Teleport Blog

I've never used it myself, but a sister comment mentioned related projects working with wireguard and innernet seems to be exactly that use case from a casual glance. You can specify full cidr rules, so it should be possible to prohibit connections between nodes by segmenting the IPs https://github.com/tonarino/innernet There are easier options around if all you wish is ssh access to your servers though. Personally I'd recommend gravitational teleport, mainly because the name is so hilarious https://goteleport.com/

Teleport (YC S15) | Backend and Fullstack Engineers | US, Toronto, London, Remote OK | https://goteleport.com Do you enjoy building security and deployment tools for other engineers? Join us to hack on https://github.com/gravitational/teleport. Most of our code is Go, we have very little technical debt, our codebase is clean and small. If you are a backend or fullstack engineer, we expect you to be comfortable with the following: * Go for backend and Go+TypeScript for fullstack engineers. * Linux, networking, and security. * Scalability and/or security experience for systems software is welcome. We're looking for senior engineers to join the Teleport team. Teleport is a company started by engineers to build products for engineers. We are a stable and growing company. We offer: * Competitive salary and equity. * 401k with company match. * Excellent health insurance. Apply: https://jobs.lever.co/teleport What to expect once you apply: * You will join a 30 minute intro call and we will walk you through compensation, the interview process, and requirements. * You join a private Slack channel and submit a coding challenge in Go (backend) or Go+TypeScript (fullstack) depending on the position using Github.

Teleport (YC S15) | Senior Technical Support Engineer | US, Europe, Canada, Remote OK | https://goteleport.com We are looking for Senior Tech Support Engineers who can script, love systems troubleshooting and helping customers. Join Us: https://jobs.lever.co/teleport/7c7f25dd-21c7-45c9-a107-98d8a78995e5 Most of our code is Go, we have very little technical debt, our codebase is clean and small. We expect you to be comfortable with the following: * Scripting in Python, Go or Bash * Deep understanding of Linux and networking administration * Understanding of modern infra stacks - Kubernetes, Terraform, Ansible * Scalability or security experience for systems software is welcome. What to expect once you apply: * We will send you a 30-50 minute SRE hacking/troubleshooting quiz * You will join 30 minute intro call and we will walk you through the compensation, interview process and requirements. * You will join a live troubleshooting session simulation and try to find all issues we planted in a cloud infrastructure. https://jobs.lever.co/teleport/7c7f25dd-21c7-45c9-a107-98d8a78995e5

Thanks Matthew, great write up. I have a couple of questions/comments 1) Have you guys considered changing the licensing to require larger organizations to contribute financially to the protocol? Permissive open source licensing is great for allowing small upstarts (i.e. individuals like me) to build off of and contribute to development without institutional scale funding. However the virtues of the system become hazy when organizations with gigantic budgets come into the fold and begin essentially parasitizing off your work, despite clearly having the resources to contribute. I'd like to live in a culture where sound moral and economic judgement ruled the day, however based on my experience with the current open source company that I work for (https://goteleport.com) and the similar experience detailed in your funding post, it seems that we simply don't live in such a world. IMO the Open Source world should be considering moving to a Source Available model which looks to maintain the innovation/security benefits of Open Source, while experimenting with a greater variety of license enforced models such that larger players are required to contribute financially. Juce is one example of a project that works something like what I'm imagining (https://juce.com/get-juce), Unreal is another model (https://www.unrealengine.com/en-US/faq). 2) As Matrix grows, it seems inevitable that it will fall victim to the spam problems well known with email. My current understanding is that…

Teleport (YC S15) | Backend Engineer | US, Europe, Canada | https://goteleport.com Do you enjoy building security and deployment tools for other engineers? Join us to hack on https://github.com/gravitational/teleport anywhere in the U.S, Canada, UK, Ireland, Portugal, Australia, and Poland. Most of our code is Go, we have very little technical debt, our codebase is clean and small. We expect you to be comfortable with the following: * Go or Rust * Linux, networking. * Scalability or security experience for systems software is welcome. We’re looking for senior engineers to join the Teleport team. Teleport is a company started by engineers to build products for engineers. We are a stable and growing company. We offer: * Competitive salary and equity. * Work anywhere in the U.S, Canada or Europe Apply: https://jobs.lever.co/teleport We are Backend, Security, Full-stack Engineers and SREs. What to expect once you apply: * We will send you a 20-30 minute programming quiz * You will join 30 minute intro call and we will walk you through the compensation, interview process and requirements.

