mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-04 02:21:02 +08:00
Paul Gottschling
e6b6f5be1b
Fixes #10976 This change helps to remedy two issues with the documentation: - Much of the documentation was written when Teleport's services consisted of the Auth Service, Proxy Service, and Nodes/SSH Service. There are some places in the docs where a reader can mistake the Node Service to mean "any resource service." - Users often associate the term "agent" with a daemon that must run on every host in their infrastructure, and usage of this term can make Teleport seem more resource intensive than it actually is. This change corrects mentions of "Node" that stand in for "any service that access resources in your infrastructure" to account for Teleport's other resource services. It also replaces mentions of the term "agent" with "instance," the name of a resource service, or simply "Teleport." Also edits the "agentless" question in the FAQ to include more detailed information about each of Teleport's resource services. This change also does some light copy-editing to correct the capitalization of service names. It doesn't aim to be comprehensive, though, since the main purpose of this change is to fix potentially misleading mentions of "Node" and "agents". Finally, this change deletes the production.mdx guide, as there is no way to access this guide due to redirects. This guide includes some outdated usage of "Nodes".
23 lines
1.2 KiB
Plaintext
23 lines
1.2 KiB
Plaintext
<Details title="Before you begin: read security tips" opened={false}>
|
|
|
|
When running Teleport in production, we recommend that you follow the
|
|
practices below to avoid security incidents. These practices may differ from
|
|
the examples used in this guide, which are intended for demo environments:
|
|
|
|
- Avoid using `sudo` in production environments unless it's necessary.
|
|
- Create new, non-root, users and use test instances for experimenting with Teleport.
|
|
- Run Teleport's services as a non-root user unless required. Only the SSH
|
|
Service requires root access. Note that you will need root permissions (or
|
|
the `CAP_NET_BIND_SERVICE` capability) to make Teleport listen on a port
|
|
numbered < `1024` (e.g. `443`).
|
|
- Follow the "Principle of Least Privilege" (PoLP). Don't give users
|
|
permissive roles when giving them more restrictive roles will do instead.
|
|
For example, assign users the built-in `access,editor` roles.
|
|
- When joining a Teleport resource service (e.g., the Database Service or
|
|
Application Service) to a cluster, save the invitation token to a file.
|
|
Otherwise, the token will be visible when examining the `teleport` command
|
|
that started the agent, e.g., via the `history` command on a compromised
|
|
system.
|
|
|
|
</Details>
|