Skip to content

VPN: 1. Create users and rules

Teleport is a tool that enables teams to access servers, databases, and other resources securely. Here's how users and roles work in Teleport:

Users

  • Creation: Users are created by admins and can be associated with identities from external identity providers like GitHub, Google Workspace, or enterprise SSO.
  • Authentication: Users log in using their credentials, which might include passwords, hardware tokens, or biometric data for two-factor authentication.
  • Permissions: User permissions are defined by the roles they are assigned.

Roles

  • Definition: Roles are sets of permissions that define what actions a user can perform within Teleport.
  • Access Control: They control access to resources like servers, Kubernetes clusters, or internal applications.
  • Attributes:
    • Allow/Deny Rules: Specify what resources a user can or cannot access.
    • Node Labels: Define which nodes a user can SSH into based on labels.
    • Rules for Databases and Applications: Determine which databases and apps a user can access.
    • Session Controls: Limit session length or require session recordings.

Example Role Configuration

kind: role
version: v3
metadata:
  name: developer
spec:
  allow:
    logins: ['{{internal.logins}}']
    node_labels:
      'environment': 'dev'
  deny:
    node_labels:
      'environment': 'prod'

In this example, a user with the developer role can access nodes labeled with environment: dev but not those labeled with environment: prod.

Roles can be highly customized to fit your organization's security requirements and operational practices.

Subpages