Privilege Access Management platforms do unify external access protocol for SSH, k8s, databases etc. For eg. Cyberark Checkpoint harmony Teleport [https://goteleport.com] Strongdm [https://www.strongdm.com/] Adaptive [https://adaptive.dev/] and there are many other tools like these.

Yes, but it can be an internal CA. There are even FOSS products for that: https://goteleport.com/

I just saw the demo of SSH looks very similar to Teleport and StrongDM. I think both the solution solve this problem gracefully and has been around doing this. [1] https://goteleport.com [2] https://www.strongdm.com

Wow, a pricing page with no numbers: https://goteleport.com/pricing/ Amazing

I feel for you. Security is a complex, evolving topic, with a dizzying array of concepts. At work, we develop Teleport (https://goteleport.com/) to provide a secure access solution that is also easy to use and hard to get wrong. (Note: you cannot truly have "hard to use" and "secure" access, because people will always develop "backdoors" that are easier to use but not secure.) If you are interested in some accessible writing about security check out: https://goteleport.com/blog/ On SAML: https://goteleport.com/blog/how-saml-authentication-works/ On OIDC: https://goteleport.com/blog/how-oidc-authentication-works/ I can recommend the YouTube channel too: https://www.youtube.com/channel/UCmtTJaeEKYxCjfNGiijOyJw

Check out teleport. It abstracts away the certificate bit and manages it for you. You run 'tsh login' once and you get a cert good for 12 hours (then you can get access to all the teleport resources you are allowed to, weather that is ssh server access, db access, kubernets access, etc.) I am evaluating the product now and am quite impressed. https://goteleport.com/

The blog is hosted on https://goteleport.com/ - the open source SSH implementation which natively supports 2FA. Full disclosure: I work there, but I am not the author.

I always wonder if something like Teleport is going to catch on to change this conversation a little bit. https://goteleport.com/

Another great read on the topic from Teleport blog: https://goteleport.com/blog/access-controls/

Teleport | Sr. Recruiter | Remote or Oakland HQ Teleport (https://goteleport.com) is an open core software company that enables engineers to quickly access any computing resource anywhere. We are hiring our first in-house recruiter. We need a full cycle recruiter to manage 50 engineering hires next year across the stack of (Go / Rust, React, Linux and Cryptography engineering), along with helping with Sales/Marketing hires. Full job description: https://jobs.lever.co/gravitational/15325c7f-9d13-4d29-9951-12e2897ded…

>Also CORS and SOP can be bypassed: https://dev.to/pssingh21/websockets-bypassing-sop-cors-5ajm Like I said, you can reimplement SOP by checking that the Origin header equals the Host header. Or alternatively check them against an allowlist. It's just a couple lines of code, and then it's as secure as normal HTTP. https://dev.to/pssingh21/websockets-bypassing-sop-cors-5ajm That article contains a confusing quote: >The initial handshake occurs via HTTP Upgrade request, the response body is disregarded and the HTTP/HTTPS protocol is upgraded to WS/WSS protocol. But the response body isn't disregarded. What could best be described as the response body is the server->client websocket messages. Those aren't disregarded. >Even very experienced teams make mistake with this kind of things. See for instance, this Kubernetes vulnerability: https://goteleport.com/blog/kubernetes-websocket-upgrade-sec... Thanks, that's an interesting vulnerability. I'm not so sure it's websocket-specific though. It looks like the attack could be done without websockets at all. The end request that does the malicious action is plain HTTP. The initial request that triggers the desync uses a Connection: Upgrade header, which is used in websockets, but isn't actually websocket-specific. Connection: Upgrade was created in RFC 2616 from 1999, which was before the websocket RFC 6455 in 2011. The vulnerability was there was a proxy, and the proxy didn't properly handle the Connection header as specified…

> Did you also consider some form of out-of-band approval mechanism for production environment access? No, not before your comment at least. Vendor CI tools (be it GitLab, Drone, etc) often make it difficult to use this workflow. Their typical model is long lived static creds, and gating authn/authz around job kick off. I'm not aware of any that would work with delegated/approved credentials, at least without writing a custom secrets plugin. If anyone knows of such capabilities, give a me a holler. Furthermore, there is still the risk of any service available to external contributors being compromised (as we saw in the this vulnerability). I'd just as soon have "no prod secrets touch a system that does external CI" as a security invariant -- no matter how trustworthy that external CI system is. In a bittersweet irony, out-of-band approvals are in our product: https://goteleport.com/blog/workflow-api/ but we're not there with CI yet. :/ It would be fantastic if we could have short lived credentials issued only for the duration of the job, after approval (or better: after delegation) from a trusted party. Something like AWS's `CalledVia`.

