CIS Teleport Benchmark

This recommendation verifies that SSO authentication is configured with hardware MFA (WebAuthn) on the Teleport secure access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Teleport secure access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Teleport cluster authentication mode:
tctl get cluster_auth_preference --format=yaml

# Verify local auth is disabled:
tctl get cap | grep -i 'type\|second_factor'

# Set SSO + MFA as auth method:
tctl create -f << 'EOF'
kind: cluster_auth_preference
version: v2
metadata:
  name: cluster-auth-preference
spec:
  type: saml
  second_factor: webauthn
  webauthn:
    rp_id: teleport.example.com
  disconnect_expired_cert: true
  require_session_mfa: true
EOF

This recommendation verifies that least-privilege roles are defined with session TTL and idle timeout on the Teleport secure access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Teleport secure access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List all roles:
tctl get roles --format=yaml | grep -E 'name:|max_session_ttl|node_labels'

# Check default role:
tctl get role/editor --format=yaml

# Create least-privilege role:
tctl create -f << 'EOF'
kind: role
version: v7
metadata:
  name: eng-readonly
spec:
  options:
    max_session_ttl: 8h
    forward_agent: false
    client_idle_timeout: 30m
    disconnect_expired_cert: true
    require_session_mfa: true
  allow:
    node_labels:
      env: ["staging"]
    logins: ["ubuntu"]
    rules:
      - resources: ["session"]
        verbs: ["list", "read"]
  deny:
    node_labels:
      env: ["production"]
    logins: ["root"]
EOF

This recommendation verifies that valid TLS certificates are configured for proxy endpoints on the Teleport secure access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Teleport secure access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check TLS configuration:
tctl get cluster_networking_config --format=yaml | grep -i tls

# Verify certificate:
openssl s_client -connect teleport.example.com:443 </dev/null 2>&1 | grep -E 'subject|issuer|expire'

# Configure TLS certificates:
# Option 1: ACME (Let's Encrypt):
# teleport.yaml:
#   proxy_service:
#     enabled: yes
#     web_listen_addr: 0.0.0.0:443
#     acme:
#       enabled: yes
#       email: admin@example.com

# Option 2: Custom certificates:
# proxy_service:
#   https_keypairs:
#   - key_file: /etc/teleport/certs/server.key
#     cert_file: /etc/teleport/certs/server.crt

This recommendation verifies that enhanced session recording is enabled with cgroup BPF on the Teleport secure access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Teleport secure access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check session recording mode:
tctl get cluster_networking_config --format=yaml | grep -i record

# Check recording proxy mode:
grep -i 'recording\|session' /etc/teleport.yaml

# Enable enhanced session recording:
cat >> /etc/teleport.yaml << 'EOF'
ssh_service:
  enabled: yes
  enhanced_recording:
    enabled: true
    command_buffer_size: 8
    disk_buffer_size: 128000
    network_buffer_size: 8
    cgroup_path: /cgroup2
EOF

# Set recording mode to strict:
tctl create -f << 'YAML'
kind: session_recording_config
version: v2
metadata:
  name: session-recording-config
spec:
  mode: node-sync
  proxy_checks_host_keys: true
YAML

This recommendation verifies that trusted clusters use explicit role mapping on the Teleport secure access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Teleport secure access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check trusted clusters:
tctl get trusted_clusters --format=yaml

# Check cluster networking:
tctl get cluster_networking_config --format=yaml

# Configure trusted cluster (leaf → root):
tctl create -f << 'EOF'
kind: trusted_cluster
version: v2
metadata:
  name: root.example.com
spec:
  enabled: true
  role_map:
    - remote: admin
      local: [admin]
    - remote: developer
      local: [eng-readonly]
  token: trusted-cluster-token
  tunnel_addr: root.example.com:443
  web_proxy_addr: root.example.com:443
EOF

This recommendation verifies that just-in-time access request workflow with dual approval is configured on the Teleport secure access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Teleport secure access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check access request plugins:
tctl get plugins --format=yaml 2>/dev/null

# Check access request flow:
tctl request ls

# Configure access request with Slack approval:
tctl create -f << 'EOF'
kind: role
version: v7
metadata:
  name: prod-access
spec:
  options:
    max_session_ttl: 4h
    request_access: always
    request_prompt: "Provide justification for production access"
  allow:
    request:
      roles: ["prod-admin"]
      thresholds:
        - approve: 2
          deny: 1
    node_labels:
      env: ["production"]
EOF

# Install Slack plugin for approval workflow:
# teleport-plugin start access-slack --config /etc/teleport-slack.toml

This recommendation verifies that database access uses TLS with role-based user and schema restrictions on the Teleport secure access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Teleport secure access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check database access agents:
tctl get db_servers --format=yaml | head -30

# Check Kubernetes access:
tctl get kube_clusters --format=yaml | head -20

# Configure database access:
cat >> /etc/teleport.yaml << 'EOF'
db_service:
  enabled: yes
  databases:
  - name: "prod-postgres"
    protocol: "postgres"
    uri: "postgres.internal:5432"
    tls:
      mode: verify-full
      server_name: "postgres.internal"
      ca_cert_file: /etc/teleport/certs/db-ca.pem
    static_labels:
      env: production
      engine: postgres
EOF

# Role for database access:
tctl create -f << 'YAML'
kind: role
version: v7
metadata:
  name: db-reader
spec:
  allow:
    db_labels:
      env: ["production"]
    db_names: ["analytics"]
    db_users: ["readonly_user"]
YAML

This recommendation verifies that application access proxying uses JWT identity injection on the Teleport secure access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Teleport secure access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check application access:
tctl get app_servers --format=yaml | head -20

# Verify application rewrite:
grep -A10 'app_service' /etc/teleport.yaml

# Configure application access with JWT:
cat >> /etc/teleport.yaml << 'EOF'
app_service:
  enabled: yes
  apps:
  - name: "grafana"
    uri: "http://localhost:3000"
    public_addr: "grafana.teleport.example.com"
    labels:
      env: production
    rewrite:
      headers:
      - name: "X-Custom-Header"
        value: "{{internal.jwt}}"
      - name: "cf-access-token"
        value: "{{internal.jwt}}"
EOF

This recommendation verifies that audit events are persisted to durable external storage on the Teleport secure access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Teleport secure access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check audit log configuration:
grep -A10 'audit' /etc/teleport.yaml

# Query recent audit events:
tctl get events --last=1h --format=json | python3 -m json.tool | head -30

# Configure audit events to external storage:
cat >> /etc/teleport.yaml << 'EOF'
teleport:
  storage:
    type: dynamodb
    region: us-east-1
    table_name: teleport-events
    audit_events_uri:
      - "dynamodb://teleport-events"
    audit_sessions_uri: "s3://teleport-sessions/records?endpoint=s3.us-east-1.amazonaws.com&region=us-east-1"
EOF

This recommendation verifies that session recording mode is set to node-sync for strict compliance on the Teleport secure access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Teleport secure access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check session upload settings:
grep -i 'session\|upload' /etc/teleport.yaml

# List recent sessions:
tctl sessions ls | head -20

# Enable session recording upload to S3:
# Configure in teleport.yaml:
# teleport:
#   storage:
#     audit_sessions_uri: s3://teleport-sessions/records

# Set session recording to strict:
tctl create -f << 'EOF'
kind: session_recording_config
version: v2
metadata:
  name: session-recording-config
spec:
  mode: node-sync
EOF

# Block connections if recording unavailable:
# mode: node-sync (fail if auth unavailable)
# vs mode: node (best-effort, less secure)

This recommendation verifies that Teleport is running a current supported version on the Teleport secure access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Teleport secure access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Teleport version:
teleport version

# Check update availability:
curl -s https://goteleport.com/dl/ | grep -o 'v[0-9]\+\.[0-9]\+\.[0-9]\+' | head -1

# Upgrade Teleport:
# Using apt:
apt-get update
apt-get install --only-upgrade teleport

# Manual:
VER=15.1.0
wget https://cdn.teleport.dev/teleport-v${VER}-linux-amd64-bin.tar.gz
tar xzf teleport-v${VER}-linux-amd64-bin.tar.gz
systemctl stop teleport
cp teleport/teleport /usr/local/bin/
cp teleport/tctl /usr/local/bin/
systemctl start teleport

This recommendation verifies that Teleport runs as a dedicated non-root user with strict systemd controls on the Teleport secure access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Teleport secure access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Teleport service user:
ps aux | grep teleport | grep -v grep | awk '{print $1}'

# Check file permissions:
ls -la /etc/teleport.yaml /var/lib/teleport/

# Run as dedicated user:
useradd --system --no-create-home --shell /usr/sbin/nologin teleport
chown -R teleport:teleport /var/lib/teleport
chmod 600 /etc/teleport.yaml
chown root:teleport /etc/teleport.yaml

cat > /etc/systemd/system/teleport.service << 'EOF'
[Unit]
Description=Teleport Service
After=network-online.target

[Service]
Type=simple
User=teleport
Group=teleport
ExecStart=/usr/local/bin/teleport start -c /etc/teleport.yaml
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
ProtectHome=true
ProtectSystem=strict
ReadWritePaths=/var/lib/teleport
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload && systemctl enable --now teleport

This recommendation verifies that HA backend (DynamoDB/etcd) with external session storage is configured on the Teleport secure access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Teleport secure access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check HA backend:
grep -A10 'storage' /etc/teleport.yaml

# List auth servers:
tctl get auth_servers --format=yaml | head -20

# Configure HA with DynamoDB/etcd backend:
cat > /etc/teleport.yaml << 'EOF'
teleport:
  nodename: auth-1
  data_dir: /var/lib/teleport
  ca_pin: sha256:<pin>
  storage:
    type: dynamodb
    region: us-east-1
    table_name: teleport-backend
    audit_events_uri:
      - dynamodb://teleport-events
    audit_sessions_uri: s3://teleport-sessions/records

auth_service:
  enabled: yes
  cluster_name: teleport.example.com
  listen_addr: 0.0.0.0:3025

proxy_service:
  enabled: yes
  web_listen_addr: 0.0.0.0:443
  tunnel_listen_addr: 0.0.0.0:3024
EOF

This recommendation verifies that host and user CA rotation procedures are scheduled on the Teleport secure access platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Teleport secure access platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check CA rotation status:
tctl status

# List CAs:
tctl get cert_authority --format=yaml | grep -E 'type:|rotation:'

# Rotate CAs:
# 1. Init rotation (adds new CA alongside old):
tctl auth rotate --phase=init --type=host

# 2. Update clients to trust both CAs:
tctl auth rotate --phase=update_clients --type=host

# 3. Update servers to use new CA:
tctl auth rotate --phase=update_servers --type=host

# 4. Complete rotation (remove old CA):
tctl auth rotate --phase=standby --type=host

# Rotate user CA:
tctl auth rotate --phase=init --type=user
tctl auth rotate --phase=update_clients --type=user
tctl auth rotate --phase=update_servers --type=user
tctl auth rotate --phase=standby --type=user

# Set rotation schedule:
# Automate via cron every 90 days