Teleport CLI Reference

When running Teleport in production, you should adhere to the following best practices to avoid security incidents:

• Avoid using sudo in production environments unless it's necessary.
• Create new, non-root, users and use test instances for experimenting with Teleport.
• Run Teleport's services as a non-root user unless required. Only the SSH Service requires root access. Note that you will need root permissions (or the CAP_NET_BIND_SERVICE capability) to make Teleport listen on a port numbered < 1024 (e.g. 443).
• Follow the principle of least privilege. Don't give users permissive roles when more a restrictive role will do. For example, don't assign users the built-in access,editor roles, which give them permissions to access and edit all cluster resources. Instead, define roles with the minimum required permissions for each user and configure access requests to provide temporary elevated permissions.
• When you enroll Teleport resources—for example, new databases or applications—you should save the invitation token to a file. If you enter the token directly on the command line, a malicious user could view it by running the history command on a compromised system.

You should note that these practices aren't necessarily reflected in the examples used in documentation. Examples in the documentation are primarily intended for demonstration and for development environments.

Teleport's CLI tools can provide completion hints for bash and zsh. For example, typing tsh and pressing Tab will show all available subcommands, typing tsh -- and pressing Tab will show all available flags.

To enable completion, add an additional statement to your shell configuration file.

Example (.bashrc):

eval "$(tsh --completion-script-bash)"

Example (.zshrc):

# enable completion feature
autoload -Uz compinit
compinit

eval "$(tsh --completion-script-zsh)"

Reload your shell to see the changes.

You can repeat the same process for tctl, teleport, and tbot.