mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-03 07:40:28 +08:00
Paul Gottschling
0fbbeff50c
Use Docusaurus syntax for admonitions so the docs engine does not need to replace these. This is one step toward removing the `remark-update-tags` plugin. See: gravitational/docs-website#94 Relevant commands are included below to make reproducing this work easier. 1. Replace all `Notice` tags with `Admonition` tags. 2. Add `type="info"` if an Admonition is missing a type. To find instances: ``` find docs/pages -name "*.mdx" -exec awk ' BEGIN{a=0} a==0 && /<Admonition/{ a = 1 } a==1 && /type/{t = 1} a==1 && />/{ a = 0; if(t == 0) print FILENAME ":" FNR }' {} \; ``` 3. Replace `type="notice"` with `type="note"`. To find instances: ``` find docs/pages -name "*.mdx" -exec awk ' BEGIN{a=0} a==0 && /<Admonition/{ a = 1 } a==1 && /type="notice"/{t = 1} a==1 && />/{ a = 0; if(t == 1) print FILENAME ":" FNR }' {} \; ```
80 lines
3.0 KiB
Plaintext
80 lines
3.0 KiB
Plaintext
---
|
|
title: Teleport Proxy Service
|
|
description: Architecture of Teleport's identity-aware proxy service
|
|
h1: Teleport Identity-Aware Proxy Service
|
|
---
|
|
|
|
The Teleport Proxy Service is an identity-aware proxy with a web UI. The Teleport Proxy Service
|
|
provides the following key features:
|
|
|
|
- Enables users to authenticate with a single sign-on identity provider or local credentials to access
|
|
SSH and Windows desktops using the Teleport web UI.
|
|
- Intercepts traffic for multiple protocols, including SSH, Kubernetes, HTTPS,
|
|
and databases, and ensures that only authenticated clients can connect to target resources.
|
|
- Provides networking and connectivity so that servers and proxies behind firewalls can connect
|
|
using reverse tunnels.
|
|
- Enables system administrators to use TLS routing feature to compress all ports for all protocols
|
|
to one TLS port using TLS routing feature.
|
|
- Records commands and API calls, and queries and streams them to the audit log.
|
|
The audit log is stored on one of the Teleport Auth Service
|
|
[backends](../backends.mdx).
|
|
|
|
|
|
|
|
<Admonition type="tip">
|
|
To create a minimal Teleport cluster, you have run two services:
|
|
Teleport Auth Service and Teleport Proxy Service. For your home lab,
|
|
you can run both services as a one binary and process.
|
|
</Admonition>
|
|
|
|
## Web UI
|
|
|
|
In Web UI, Teleport Proxy implements WSS - secure web sockets - to proxy a
|
|
target resource, for example SSH server or Desktop:
|
|
|
|
|
|
|
|
<Admonition
|
|
type="note"
|
|
title="TLS Encryption"
|
|
>
|
|
When using the web UI, the Teleport Proxy terminates traffic and re-encodes data for the client connection.
|
|
</Admonition>
|
|
|
|
## Identity-Aware-Proxy
|
|
|
|
In IAP mode, users initiate the SSO or login flow to sign public keys on their client machines:
|
|
|
|
|
|
|
|
<Admonition
|
|
type="note"
|
|
title="IAP Mode Security"
|
|
>
|
|
We consider IAP mode more secure than Web UI access, because private keys never leave user's client.
|
|
Client's connection to resource is mutually authenticated. This mode is also less vulnerable
|
|
for web-related attacks, like CSRF or cookie hijacking, because browser is used less.
|
|
</Admonition>
|
|
|
|
## Tunnels
|
|
|
|
In this mode, resources behind firewall can establish reverse tunnels back to proxies.
|
|
Proxies will forward client's connections to target resources via those tunnels.
|
|
|
|
In the example below, Alice connects to kubernetes cluster behind firewall via two tunnels:
|
|
|
|
|
|
|
|
<Admonition type="tip">
|
|
All modes above are turned on by default in Proxies. No special configuration is necessary, unless you
|
|
want to turn some of those modes off.
|
|
</Admonition>
|
|
|
|
## More concepts
|
|
|
|
- [TLS Routing](tls-routing.mdx)
|
|
- [Architecture Overview](../../core-concepts.mdx)
|
|
- [Teleport Authentication](authentication.mdx)
|
|
- [Teleport Authorization](authorization.mdx)
|
|
- [Teleport Proxy](proxy.mdx)
|