In today’s digital landscape, secure and efficient access to global infrastructure is essential for businesses. Teleport, an open-source access plane, offers a zero-trust approach to accessing various services such as servers, Kubernetes clusters, and DevOps applications. With features like synchronized access across your infrastructure and public auditing, Teleport has gained popularity among prominent companies like Samsung and NASDAQ.

This comprehensive guide will walk you through the process of installing and configuring Teleport on a Debian 11 server. You’ll learn how to set up a secure Teleport Cluster, create a Teleport user, and add nodes to the cluster using different methods. By the end of this guide, you’ll have a fully functional Teleport Cluster on your Debian 11 server.

Prerequisites

Before you begin the installation process, make sure you have the following prerequisites:

• A Debian 11 server (e.g., ‘teleport-server’) with an assigned IP address (e.g., ‘192.168.5.100’).
• A non-root user with sudo/root administrator privileges.
• A domain name pointing to your server’s IP address.
• SSL certificates generated for your domain name.
• Two-Factor Authentication apps installed on your devices.
• Additional nodes/servers to be added to the Teleport Cluster.

Installing Teleport on Debian Server

To install Teleport on your Debian server, follow these steps:

Step 1: Install Basic Dependencies

First, install the basic dependencies for managing repositories by running the following command:

sudo apt install curl wget apt-transport-https gnupg2

Step 2: Add Teleport Repository

Next, add the Teleport repository to your Debian server by executing the following commands:

source /etc/os-release
sudo curl https://apt.releases.teleport.dev/gpg -o /usr/share/keyrings/teleport-archive-keyring.asc
echo "deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} stable/v11" | \
sudo tee /etc/apt/sources.list.d/teleport.list > /dev/null

Step 3: Update Package Manager Cache

After adding the Teleport repository, update your package manager cache with the following command:

sudo apt update

Step 4: Install Teleport

Finally, install Teleport on your Debian server by running the following command:

sudo apt install teleport

Once the installation is complete, you can proceed to the next step of configuring Teleport.

Configuring Teleport Server

Now that Teleport is installed on your Debian server, it’s time to configure the Teleport server itself. This involves initializing the Teleport installation, enabling the web application dashboard, and starting the Teleport service. Follow these steps to configure Teleport:

Step 1: Initialize Teleport Configuration

To initialize the Teleport server configuration, run the following command:

sudo teleport configure -o file \
--cluster-name=tele.example.io \
--public-addr=tele.example.io:443 \
--cert-file=/etc/letsencrypt/live/tele.example.io/fullchain.pem \
--key-file=/etc/letsencrypt/live/tele.example.io/privkey.pem

Make sure to replace ‘tele.example.io’ with your domain name and adjust the paths to your SSL certificates.

Step 2: Enable Teleport Web Service

Next, open the Teleport configuration file using the nano editor:

sudo nano /etc/teleport.yaml

Add the following lines at the end of the file to enable the Teleport web service:

app_service:
enabled: yes
apps:
- name: "teleport-webapp"
uri: "http://localhost:9000"
public_addr: "tele.example.io"

Save the file and exit the editor.

Step 3: Start and Enable Teleport Service

Start the Teleport service by running the following command:

sudo systemctl start teleport

Enable the Teleport service to start automatically on boot:

sudo systemctl enable teleport

Verify the status of the Teleport service with the following command:

sudo systemctl status teleport

If the service is running and enabled, you should see a “running” status.

Step 4: Access Teleport Web Service

To verify that the Teleport web service is enabled, open your web browser and visit your Teleport installation’s domain name (e.g.,https://tele.example.io/). You should see the Teleport web service login page.

Setting up Teleport User

With the Teleport server and web service running, the next step is to create a Teleport user. This user will have the ability to manage the Teleport Cluster via command lines or the web administration dashboard. Follow these steps to set up a Teleport user:

Step 1: Install Two-Factor Authentication App

Before creating a Teleport user, make sure you have a Two-Factor Authentication app installed on your device. You can use apps like Aegis, Google Authenticator, or KeepassXC with a 2FA plugin.

Step 2: Create Teleport User

On the ‘teleport-server’ machine, run the following command to create a new Teleport user:

sudo tctl users add teleport-admin --roles=editor,access --logins=root,debian,ec2-user

This command creates a new user named ‘teleport-admin’ with editor and access roles. The ‘–logins’ flag allows the ‘teleport-admin’ user to log in to any nodes via the specified usernames.

Step 3: Set up Two-Factor Authentication

Copy the generated link from the command output and paste it into your web browser. You should see a welcome message for setting up the new Teleport user. Click the “GET STARTED” button to continue.

Enter a username for your Teleport user, set a strong password, and click “NEXT”.

Set up Two-Factor Authentication by scanning the QR code with your 2FA app. Enter the generated authentication code and click “SUBMIT”.

If the 2FA code is correct, you should see a “Registration Successful” message. Click “GO TO DASHBOARD”.

You should now have access to the Teleport web administration dashboard, where you can manage your Teleport Cluster.

Managing Teleport Cluster via Command Line

Teleport provides two command-line tools, tsh and tctl, for managing the Teleport Cluster. The tsh command allows you to authenticate and manage the cluster from the terminal, while the tctl command is used to configure the Teleport Auth Service. Let’s explore how to use these command-line tools:

Authenticating with tsh

To authenticate with the Teleport Cluster using tsh, follow these steps:

1. Log in to your Teleport Cluster as a non-root user (e.g., ‘debian’):

su - debian

2. Authenticate to the Teleport Cluster with the following command:

tsh login --proxy=tele.example.io --user=teleport-admin

Replace ‘tele.example.io’ with your domain name and ‘teleport-admin’ with your Teleport username. Enter your password and the OTP authentication code when prompted.

