Teleport

Getting Started with Teleport Application Access

Improve

Getting started with Teleport Application Access

Length: 08:20

Getting Started

Let's connect to Grafana using Teleport Application Access in three steps:

Launch Grafana in a Docker container.
Install the Teleport Application Service on a node and configure it to proxy Grafana.
Access Grafana through Teleport.

Prerequisites

A running Teleport cluster. For details on how to set this up, see one of our Getting Started guides.
The tctl admin tool and tsh client tool version >= 9.3.7.
```
tctl version
Teleport v9.3.7 go1.17
tsh version
Teleport v9.3.7 go1.17
```
See Installation for details.

A running Teleport cluster. For details on how to set this up, see our Enterprise Getting Started guide.
The tctl admin tool and tsh client tool version >= 9.3.7, which you can download by visiting the customer portal.
```
tctl version
Teleport v9.3.7 go1.17
tsh version
Teleport v9.3.7 go1.17
```

A Teleport Cloud account. If you do not have one, visit the sign up page to begin your free trial.
The tctl admin tool and tsh client tool version >= 9.3.8. To download these tools, visit the Downloads page.
```
tctl version
Teleport v9.3.8 go1.17
tsh version
Teleport v9.3.8 go1.17
```

To connect to Teleport, log in to your cluster using tsh, then use tctl remotely:

tsh login --proxy=teleport.example.com [email protected]
tctl status
Cluster  teleport.example.com
Version  9.3.7
CA pin   sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678

You can run subsequent tctl commands in this guide on your local machine.

For full privileges, you can also run tctl commands on your Auth Service host.

To connect to Teleport, log in to your cluster using tsh, then use tctl remotely:

tsh login --proxy=myinstance.teleport.sh [email protected]
tctl status
Cluster  myinstance.teleport.sh
Version  9.3.8
CA pin   sha256:sha-hash-here

You must run subsequent tctl commands in this guide on your local machine.

A Docker installation, which we will use to launch Grafana in a container. Alternatively, if you have another web application you'd like to protect with Application Access, you can use that instead.
A host where you will run the Teleport Application Service.

Not yet a Teleport user?

If you have not yet deployed the Auth Service and Proxy Service, you should follow one of our getting started guides or try our Teleport Application Access interactive learning track.

We will assume your Teleport cluster is accessible at teleport.example.com and *.teleport.example.com. You can substitute the address of your Teleport Proxy Service. (For Teleport Cloud customers, this will be similar to mytenant.teleport.sh.)

Application Access and DNS

Teleport assigns a subdomain to each application you have configured for Application Access (e.g., grafana.teleport.example.com), so you will need to ensure that a DNS A record exists for each application-specific subdomain so clients can access your applications via Teleport.

You should create either a separate DNS A record for each subdomain or a single record with a wildcard subdomain such as *.teleport.example.com. This way, your certificate authority (e.g., Let's Encrypt) can issue a certificate for each subdomain, enabling clients to verify your Teleport hosts regardless of the application they are accessing.

Step 1/3. Start Grafana

We've picked Grafana for this tutorial since it's very easy to run with zero configuration required. If you have another web application you'd like to expose, skip over to Step 2.

Grafana can be launched in a Docker container with a single command:

docker run -d -p 3000:3000 grafana/grafana

Step 2/3. Install and configure Teleport

When running Teleport in production, we recommend that you follow the practices below to avoid security incidents. These practices may differ from the examples used in this guide, which are intended for demo environments:

Avoid using sudo in production environments unless it's necessary.
Create new, non-root, users and use test instances for experimenting with Teleport.
Run Teleport's services as a non-root user unless required. Only the SSH Service requires root access. Note that you will need root permissions (or the CAP_NET_BIND_SERVICE capability) to make Teleport listen on a port numbered < 1024 (e.g. 443).
Follow the "Principle of Least Privilege" (PoLP). Don't give users permissive roles when giving them more restrictive roles will do instead. For example, assign users the built-in access,editor roles.
When joining a Teleport agent to a cluster, save the invitation token to a file. Otherwise, the token will be visible when examining the teleport command that started the agent, e.g., via the history command on a compromised system.

On your Application Service host, download the latest version of Teleport for your platform from our downloads page.

