Database Access with Self-Hosted MongoDB

Teleport can provide secure access to MongoDB via the Teleport Database Service. This allows for fine-grained access control through Teleport's RBAC.

In this guide, you will:

1. Configure an MongoDB cluster with mutual TLS authentication.
2. Join the MongoDB database to your Teleport cluster.
3. Connect to the MongoDB database via the Teleport Database Service.

• Self-Hosted
• Teleport Enterprise Cloud

Cloud is not available for Teleport v.
Please use the latest version of Teleport Enterprise documentation.

Prerequisites

To check version information, run the tctl version and tsh version commands. For example:

tctl version
Teleport Enterprise v13.3.9 git:api/14.0.0-gd1e081e go1.21

tsh version
Teleport v13.3.9 go1.21
Proxy version: 13.3.9Proxy: teleport.example.com

• MongoDB cluster (standalone or replica set) version 3.6 or newer.

• To check that you can connect to your Teleport cluster, sign in with tsh login, then verify that you can run tctl commands on your administrative workstation using your current credentials. For example:

  tsh login --proxy=teleport.example.com --user=[email protected]
  tctl status
  Cluster  teleport.example.com
  Version  14.0.0
  CA pin   sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678

  If you can connect to the cluster and run the tctl status command, you can use your current credentials to run subsequent tctl commands from your workstation. If you host your own Teleport cluster, you can also run tctl commands on the computer that hosts the Teleport Auth Service for full permissions.

Step 1/3. Install and configure Teleport

Set up the Teleport Database service

The Database Service requires a valid auth token to connect to the cluster. Generate one by running the following command against your Teleport Auth Service and save it in /tmp/token on the node that will run the Database Service:

tctl tokens add --type=db

Install and configure Teleport where you will run the Teleport Database Service:

curl https://goteleport.com/static/install.sh | bash -s 13.3.9

curl https://goteleport.com/static/install.sh | bash -s 14.0.0

Download Teleport's PGP public key
sudo curl https://apt.releases.teleport.dev/gpg \-o /usr/share/keyrings/teleport-archive-keyring.asc
Source variables about OS version
source /etc/os-release
Add the Teleport APT repository for v14. You'll need to update this
file for each major release of Teleport.
echo "deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] \https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} stable/v14" \| sudo tee /etc/apt/sources.list.d/teleport.list > /dev/null

sudo apt-get update
sudo apt-get install teleport-ent

sudo apt-get install teleport-ent-fips

Source variables about OS version
source /etc/os-release
Add the Teleport YUM repository for v14. You'll need to update this
file for each major release of Teleport.
First, get the major version from $VERSION_ID so this fetches the correct
package version.
VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
sudo yum-config-manager --add-repo "$(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/v14/teleport.repo")"
sudo yum install teleport-ent
Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path

sudo yum install teleport-ent-fips

Source variables about OS version
source /etc/os-release
Add the Teleport Zypper repository for v14. You'll need to update this
file for each major release of Teleport.
First, get the OS major version from $VERSION_ID so this fetches the correct
package version.
VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
Use zypper to add the teleport RPM repo
sudo zypper addrepo --refresh --repo $(rpm --eval "https://zypper.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/cloud/teleport-zypper.repo")
sudo yum install teleport-ent
Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path

sudo yum install teleport-ent-fips

Source variables about OS version
source /etc/os-release
Add the Teleport YUM repository for v14. You'll need to update this
file for each major release of Teleport.
First, get the major version from $VERSION_ID so this fetches the correct
package version.
VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
Use the dnf config manager plugin to add the teleport RPM repo
sudo dnf config-manager --add-repo "$(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/v14/teleport.repo")"

Install teleport
sudo dnf install teleport-ent

Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path

sudo dnf install teleport-ent-fips

Source variables about OS version
source /etc/os-release
Add the Teleport Zypper repository.
First, get the OS major version from $VERSION_ID so this fetches the correct
package version.
VERSION_ID=$(echo $VERSION_ID | grep -Eo "^[0-9]+")
Use Zypper to add the teleport RPM repo
sudo zypper addrepo --refresh --repo $(rpm --eval "https://zypper.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/v14/teleport-zypper.repo")

Install teleport
sudo zypper install teleport-ent

sudo zypper install teleport-ent-fips

curl https://get.gravitational.com/teleport-ent-v14.0.0-linux-$SYSTEM_ARCH-bin.tar.gz.sha256
<checksum> <filename>
curl -O https://cdn.teleport.dev/teleport-ent-v14.0.0-linux-$SYSTEM_ARCH-bin.tar.gz
shasum -a 256 teleport-ent-v14.0.0-linux-$SYSTEM_ARCH-bin.tar.gz
Verify that the checksums match
tar -xvf teleport-ent-v14.0.0-linux-$SYSTEM_ARCH-bin.tar.gz
cd teleport-ent
sudo ./install

curl https://get.gravitational.com/teleport-ent-v14.0.0-linux-$SYSTEM_ARCH-fips-bin.tar.gz.sha256
<checksum> <filename>
curl -O https://cdn.teleport.dev/teleport-ent-v14.0.0-linux-$SYSTEM_ARCH-fips-bin.tar.gz
shasum -a 256 teleport-ent-v14.0.0-linux-$SYSTEM_ARCH-fips-bin.tar.gz
Verify that the checksums match
tar -xvf teleport-ent-v14.0.0-linux-$SYSTEM_ARCH-fips-bin.tar.gz
cd teleport-ent
sudo ./install

sudo teleport db configure create \   -o file \   --token=/tmp/token \   --proxy=teleport.example.com:443 \   --name=example-mongo \   --protocol=mongodb \   --uri=mongo.example.com:27017 \   --labels=env=dev 

