Getting started with Teleport Application Access
Length: 08:20
Getting Started
Let's connect to Grafana using Teleport Application Access in three steps:
- Launch Grafana in a Docker container.
- Install the Teleport Application Service on a node and configure it to proxy Grafana.
- Access Grafana through Teleport.
Prerequisites
-
A running Teleport cluster. For details on how to set this up, see one of our Getting Started guides.
-
The
tctl
admin tool andtsh
client tool version >= 9.3.7.tctl versionTeleport v9.3.7 go1.17
tsh versionTeleport v9.3.7 go1.17
See Installation for details.
-
A running Teleport cluster. For details on how to set this up, see our Enterprise Getting Started guide.
-
The
tctl
admin tool andtsh
client tool version >= 9.3.7, which you can download by visiting the customer portal.tctl versionTeleport v9.3.7 go1.17
tsh versionTeleport v9.3.7 go1.17
-
A Teleport Cloud account. If you do not have one, visit the sign up page to begin your free trial.
-
The
tctl
admin tool andtsh
client tool version >= 9.3.8. To download these tools, visit the Downloads page.tctl versionTeleport v9.3.8 go1.17
tsh versionTeleport v9.3.8 go1.17
To connect to Teleport, log in to your cluster using tsh
, then use tctl
remotely:
tsh login --proxy=teleport.example.com [email protected]tctl statusCluster teleport.example.com
Version 9.3.7
CA pin sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678
You can run subsequent tctl
commands in this guide on your local machine.
For full privileges, you can also run tctl
commands on your Auth Service host.
To connect to Teleport, log in to your cluster using tsh
, then use tctl
remotely:
tsh login --proxy=myinstance.teleport.sh [email protected]tctl statusCluster myinstance.teleport.sh
Version 9.3.8
CA pin sha256:sha-hash-here
You must run subsequent tctl
commands in this guide on your local machine.
- A Docker installation, which we will use to launch Grafana in a container. Alternatively, if you have another web application you'd like to protect with Application Access, you can use that instead.
- A host where you will run the Teleport Application Service.
If you have not yet deployed the Auth Service and Proxy Service, you should follow one of our getting started guides or try our Teleport Application Access interactive learning track.
We will assume your Teleport cluster is accessible at teleport.example.com
and *.teleport.example.com
. You can substitute the address of your Teleport Proxy Service. (For Teleport Cloud customers, this will be similar to mytenant.teleport.sh
.)
Teleport assigns a subdomain to each application you have configured for Application
Access (e.g., grafana.teleport.example.com
), so you will need to ensure that a DNS A record exists for each application-specific subdomain so clients can access your applications via Teleport.
You should create either a separate DNS A record for each subdomain or a single record with a wildcard subdomain such as *.teleport.example.com
. This way, your certificate authority (e.g., Let's Encrypt) can issue a certificate for each subdomain, enabling clients to verify your Teleport hosts regardless of the application they are accessing.
Step 1/3. Start Grafana
We've picked Grafana for this tutorial since it's very easy to run with zero configuration required. If you have another web application you'd like to expose, skip over to Step 2.
Grafana can be launched in a Docker container with a single command:
docker run -d -p 3000:3000 grafana/grafana
Step 2/3. Install and configure Teleport
When running Teleport in production, we recommend that you follow the practices below to avoid security incidents. These practices may differ from the examples used in this guide, which are intended for demo environments:
- Avoid using
sudo
in production environments unless it's necessary. - Create new, non-root, users and use test instances for experimenting with Teleport.
- Run Teleport's services as a non-root user unless required. Only the SSH
Service requires root access. Note that you will need root permissions (or
the
CAP_NET_BIND_SERVICE
capability) to make Teleport listen on a port numbered <1024
(e.g.443
). - Follow the "Principle of Least Privilege" (PoLP). Don't give users
permissive roles when giving them more restrictive roles will do instead.
For example, assign users the built-in
access,editor
roles. - When joining a Teleport agent to a cluster, save the invitation token to a
file. Otherwise, the token will be visible when examining the
teleport
command that started the agent, e.g., via thehistory
command on a compromised system.
On your Application Service host, download the latest version of Teleport for your platform from our downloads page.
