opensource/teleport
3
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-09-19 01:58:44 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs: add prereqs to selinux guide (#67586)

Browse Source 
* docs: add prereqs to selinux guide

* reduced verbiage, streamlined bullets, and split the agent requirement

* minor sentence edits. also removed dupe info, we already have the first header with the rhel requirements

* Update docs/pages/zero-trust-access/management/security/selinux.mdx

Co-authored-by: Noah Stride <noah.stride@goteleport.com>

---------

Co-authored-by: Noah Stride <noah.stride@goteleport.com>
This commit is contained in:
mica
2026-06-11 17:17:59 +00:00
committed by GitHub
co-authored by Noah Stride
parent ccc9b36a1f
commit 644cae4529
1 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/pages/zero-trust-access/management/security/selinux.mdx
+33
View File
@@ -17,6 +17,39 @@ more Teleport features, and integration with Teleport Managed Updates.
The Teleport SSH Service SELinux module allows SELinux to confine the Teleport SSH Service. It ensures that Teleport SSH Service processes can only perform explicitly allowed operations, reducing the attack surface and preventing unauthorized actions even if the Teleport binary were compromised.
## Prerequisites
Before installing the SELinux module, ensure the following requirements are met:
(!docs/pages/includes/edition-prereqs-tabs.mdx!)
Service SELinux module is officially supported on these platforms only.
- Root or `sudo` access on the host. The `install-selinux.sh` script must be run
as `root`.
- SELinux enabled on the host (either permissive or enforcing mode). The module can be installed in either mode,
but enforcing mode is recommended for production use. See [SELinux modes] (#selinux-modes) for the difference between the two.
- The `selinux-policy-devel` package installed on the host, which provides the
toolchain used to compile the module. The [Installation](#installation) section
covers this.
- A Teleport configuration file on the host (`/etc/teleport.yaml` by default).
The install script reads this file to customize the module and label files
correctly.
- A Teleport SSH Service agent configured to point at your cluster and enrolled by
following
[SSH getting started](../../../enroll-resources/server-access/getting-started.mdx).
This agent has three SELinux-specific requirements:
- **Tarball installation only.** The `install-selinux.sh` script and SELinux
module ship only in the Linux tarball. Package-manager and container installs
are not supported.
- **SSH Service only.** The agent must run only the SSH Service. Teleport exits
with an error if `--enable-selinux` is set while other services are enabled or
the SSH Service is disabled.
- **Runs as a systemd service.** Teleport is expected to run as a systemd service.
SELinux enforcement relies on Teleport running under the `teleport_ssh_t` domain,
which typically only occurs when Teleport is started by systemd.
(!docs/pages/includes/tctl.mdx!)
## Supported features
The Teleport SSH Service SELinux module supports the following Teleport SSH Service features: