How I secure my Server Access with Teleport (for SSH, K8S, and Web)

Поделиться
HTML-код
  • Опубликовано: 4 сен 2024

Комментарии • 151

  • @GadgeteerZA
    @GadgeteerZA 2 года назад +45

    Still love the installation tutorials

  • @rogerthomas368
    @rogerthomas368 2 года назад +18

    Maybe for setup videos, you can select a single target environment that you feel would be a good foundation for any general environment such as Docker+Traefik (as an example). This way you can do follow along videos without having to detail many different setups.

    • @christianlempa
      @christianlempa  2 года назад +2

      That's a great idea, thanks for sharing! I think I will try it in the next video 😁

  • @paulogodinho3275
    @paulogodinho3275 2 года назад +4

    This is simply awesome Christian! I will deploy Teleport to my home right now and start poking around my company to see what they think :D

  • @m4heshd
    @m4heshd 2 года назад +8

    Docker with Traefik + Portainer and Teleport CE complete tutorial would've been amazing. Including installations.

    • @christianlempa
      @christianlempa  2 года назад +2

      Hmmm yeah might be a nice idea! I'll take a look

    • @m4heshd
      @m4heshd 2 года назад

      @@christianlempa Thank you 😊

    • @Daranix
      @Daranix 2 года назад +1

      I really need this

  • @JohnDoe-el8tg
    @JohnDoe-el8tg 2 года назад +10

    More project-focus. I prefer to see possibilities of the technology. You're right about installation - most of apps are trivial to install. It might worth though to cover some cases when configuration is tricky. Also apart from demonstrating basic purpose of technologies, it would be good sometimes to deeper - to show what we can reach when we "unleash" it :)
    thanks for you videos btw :)

  • @evkonoff
    @evkonoff 2 года назад +3

    I am very happy that you have both kind of videos, because in that way your channel have some kind of learning curve. I know how to google a guide but on your channel I can find not only "how to install app", but more like "this is insecure because of that, this is outdated and you should NEVER do this on your production, also you need to do this this and this, go check my other videos". It's not a trivial tusk to find not just a guide, but guide which will show you the right direction to grow and what to do next.

    • @christianlempa
      @christianlempa  2 года назад +2

      Thank you so much for this feedback, I highly appreciate! And yeah I fully agree with you, I always want somewhat a learning curve, because my channel shouldn't be just for beginners but also for intermediate/advanced people. Thank you again, it really helps me :)

  • @techiot
    @techiot 2 года назад +7

    That was a great video! Let me tell you that I was watching your videos several times in the past and for me you have informative and qualitative content. I was so focused on your videos, that only on this one I saw that I haven't subscribed yet! Well now I did it and as they say, better late than never. Kudos from Greece!

  • @JediaelOliveira
    @JediaelOliveira 2 года назад +5

    I def need the installation instructions lol
    Thank you for the great content!

    • @christianlempa
      @christianlempa  2 года назад

      Thanks for your feedback! Maybe you can check their documentation, they have good guides, or you could ask on our Discord if you need help!

  • @Dustin_DM
    @Dustin_DM 2 года назад +3

    I think installation tutorials are a great way to get more people to a channel

    • @christianlempa
      @christianlempa  2 года назад

      That maybe right, but I don't know if its the right way to keep them. Most people just search for a tutorial and once they got what they want, they leave :D

  • @themorpheusmm
    @themorpheusmm 2 года назад +1

    We are using Apache Guacamole. Free Open Source, self hosted and we have M$ Win customers, so we need RDP as well (beside VNC, SSH, etc.)

  • @mikkel3135
    @mikkel3135 2 года назад +1

    Never heard of this before, so glad I found out! Currently using Apache Guacamole, but I'm thinking of trying out this one for my next setup upgrade

  • @jamochl
    @jamochl 2 года назад +1

    This is incredible, I can see how this will be super useful to myself and friends working on private projects and needing to hide our Jenkins servers and such from the public web. Thanks!

    • @christianlempa
      @christianlempa  2 года назад

      You're welcome! Sounds like a great use case

  • @lstanford23
    @lstanford23 3 месяца назад

    keep doing installation tutorials, but all of your videos are awesome!

  • @truthontech
    @truthontech Год назад

    Thanks Christian. Documentation had me going in circles. I prefer this style of training too as its focuses on the essential points and leaves the stuff that can be Googled.

