunix@rocky8<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\n[kifarunix@rocky8 ~]$ pwd\n\/home\/kifarunix\n[kifarunix@rocky8 ~]$ whoami\nkifarunix\n[kifarunix@rocky8 ~]$ id\nuid=1000(kifarunix) gid=1000(kifarunix) groups=1000(kifarunix),10(wheel) context=system_u:system_r:unconfined_service_t:s0\n[kifarunix@rocky8 ~]$ \n<\/code><\/pre>\n\n\n\n<p>And that is all on how to secure SSH access on Linux servers using Teleport.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Reference<\/h3>\n\n\n\n<p><a href=\"https:\/\/goteleport.com\/docs\/server-access\/getting-started\/\" target=\"_blank\" rel=\"noreferrer noopener\">Getting Started with Teleport Server Access<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Other Tutorials<\/h2>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/monitor-process-creation-events-on-windows-systems-using-wazuh-and-elk-stack\/\" target=\"_blank\" rel=\"noreferrer noopener\">Monitor Process Creation Events on Windows Systems using Wazuh and ELK stack<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/how-to-enable-openldap-audit-logging\/\" target=\"_blank\" rel=\"noreferrer noopener\">How to Enable OpenLDAP Audit Logging<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this tutorial, you will learn how to setup secure SSH access on Linux servers using Teleport. In our previous guide, we learnt how to<\/p>\n","protected":false},"author":1,"featured_media":11869,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[121,34,362],"tags":[4715,4713,4711,4714,4712],"class_list":["post-11870","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-howtos","category-security","category-ssh","tag-install-and-configure-teleport","tag-install-teleport-in-linux","tag-setup-secure-ssh-access-using-teleport","tag-setup-teleport-in-linux","tag-teleport-secure-ssh-access-linux","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/11870"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=11870"}],"version-history":[{"count":5,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/11870\/revisions"}],"predecessor-version":[{"id":20439,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/11870\/revisions\/20439"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/11869"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=11870"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=11870"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=11870"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}