Generate a token

A join token is required to authorize a Teleport Application Service agent to join the cluster. Generate a short-lived join token and save it, for example, in /tmp/token on your Teleport Application Service host:

tctl tokens add \    --type=app \    --app-name=grafana \    --app-uri=http://localhost:3000

Start Teleport

Install Teleport on the host where you will run the Teleport Application Service. See our Installation page for options besides Linux servers.

Download Teleport's PGP public key
sudo curl https://deb.releases.teleport.dev/teleport-pubkey.asc \  -o /usr/share/keyrings/teleport-archive-keyring.asc
Add the Teleport APT repository
echo "deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] https://deb.releases.teleport.dev/ stable main" \| sudo tee /etc/apt/sources.list.d/teleport.list > /dev/null
sudo apt-get update
sudo apt-get install teleport

sudo yum-config-manager --add-repo https://rpm.releases.teleport.dev/teleport.repo
sudo yum install teleport
Optional:  Using DNF on newer distributions
$ sudo dnf config-manager --add-repo https://rpm.releases.teleport.dev/teleport.repo
$ sudo dnf install teleport

curl https://get.gravitational.com/teleport-v9.3.7-linux-amd64-bin.tar.gz.sha256
<checksum> <filename>
curl -O https://get.gravitational.com/teleport-v9.3.7-linux-amd64-bin.tar.gz
shasum -a 256 teleport-v9.3.7-linux-amd64-bin.tar.gz
Verify that the checksums match
tar -xzf teleport-v9.3.7-linux-amd64-bin.tar.gz
cd teleport
sudo ./install

curl https://get.gravitational.com/teleport-v9.3.7-linux-arm-bin.tar.gz.sha256
<checksum> <filename>
curl -O https://get.gravitational.com/teleport-v9.3.7-linux-arm-bin.tar.gz
shasum -a 256 teleport-v9.3.7-linux-arm-bin.tar.gz
Verify that the checksums match
tar -xzf teleport-v9.3.7-linux-arm-bin.tar.gz
cd teleport
sudo ./install

curl https://get.gravitational.com/teleport-v9.3.7-linux-arm64-bin.tar.gz.sha256
<checksum> <filename>
curl -O https://get.gravitational.com/teleport-v9.3.7-linux-arm64-bin.tar.gz
shasum -a 256 teleport-v9.3.7-linux-arm64-bin.tar.gz
Verify that the checksums match
tar -xzf teleport-v9.3.7-linux-arm64-bin.tar.gz
cd teleport
sudo ./install

Now start Teleport and point it to the application endpoint:

sudo teleport app start \  --name=grafana \  --token=/tmp/token \  --uri=http://localhost:3000 \  --auth-server=https://teleport.example.com:3080

Change https://teleport.example.com:3080 to the address and port of your Teleport Proxy Server. If you are a Teleport Cloud customer, use port 443 of your tenant's subdomain, e.g., mytenant.teleport.sh:443.

Make sure to update --app-name and --app-uri accordingly if you're using your own web application.

The --token flag points to the file on the Application Service host where we stored the token that we generated earlier.

Create a user

Next, let's create a user to access the application we've just connected. Teleport has a built-in role called access that allows users to access cluster resources. Create a local user assigned this role:

tctl users add --roles=access alice

The command will output a signup link. Use it to choose a password and set up a second factor. After that, it will take you to the Teleport Web UI.

Step 3/3. Access the application

There are a couple of ways to access the proxied application.

Every application is assigned a public address that you can use to navigate to the application directly. In our sample Grafana application we have provided a public address with the --app-public-addr flag, so go to https://grafana.teleport.example.com to access the app.

Replace grafana with the value of the --app-name flag you used when starting the Teleport Application Service and teleport.example.com with the address of your Proxy Service.

If you're not logged into Teleport, you will need to authenticate before the application will show.

Alternatively, log in to the Teleport Web Interface at https://teleport.example.com (replace with your Proxy Service's public address). All available applications are displayed on the Applications tab. Click on the Grafana application tile to access it.

Next steps

Dive deeper into the topics relevant to your Application Access use-case:

Learn in more detail about connecting applications with Application Access.
Learn about integrating with JWT tokens for auth.
Learn how to use Application Access with RESTful APIs.
See full configuration and CLI reference.
Read about how Let's Encrypt uses the ACME protocol.

Have a suggestion or can’t find something?

IMPROVE THE DOCS