  • @pavelivakin3735
    @pavelivakin3735 2 года назад +3

    I'd like to see project videos with reference to a installation blog post.
    Every instruction is better on a website because you can copy paste from it. And it's faster to consume.

    • @christianlempa
      @christianlempa  2 года назад +2

      That's absolutely right! Thanks for the great feedback :)

    • @bobedgar6647
      @bobedgar6647 2 года назад +2

      I’d like to agree wholeheartedly. They serve two different purposes and it’s a nice split. When doing an actual design/build it’s nice to have a reference installation to look at for hints and pitfalls to watch for. The project level is better for covering the functionality and thoughts about alternatives and trade offs.
      I find your videos quite useful and use them to help me plan and implement my own playground.
      Gruß aus Darmstadt

  • @gernhardreinholzen1448
    @gernhardreinholzen1448 2 года назад +1

    Hey, deine Installations Tutorials helfen ungemein weil du dich mit den Sachen beschäftigt hast und nicht einfach nur die absolut basic config für das video zurecht gezimmert hast. Zudem hilft es bei Problemen sich mit dem Video, bei dem man weiß das es am Ende funktioniert, rückzuversichern bzw. darauf zu achten was man ggf. vergessen hat anzupassen. Daher bin ich absoluter Fan von den Installations-Tuts.

    • @christianlempa
      @christianlempa  2 года назад +1

      Vielen Dank! Ich glaube ich habe einen guten Weg gefunden, wie ich das in Zukunft mache ;)

    • @oneany367
      @oneany367 Год назад

      @@christianlempa Where is the basic teleport installation guide for Mac, I tried to follow the guide in github, the teleport and webapp are seperate project and webapp can not be built with yarn or docker.

  • @yourpcmd
    @yourpcmd 2 года назад +1

    I subscribed mainly for the tutorials, so it would be nice to continue doing them.

    • @christianlempa
      @christianlempa  2 года назад +1

      Thanks for the feedback! Don't worry, you'll still get tutorials ;)

  • @Ne0_Vect0r
    @Ne0_Vect0r 2 года назад +2

    can we use our own SSO (OIDC OR SAML) to auth -> teleport. and is this feature available in the open-source part of teleport?:
    "The authentication layer handled by the Teleport Desktop Service is based on ephemeral certificates that are passed as a smart card via a virtual smart card emulator. In fact, this capability allows Teleport to offer certificate-based access to remote desktops with a full passwordless experience to users."

  • @jrrtolkin
    @jrrtolkin 2 года назад +1

    Thnx Christian, as always a great video. Both installation videos and project videos are great pls do both. Thnx again.

  • @raul230285
    @raul230285 2 года назад +1

    Amazing... Please podrías actualizar el video de teleport porque ya existe una nueva versión. Gracias

  • @Glatze603
    @Glatze603 2 года назад +2

    Hi Christian and thanks very much for your real professional videos and your time 👍👌😉 Unfortunately I still don't know, how to install and self host a teleport server in my cgnat-lan behind a reverse-proxy (NPM). If the teleport server needs to generate letsencrypt-certificates automatically, this will not be possible in lan.

    • @christianlempa
      @christianlempa  2 года назад +2

      I'm thinking about that for a long time, my friend :D I'm currently investigating using certbot somehow in my homelab, as this could then distribute certificates via network share or docker to services like Teleport. Teleport made a video about this on their official channel: ruclips.net/video/5dHdZlamM8U/видео.html
      But I think I'd make a more general video about certificates, self-signed, letsencrypt and certbot in the future... could be a great video.

  • @bzmrgonz
    @bzmrgonz 8 месяцев назад

    On your new project approach…Maybe you can link to your notes and scratchpad on the topic at hand. You can include the usual popular recipes there, windows/nix etc. I think those who only want the generic knowledge will watch your sunmarization video, and those implementing or wanting deeper knowledge can click and follow the link.

  • @kingsathurthi
    @kingsathurthi 2 года назад +1

    Would be great if you post both installation and project videos

    • @christianlempa
      @christianlempa  2 года назад +1

      Thanks for the great feedback! Yeah that might be a viable option, why not just do both :)

  • @vrl.
    @vrl. 2 года назад

    Finally! Thank you Christian!

