MFA for Administrative Actions
- Available for:
Teleport can be configured to require additional multi-factor authentication
checks to perform administrative actions through
tsh, the Web UI,
Teleport Connect, and any other Teleport client.
Examples of administrative actions include, but are not limited to:
- Resetting or recovering user accounts
- Inviting new users
- Updating cluster configuration resources
- Modifying access management resources
- Approving access requests
- Generating new join tokens
- Creating new bots for Machine ID
This is an advanced security feature that protects users against compromises of their on-disk Teleport certificates.
When MFA for administrative actions is enabled, user certificates produced
tctl auth sign will no longer be suitable for automation due to the
additional MFA checks.
We recommend using Machine ID to issue certificates for automated workflows, which uses role impersonation that is not subject to MFA checks.
Certificates produced with
tctl auth sign directly on an Auth Service
instance using the super-admin role are not subject to MFA checks to support
legacy self-hosted setups.
- To check that you can connect to your Teleport cluster, sign in with
tsh login, then verify that you can run
tctlcommands using your current credentials.
tctlis supported on macOS and Linux machines. For example:If you can connect to the cluster and run thetsh login --proxy=teleport.example.com --user=[email protected]tctl status
CA pin sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678
tctl statuscommand, you can use your current credentials to run subsequent
tctlcommands from your workstation. If you host your own Teleport cluster, you can also run
tctlcommands on the computer that hosts the Teleport Auth Service for full permissions.
- WebAuthn configured on this cluster
- Second factor hardware device, such as YubiKey or SoloKey
- A Web browser with WebAuthn support (if using SSH or desktop sessions from the Teleport Web UI).
MFA for administrative actions is automatically enforced for clusters where WebAuthn is the only form of second factor allowed.
In a future major version, Teleport may enforce MFA for administrative actions for a wider range of cluster configurations.