Generate a token
A join token is required to authorize a Teleport Application Service agent to
join the cluster. Generate a short-lived join token and save it, for example,
in /tmp/token
on your Teleport Application Service host:
tctl tokens add \ --type=app \ --app-name=grafana \ --app-uri=http://localhost:3000
Start Teleport
Install Teleport on the host where you will run the Teleport Application Service. See our Installation page for options besides Linux servers.
Download Teleport's PGP public key
sudo curl https://deb.releases.teleport.dev/teleport-pubkey.asc \ -o /usr/share/keyrings/teleport-archive-keyring.ascAdd the Teleport APT repository
echo "deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] https://deb.releases.teleport.dev/ stable main" \| sudo tee /etc/apt/sources.list.d/teleport.list > /dev/nullsudo apt-get updatesudo apt-get install teleport
sudo yum-config-manager --add-repo https://rpm.releases.teleport.dev/teleport.reposudo yum install teleportOptional: Using DNF on newer distributions
$ sudo dnf config-manager --add-repo https://rpm.releases.teleport.dev/teleport.repo
$ sudo dnf install teleport
curl https://get.gravitational.com/teleport-v9.3.7-linux-amd64-bin.tar.gz.sha256<checksum> <filename>
curl -O https://get.gravitational.com/teleport-v9.3.7-linux-amd64-bin.tar.gzshasum -a 256 teleport-v9.3.7-linux-amd64-bin.tar.gzVerify that the checksums match
tar -xzf teleport-v9.3.7-linux-amd64-bin.tar.gzcd teleportsudo ./install
curl https://get.gravitational.com/teleport-v9.3.7-linux-arm-bin.tar.gz.sha256<checksum> <filename>
curl -O https://get.gravitational.com/teleport-v9.3.7-linux-arm-bin.tar.gzshasum -a 256 teleport-v9.3.7-linux-arm-bin.tar.gzVerify that the checksums match
tar -xzf teleport-v9.3.7-linux-arm-bin.tar.gzcd teleportsudo ./install
curl https://get.gravitational.com/teleport-v9.3.7-linux-arm64-bin.tar.gz.sha256<checksum> <filename>
curl -O https://get.gravitational.com/teleport-v9.3.7-linux-arm64-bin.tar.gzshasum -a 256 teleport-v9.3.7-linux-arm64-bin.tar.gzVerify that the checksums match
tar -xzf teleport-v9.3.7-linux-arm64-bin.tar.gzcd teleportsudo ./install
Now start Teleport and point it to the application endpoint:
sudo teleport app start \ --name=grafana \ --token=/tmp/token \ --uri=http://localhost:3000 \ --auth-server=https://teleport.example.com:3080
Change https://teleport.example.com:3080
to the address and port of your Teleport Proxy Server. If you are a Teleport Cloud customer, use port 443 of your tenant's subdomain, e.g., mytenant.teleport.sh:443
.
Make sure to update --app-name
and --app-uri
accordingly if you're using your own web application.
The --token
flag points to the file on the Application Service host where we stored the token that we generated earlier.
Create a user
Next, let's create a user to access the application we've just connected. Teleport has a built-in role called access
that allows users to access cluster resources. Create a local user assigned this role:
tctl users add --roles=access alice
The command will output a signup link. Use it to choose a password and set up a second factor. After that, it will take you to the Teleport Web UI.
Step 3/3. Access the application
There are a couple of ways to access the proxied application.
Every application is assigned a public address that you can use to navigate to
the application directly. In our sample Grafana application we have provided a public address with
the --app-public-addr
flag, so go to https://grafana.teleport.example.com
to access the app.
Replace grafana
with the value of the --app-name
flag you used when starting the Teleport Application Service and teleport.example.com
with the address of your Proxy Service.
If you're not logged into Teleport, you will need to authenticate before the application will show.
Alternatively, log in to the Teleport Web Interface at https://teleport.example.com
(replace with your Proxy Service's public address). All available applications are displayed on the Applications tab. Click on the Grafana application tile to access it.
Next steps
Dive deeper into the topics relevant to your Application Access use-case:
- Learn in more detail about connecting applications with Application Access.
- Learn about integrating with JWT tokens for auth.
- Learn how to use Application Access with RESTful APIs.
- See full configuration and CLI reference.
- Read about how Let's Encrypt uses the ACME protocol.