  • @haythemferjani1590
    @haythemferjani1590 2 года назад

    Tutorials still been good too

    • @christianlempa
      @christianlempa  2 года назад

      Yeah you're right! I think I'm doing both when it makes sense 😀

  • @optical_ideas
    @optical_ideas 2 года назад +1

    Nice, thanks.
    Any chance to get a tutorial for home developement and connect docker containers and use teleport without tls?
    Cant get it to run. I pass the parameter --insecure but it always says "nope, tls handshake failed)

    • @christianlempa
      @christianlempa  2 года назад +1

      I've done an older video where I installed it locally, maybe this helps: ruclips.net/video/nk1jfIAL5qE/видео.html

    • @optical_ideas
      @optical_ideas 2 года назад

      @@christianlempa thanks, i got it, very helpfull 😃

  • @Weirlive
    @Weirlive 2 года назад

    how do you not have more subscribers?!?! your content is very well done.

    • @christianlempa
      @christianlempa  2 года назад +1

      I don't know man 🤣, but the subs will come over time. Thank you 😊

    • @Weirlive
      @Weirlive 2 года назад

      @@christianlempa to your question about setups, is it best practice to have a "security" server like this dedicated / in Docker / in K8s ?

  • @pauljennings
    @pauljennings 2 года назад +1

    Great video - thanks for sharing. Quick question: How do you enable the "automatic" add server/node (for SSH) option? My teleport only have manual method displayed and no menu tabs to switch between automatic and manual? (timestamp 10:23 in video)

    • @christianlempa
      @christianlempa  2 года назад +1

      Hmmm good question, I never did anything to enable it. Maybe thats part of cloud deployments?

  • @t4ruvk107
    @t4ruvk107 Год назад

    Have you got video on bastion server setup with baby steos on aws cloud to connect with private network instances. Missing the apt video on RUclips. Thanks in advance

  • @gaetanb6296
    @gaetanb6296 2 года назад

    thanks for the discovery

  • @JPEaglesandKatz
    @JPEaglesandKatz 2 года назад

    can't run the add user script on my new server... curl compalins about not trusting the self signed certificate...

  • @TominoNoxo
    @TominoNoxo Год назад

    Christian, you are just a great smart guy ;) thanks & respect !

    • @christianlempa
      @christianlempa  Год назад

      Thank you so much. :)

    • @TominoNoxo
      @TominoNoxo Год назад

      ​@@christianlempa I have a problem with the settings of Teleport in the Nginx Proxy Manager.. How forward TCP ports 3023-5? Could you give me please some advice?

  • @godbleak
    @godbleak Год назад

    It'd be nice if Teleport could handle the authentication for those web apps as well. It's not like the ones you showed don't have robust authentication mechanisms themselves, so it seems like additional security friction without any real benefits.

  • @Dellabeneta
    @Dellabeneta 9 месяцев назад

    Hey there! Afternoon! I'm trying to figure out how to set the maximum time for inactive client sessions in an SSH session. It's currently at 1 minute by default, but when I try to change it, nothing happens. The documentation is a bit confusing, and I'm struggling to sort out this problem. Any chance you could lend a hand? Thanks!

  • @tqnpersonal
    @tqnpersonal 2 года назад +1

    Great video as always.
    I'm also looking forward to using Teleport, but seems they lack a bit RDP support. It's under development now I think.

    • @christianlempa
      @christianlempa  2 года назад +1

      Thank you! Yeah they're currently working on it ;)

  • @luckyluk83
    @luckyluk83 Год назад

    I was trying to make teleport work behind the reverse proxy but unfortunately I've failed. I would love to see a guide how to do it, maybe you're able to do it.

  • @dylanmaniatakes
    @dylanmaniatakes 2 года назад

    Love the idea of this, i just wish it could also do windows jump clients to remote control windows

    • @christianlempa
      @christianlempa  2 года назад

      Yeah this will be great, they're currently working on it ;)

  • @srepairs3986
    @srepairs3986 2 года назад

    Schon gewundert wo der Akzent herkommt. :D Sehr gutes Video.

  • @annahri
    @annahri 2 года назад +1

    Setting up teleport behind a reverse proxy is so much pain!