3. Once you’re successfully authenticated, you can check the connection status with the following command:

tsh status

Managing Resources with tsh

With tsh, you can manage various resources in the Teleport Cluster. Here are a few useful commands:

• List available hosts/nodes/servers:

tsh ls

• List enabled applications:

tsh apps ls

• Log in to a specific node/server:

tsh ssh root@teleport-server

Replace ‘teleport-server’ with the desired node/server and ‘root’ with the desired username.

Configuring the Teleport Auth Service with tctl

To configure the Teleport Auth Service using tctl, follow these steps:

1. Run the following command with sudo or root privileges:

sudo tctl nodes ls

This command lists the available nodes/servers in the Teleport Cluster.

2. Use the following command to add a new token for a node to join the cluster:

sudo tctl nodes add --ttl=30m --roles=node | grep "invite token:" | grep -Eo "[0-9a-z]{32}"

This command generates a new token that the node (e.g., ‘client2’) will use to join the Teleport Cluster. Make sure to copy the generated token.

3. Connect to the ‘client2’ machine and install the Teleport package via APT.
4. Add the Teleport repository to the ‘client2’ machine and install Teleport using the following commands:

source /etc/os-release
sudo curl https://apt.releases.teleport.dev/gpg -o /usr/share/keyrings/teleport-archive-keyring.asc
echo "deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} stable/v11" | \
sudo tee /etc/apt/sources.list.d/teleport.list > /dev/null
sudo apt update
sudo apt install teleport

5. Create a new Teleport configuration file ‘/etc/teleport.yaml’ using the following command:

sudo nano /etc/teleport.yaml

6. Add the Teleport configurations to the file, replacing the necessary values:

version: v3
teleport:
nodename: client2
data_dir: /var/lib/teleport
join_params:
token_name: <generated_token>
method: token
proxy_server: tele.example.io:443
log:
output: stderr
severity: INFO
format:
output: text
ca_pin: <CA_pin_fingerprint>
diag_addr: ""
auth_service:
enabled: "no"
ssh_service:
enabled: "yes"
commands:
- name: hostname
command: [hostname]
period: 1m0s
proxy_service:
enabled: "no"
https_keypairs: []
acme: {}

Replace ” with the token you copied earlier and ” with the CA pin fingerprint of your Teleport Cluster.

7. Save the file and exit the editor.
8. Start and enable the Teleport service on the ‘client2’ machine:

sudo systemctl start teleport
sudo systemctl enable teleport

9. Verify the Teleport service status:

sudo systemctl status teleport

10. Back on the ‘teleport-server’, use the following command to verify the list of available nodes/servers:

sudo tctl nodes ls

Accessing Nodes via Teleport

To access the nodes/servers in your Teleport Cluster via the Teleport web administration dashboard, follow these steps:

1. Login to the Teleport web administration dashboard and select the user you want to use for logging in to a node.
2. Click the “TEST SERVER” button to check the connection to the node. Ensure that all tests are marked as complete.
3. Click the “START SESSION” button to open a new tab and access the node via the selected user.

Adding Nodes to the Teleport Cluster

To add nodes/servers to your Teleport Cluster, you can choose between two methods: using the installer script generated from the web administration dashboard or manually adding nodes via the command line.

Method 1: Adding Nodes via Installer Script

1. From the Teleport web administration dashboard, click the “ADD SERVER” button.
2. Select the resource type you want to add (e.g., SERVERS) and click “NEXT”.
3. Copy the generated installer script and command line.
4. Log in to the target machine (e.g., ‘client1’), access root privileges, and run the generated command line. This will download the installer script and automatically add the machine to the Teleport Cluster.
5. Follow the instructions in the installer script output to complete the installation.
6. Back in the Teleport web administration dashboard, click “NEXT” and specify the usernames allowed to access the added machine.
7. Verify the connection to the added machine by selecting the user and clicking the “TEST SERVER” button.
8. To start a session on the added machine, click the “START SESSION” button.

Method 2: Adding Nodes Manually

1. On the ‘teleport-server’, run the following command to obtain the CA pin fingerprint of your Teleport Cluster:

sudo tctl status

2. Copy the CA pin fingerprint.
3. Generate a new token for the node to join the Teleport Cluster by running the following command:

sudo tctl nodes add --ttl=30m --roles=node | grep "invite token:" | grep -Eo "[0-9a-z]{32}"

4. Connect to the target machine (e.g., ‘client2’) and install the Teleport package.
5. Add the Teleport repository and install Teleport on the target machine using the provided commands.
6. Create a Teleport configuration file ‘/etc/teleport.yaml’ and add the necessary configurations, replacing the values with the appropriate ones.
7. Save the file and start the Teleport service on the target machine.
8. Back on the ‘teleport-server’, use the following command to verify the list of available nodes/servers:

sudo tctl nodes ls

9. Access the target machine via Teleport SSH by running the following command:

tsh ssh debian@client2

Replace ‘debian’ with the desired username and ‘client2’ with the target machine’s name.

Conclusion

Congratulations! You have successfully installed and configured a Teleport Cluster on your Debian 11 server. By following the steps outlined in this guide, you have set up a secure access plane for your infrastructure, allowing for efficient and controlled access to your servers, Kubernetes clusters, and other resources.

With Teleport, you can eliminate the need for VPNs and enjoy the benefits of zero-trust access. The Teleport web administration dashboard and command-line tools (tsh and tctl) provide powerful management capabilities, allowing you to add nodes, configure users, and access your infrastructure securely.

If you’re looking for a reliable cloud hosting solution, Shape.host offers Cloud VPS services that can meet your needs. With Shape.host, you can benefit from secure and scalable hosting solutions that ensure the availability and performance of your applications.