sudo teleport db configure create \   -o file \   --token=/tmp/token \   --proxy=mytenant.teleport.sh:443 \   --name=example-mongo \   --protocol=mongodb \   --uri=mongo.example.com:27017 \   --labels=env=dev

sudo systemctl enable teleport
sudo systemctl start teleport

sudo teleport install systemd -o /etc/systemd/system/teleport.service
sudo systemctl enable teleport
sudo systemctl start teleport

helm repo add teleport https://charts.releases.teleport.dev

helm repo update

JOIN_TOKEN=$(cat /tmp/token)
helm install teleport-kube-agent teleport/teleport-kube-agent \  --create-namespace \  --namespace teleport-agent \  --set roles=db \  --set proxyAddr=teleport.example.com:443 \  --set authToken=${JOIN_TOKEN?} \  --set "databases[0].name=example-mongo" \  --set "databases[0].uri=mongo.example.com:27017" \  --set "databases[0].protocol=mongodb" \  --set "labels.env=dev" \  --version 14.0.0

JOIN_TOKEN=$(cat /tmp/token)
helm install teleport-kube-agent teleport/teleport-kube-agent \  --create-namespace \  --namespace teleport-agent \  --set roles=db \  --set proxyAddr=mytenant.teleport.sh:443 \  --set authToken=${JOIN_TOKEN?} \  --set "databases[0].name=example-mongo" \  --set "databases[0].uri=mongo.example.com:27017" \  --set "databases[0].protocol=mongodb" \  --set "labels.env=dev" \  --version 13.3.9

kubectl -n teleport get pods
NAME                    READY   STATUS    RESTARTS   AGEteleport-kube-agent-0   1/1     Running   0          32s

You can specify either a single connection address or a MongoDB connection string as a URI. For example, when connecting to a replica set:

--uri="mongodb://mongo1.example.com:27017,mongo2.example.com:27017/?replicaSet=rs0"

By default, Teleport will connect to the primary replica set member. If you'd like to connect to a secondary instead, Teleport will respect readPreference connection string setting:

--uri="mongodb://mongo1.example.com:27017,mongo2.example.com:27017/?replicaSet=rs0&readPreference=secondary"

Create a Teleport user

tctl users add \  --roles=access \  --db-users=\* \  --db-names=\* \  alice

tctl users add \  --roles=access,requester \  --db-users=\* \  --db-names=\* \  alice

For more detailed information about database access controls and how to restrict access see RBAC documentation.

If you opt for a stricter selection of database names for your user, which differs from the wildcard approach illustrated in this guide, it is essential to include the admin database. This ensures MongoDB clients won't have issues while connecting and executing operations such as retrieving server information, listing databases, and aborting transactions.

Step 2/3. Configure MongoDB

Create a MongoDB user

Teleport will use X.509 authentication when connecting to a MongoDB instance. Users authenticating with client certificates must be created in the $external MongoDB authentication database.

MongoDB treats the entire Subject line of the client certificate as a username. When connecting to a MongoDB server, say as a user alice, Teleport will sign an ephemeral certificate with the CN=alice subject.

To create this user in the database, connect to it using the mongosh or mongo shell and run the following command:

db.getSiblingDB("$external").runCommand(
  {
    createUser: "CN=alice",
    roles: [
      { role: "readWriteAnyDatabase", db: "admin" }
    ]
  }
)

Update the roles accordingly to grant the user appropriate database permissions.

Set up mutual TLS

Teleport uses mutual TLS authentication with self-hosted databases. These databases must be configured with Teleport's certificate authority to be able to verify client certificates. They also need a certificate/key pair that Teleport can verify.

If you are using Teleport Cloud, your Teleport user must be allowed to impersonate the system role Db in order to be able to generate the database certificate.

Include the following allow rule in in your Teleport Cloud user's role:

allow:
  impersonate:
    users: ["Db"]
    roles: ["Db"]

Create the secrets:

tctl auth sign --format=mongodb --host=mongo.example.com --out=mongo --ttl=2190h

tctl auth sign --format=mongodb --host=mongo1.example.com --out=mongo1 --ttl=2190h
tctl auth sign --format=mongodb --host=mongo2.example.com --out=mongo2 --ttl=2190h

Use the generated secrets to enable mutual TLS in your mongod.conf configuration file and restart the database:

net:
  ssl:
    mode: requireSSL
    PEMKeyFile: /etc/certs/mongo.crt
    CAFile: /etc/certs/mongo.cas

net:
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/certs/mongo.crt
    CAFile: /etc/certs/mongo.cas

When configuring a replica set, make sure to do it for each member and use secrets generated for the particular server.

Once mutual TLS has been enabled, you will no longer be able to connect to the cluster without providing a valid client certificate. You can use the net.tls.allowConnectionsWithoutCertificates setting to allow connections from clients that do not present a certificate.

See Configure TLS/SSL in the MongoDB documentation for more details.

Step 3/3. Connect

Log in to your Teleport cluster and see available databases:

tsh login --proxy=teleport.example.com --user=alice
tsh db ls
Name          Description     Labels
------------- --------------- --------
example-mongo Example MongoDB env=dev

To retrieve credentials for a database and connect to it:

tsh db connect example-mongo

You can optionally specify the database name and the user to use by default when connecting to the database instance:

tsh db connect --db-user=alice example-mongo

To log out of the database and remove credentials:

Remove credentials for a particular database instance.
tsh db logout example-mongo
Remove credentials for all database instances.
tsh db logout

Next steps

• Learn how to restrict access to certain users and databases.

• Learn more about dynamic database registration.

• View the High Availability (HA) guide.

• See the YAML configuration reference for updating dynamic resource matchers or static database definitions.

• Take a look at the full CLI reference.