    • @mandalorian2010
      @mandalorian2010 2 года назад

      I am experiencing this now

    • @dandocmando
      @dandocmando Год назад

      How did you do it? I tried to get it with Traefik and failed.

  • @Mikesco3
    @Mikesco3 2 года назад +1

    Please don't use Google authenticator
    Aegis for Android
    TOTP Auth for iPhone
    These last allow you to easily export the codes to a backup phone

  • @adamdaniel5766
    @adamdaniel5766 2 года назад

    Thanks for this amazing video, by the way I love your terminal theme what are you using?

    • @christianlempa
      @christianlempa  2 года назад

      Thanks bro! I've made a video about my terminal: ruclips.net/video/AK2JE2YsKto/видео.html

  • @jacksware
    @jacksware 2 года назад

    Great video, but I think I missed something because I don't recall you mentioning what the cost would be for what you're actually demoing. And that information seems to be hard to come by. Don't get me wrong, it's all good, I just would have found the video more complete if you either demo'd the self-hosted, or at least cited a ballpark price for what was being demo'd. Price is certainly not the only consideration, but it is a consideration and I get squirrelly when a company hides their pricing. Just my $0.02 - Thanks for all the great content!

    • @christianlempa
      @christianlempa  2 года назад +1

      Thanks! Yeah, I get it; however, it doesn't seem to be an unconventional practice in the enterprise business. Can't say much about the costs, on my end it's sponsored.

  • @gabrieldealmeida7012
    @gabrieldealmeida7012 2 года назад

    I am choosing a secret manager for my company. Do you have any material or video to compare the differences between Teleport and PAM Cyberark?

  • @sangtengkorak1954
    @sangtengkorak1954 2 года назад

    A project based is more interesting for me, since implementing is also learning but in nitro mode.
    Thanks.

    • @christianlempa
      @christianlempa  2 года назад

      Thank you for your feedback, I think I will do both 😁

  • @YM-kn1qz
    @YM-kn1qz 2 года назад

    I love this this new way

    • @christianlempa
      @christianlempa  2 года назад +1

      Thanks! I love making these videos ;) Glad you enjoy

  • @phainesthai
    @phainesthai 2 года назад

    hi, how do you get your terminal to look like that with the line after a command with the ubuntu logo?

  • @JohnWeland
    @JohnWeland Год назад

    I wonder if this can be used to expose an app for public consumption. I occasionally use CloudFlare Tunnels for this when I want something public but don't want to poke holes in my firewall. What I saw here looks like it would still require authentication to hit a hosted app. Is there a way to make an app "public"?

  • @knightwolf8877
    @knightwolf8877 Год назад

    how did you get your terminal prompt to look like kali?

  • @kostast2594
    @kostast2594 2 года назад

    Thanks! Excellent video. Does teleport support access to Windows Servers through RDP?

    • @christianlempa
      @christianlempa  2 года назад

      They're currently working on it, but it's still in preview, so don't use it in production.

  • @gncfhcnvc
    @gncfhcnvc Год назад

    Great video muak 💋

  • @Blackbird01989
    @Blackbird01989 Год назад

    Tolles Video, Teleport interessiert mich schon eine ganz Weile! Aber: Ist es eine gute Idee die sicheren SSH Verbindungen mit root access über ein (deutlich anfälligeres) Webinterface zugänglich zu machen?

    • @christianlempa
      @christianlempa  Год назад +1

      Danke! Ist natürlich immer deine eigene Entscheidung welche Software du benutzt, aber den Vorteil den Teleport hat ist, dass du verschiedene Benutzer anlegen kannst, diese über MFA sicher authentifizieren kannst, Auditing hast und natürlich kannst du Benutzer an anlegen, die NICHT als Root sich anmelden können und ihre eigenen Benutzernamen haben.
      Ist immer eine Frage, wie sicher du es konfigurierst.

    • @Blackbird01989
      @Blackbird01989 Год назад

      @@christianlempa So schnell hätte ich ja gar nicht mit einer Antwort gerechnet - Danke dafür! Du hast natürlich vollkommen Recht, jeder muss das selber entscheiden, welche Software er einsetzen möchte. Genau darum beschäftigt mich das Thema: Ich finde Auditing und Benutzerverwaltung super interessant, das ist genau das Thema was mich in unserer Serverinfrastruktur stört. Auf der anderen Seite sehe ich den Fall, dass man die schönen Sicherheitsfeatures wie PubKey Authentifizierung, die ja als sehr sicher gilt ( Habe gerade erst dazu dein Linux-Sicherheitsvideo gesehen - Auch sehr interessant!), einfach aushebelt und den Zugang per Passwort und MFA Token zugänglich macht. Aber scheinbar ist das ja in der Praxis durchaus als adäquate und sichere Lösung angesehen, auch ohne Schutz davor, wie VPN oder ähnliches.