Unfortunately database design and database administration are entire fields of expertise unto themselves, and I've never seen a resource that covers 100% of the need-to-know info. Oracle, SQL Server, Postgres, and MySQL are all massive, complex, and old, and they have lots of hidden footguns in them. You should start by knowing how other people design the type of DB you're building. A reporting DB is going to work very differently from a transactional DB. If you're using PG's excellent JSONB support as an alternative to Mongo, that's also something you need to consider at the design stage. pgbouncer is very commonly used in PG setups, to the point where I don't understand why it isn't included in the default build. - https://www.pgbouncer.org Sensible config generators: - https://pgtune.leopard.in.ua/ - https://postgresqlco.nf/ (this one is more educational and works as a reference as well) Security intro: - https://goteleport.com/blog/securing-postgres-postgresql/

I guess so, yeah, though that sounds like that's a whole separate ecosystem, and positions itself as a direct competitor: https://goteleport.com/compare/tailscale-alternative/ OTOH, a lot of people who think they need a VPN really just need tunneling and authenticated access, so I can see the pitch for why Teleport's offering is a fit for many users who would otherwise consider tailscale.

Once the connection is upgraded, you loose all metadata included in the HTTP headers (because it’s not HTTP) and all protections relying on it. Also CORS and SOP can be bypassed: https://dev.to/pssingh21/websockets-bypassing-sop-cors-5ajm Even very experienced teams make mistake with this kind of things. See for instance, this Kubernetes vulnerability: https://goteleport.com/blog/kubernetes-websocket-upgrade-security-vuln… Of course you can reimplement everything by hand (and you must if you use WebSockets), but with SSE/Mercure you don't have to because it's plain old HTTP.

Logging you out in 15 minutes is ridiculous as is losing your places/work but "behind a VPN" is not considered secure anymore. "BeyondCorp comes from a realization that VPN perimeter network security is obsolete. As soon as an attacker breaches the perimeter, they have unrestricted access to the resources." https://goteleport.com/blog/how-teleport-extends-beyondcorp-and-federa… no idea if that's a good resource, it's just the first hit for "beyondcorp"

At Teleport we had a lot of requests to support Windows / RDP. We ended up building our own Go/Rust Client into our server/web client. This gave more control over the RDP protocol and authentication. https://goteleport.com/blog/desktop-access/ https://goteleport.com/blog/secure-rdp-client/

This also quite relevant news regarding Teleport: https://goteleport.com/blog/teleport-community-license/ Starting v16 they are switching to a commercial license. It’s quite interesting to see how the market around access tooling is evolving. Especially now with the platform shift with AI

Absolutely. The real difficulty is tests on PR are by definition remote code execution by an untrusted source, so a full risk analysis and hardening needs to be done. Here's a similar mistake on an OSS repo a company I worked for made: https://goteleport.com/blog/hack-via-pull-request/

In case you didn't see it: https://goteleport.com/blog/teleport-oss-switches-to-agpl-v3/ and https://github.com/gravitational/teleport/pull/35259 I readily admit it's not the same amount of :fu: as BuSL or whatever the fuck is going on over at Sentry but still :-( as compared to their much friendlier Apache 2

Teleport (YC S15) | Product Growth Engineer | Remote US/Canada | $180-235K + Equity What is Teleport? We're a Series C startup building an infrastructure access platform. Think of Teleport as a dev tool that makes it easy and secure to access infrastructure. What is the role? This is a senior full-stack engineering role with a heavy product focus. You will be splitting your time between coding (Golang and Javascript) and making product decisions. This role is perfect for former or aspiring technical founders. If you're interested in the role, you can reach out to me directly at xin_at_goteleport.com. Please include "Ask HN" in the subject so it doesn't get filtered out. We are also hiring for other roles: https://goteleport.com/careers/#jobs.

Teleport has two person rule + hardware token enforcement, https://goteleport.com/resources/videos/hardened-teleport-access/

> A new AI bot that can assist you in managing your Teleport cluster via OpenAI GPT-4. Teleport Assist looks pretty neat! https://goteleport.com/features/assist/

I'm not 100% sure of the ask but I think Teleport can do this sort of thing. https://goteleport.com/docs/ also - AWS has AWS Systems Manager. Any system can run AWS SSM agent and SSM Documents define scripts that can be run on machines running SSM agent. On demand or scheduled, with some dynamic inputs etc.

If that's bothering you, you might consider configuring port-knocking[0], or setting up a VPN like tailscale instead of exposing an SSH port. [0] https://goteleport.com/blog/ssh-port-knocking/