  • @dennisverbeek5965
    @dennisverbeek5965 2 года назад

    Does this also work for connecting to devices where you cannot install the agent? E.g. switches, virtual appliances?

    • @christianlempa
      @christianlempa  2 года назад

      Sorry for my last reply, thought about it, and you could use it this way: goteleport.com/docs/server-access/guides/openssh/

  • @biggyk87
    @biggyk87 2 года назад

    Weird my teleport doesnt have the automatic option when trying to add a node to the cluster.

  • @superworstje
    @superworstje 2 года назад

    Can teleport also be used to act as a jumphost for network devices like cisco routers,switches via ssh?

    • @christianlempa
      @christianlempa  2 года назад

      Yeah, there is a command in the tsh client for that: goteleport.com/docs/server-access/guides/tsh/#ssh-jumphost

  • @plokko1
    @plokko1 2 года назад

    Is it possible to use Teleport for accessing shell in pods?
    For web deployment (ex. Laravel) i usually deploy a Docker apache-php container for each website and a reverse proxy for global public access.
    I also have to give web developers an access to the shell (to run test, composer, migrations, etc.) and i usually create an SSH container for each website based on the same apache-php in production.
    Now, let alone that i have to assign a different SSH port for each SSH access, every time they ask for a customization on the apache-php (Ex. different version, extensions or additional programs) i have to apply the customization also on the SSH container;
    the issue would be fixed if i had a service that would allow access directly on the apache-php container but in Docker i cannot restrict the user only in one container.
    I understood from your video that you can give access to kubectl with namespace restrictions (ex. i can create a namespace for each client and allow kubectl for his domain and all his websites) but is it possible to give direct access to a pod without giving access to kubctl?

    • @christianlempa
      @christianlempa  2 года назад

      You can of course run a teleport agent inside a pod, or use it with openSSH: goteleport.com/docs/server-access/guides/openssh/

    • @plokko1
      @plokko1 2 года назад

      @@christianlempa if I understood correctly this guide aim to integrate teleport to an sshd server; my goal is to completely remove SSH servers, now one for each installation, and replace it with a global teleport server (only one instance on the k8s cluster)that will start a bash shell directly in a pod (an Apache-php pod without sshd ).
      This will allow me to avoid creating custom sshd server for each custom installation.

  • @vladduh3164
    @vladduh3164 2 года назад

    nice video, just a suggestion, can you please use dark theme (or dark reader extension) when showing white websites, my eyes burn x/

  • @binarytech8457
    @binarytech8457 Год назад

    Interesting product. Is it possible to use it to grant a user temporary access to the domain joined Windows server?

    • @christianlempa
      @christianlempa  Год назад

      Haven’t tested it yet, but I guess so

    • @binarytech8457
      @binarytech8457 Год назад

      @@christianlempa Few minutes after I've post my comment here I've found an official video about it on their website :D Cheers!

  • @joaopaulosapidepaula1706
    @joaopaulosapidepaula1706 2 года назад

    Nice Job!!! I'm testing the solution, but I can't get out of the authentication screen!! I installed the Authy app on my cell phone to scan the qr code, but it's not coming in.
    It is giving the error, as shown in the message: invalid one time token, please check if the token has expired and try again.
    I tried several times and nothing.

    • @christianlempa
      @christianlempa  2 года назад +1

      Thanks! You might check out the teleport community for help, they have great support

  • @doge1931
    @doge1931 Год назад

    can this also manage RDP?

  • @ironosenshicas
    @ironosenshicas 2 года назад

    Can we get a video about teleports login options?

    • @christianlempa
      @christianlempa  2 года назад

      Great suggestions, I'll include it in the next video about RDP access!

  • @jasongomez5344
    @jasongomez5344 2 года назад

    Why aren't there any aarch64 Docker images for Teleport? Frustrating!

  • @raylab77
    @raylab77 2 года назад

    Oh, i really still want install tutorials please.. 🙏

    • @christianlempa
      @christianlempa  2 года назад

      Don't worry, they're still my main focus ;)

  • @xiaxiao7567
    @xiaxiao7567 Год назад

    Is there an alternative. Hard as fuck to setup. Here i can do Kubernetes but for hell can get this thing up and running. Do you have some simillar product to this one. Been taking me 3 days now I have to move on. Any tips for another simillar product?

  • @shetuamin
    @shetuamin 2 года назад

    I shall try this tonight. That reverse proxy work for vscode server container?

    • @christianlempa
      @christianlempa  2 года назад

      It should work with all web apps, but you can tell me how it's working on your end

  • @ronald0122
    @ronald0122 2 года назад

    what is your password manager? can you make a video?

    • @christianlempa
      @christianlempa  2 года назад

      Already did that: ruclips.net/video/ub8jj96_Q3g/видео.html&lc=Ugze3pTWOzotjv2ArrB4AaABAg

  • @vasileloshvili
    @vasileloshvili 28 дней назад

    Are you using the community version?

  • @drrenard1277
    @drrenard1277 2 года назад

    No webauthen?

  • @buscseik
    @buscseik 2 года назад

    Is there any similar alternative for ssh?

  • @030426101993
    @030426101993 2 года назад

    Still want the installation tutorials

  • @jamilshaikh07
    @jamilshaikh07 3 месяца назад

    pls redo again!

  • @green-media-pl
    @green-media-pl 2 года назад

    What model of Acer laptop do you use?

    • @christianlempa
      @christianlempa  2 года назад +1

      I'm using an Aspire5, it's a very very slow and basic laptop :D Haven't found anything better that would satisfy me ;)

  • @antoniorobles998
    @antoniorobles998 2 года назад +1

    Tutorialsss!! Please😅

    • @christianlempa
      @christianlempa  2 года назад

      Haha, thanks mate, I'll think about it ;)

  • @VicenteFontanella
    @VicenteFontanella 2 года назад

    It seems interesting, but I believe that Thycotic can be a better solution for enterprise. Correct me if I’m wrong.

  • @ierosgr
    @ierosgr 2 года назад +1

    nah..... even though I ve seen many of your videos about installation and configuration of things, personally speaking I could easily see myself unsubscribed if you move to a more general way of just presenting things. I can do this by browsing to sites of the services.

    • @christianlempa
      @christianlempa  2 года назад +1

      I get your point, and thanks for your honest feedback! I don't want to make my videos just like a "marketing presentation", that's not what I want. Don't worry, I'll find I way to make both, exciting videos and technical tutorials ;)

    • @ierosgr
      @ierosgr 2 года назад

      @@christianlempa Didnt mean to be rude Its just the way I amin my life straight forward. Nice that you will think about it

    • @christianlempa
      @christianlempa  2 года назад +1

      @@ierosgr Don't worry, I didn't feel it was rude! It was just honest feedback. Btw, I'm thankful for people being straight forward ;)

  • @AlexandreAlonso
    @AlexandreAlonso 2 года назад

    how much it cost the cloud hosted version?

    • @christianlempa
      @christianlempa  2 года назад

      You need to speak to Teleports Sales Engineers, there is no public price list.

    • @nabochilla
      @nabochilla 2 года назад

      Would be great to know for us in which range you're paying for the cloud version you showed us.. $0-20/month, $20-50, $50-100, $100-1000, more?

    • @AlexandreAlonso
      @AlexandreAlonso 2 года назад

      @@christianlempa I was thinking you already know since you are paid user for the teleport cloud services

  • @petarsimovic5628
    @petarsimovic5628 2 года назад +1

    This is so bad from security point of view. Before Teleport hackers would have to hack your personal computer to steal passwords or ssh secret keys (targeted attack, personal PC-s are now publicly available), but now any hacker will have access to all server's root logins just by hacking one publicly available login portal.

  • @maheshs1220
    @maheshs1220 Год назад

    Does anyone tell you look like mark

  • @pycloud3337
    @pycloud3337 8 месяцев назад

    RHCSA RHCE post me pls

  • @pacholskigaming8699
    @pacholskigaming8699 2 года назад

    This is exacy what we neee