mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-19 10:10:29 +08:00
Paul Gottschling
149340f6d5
Implements part of RFD 246 Help new users understand what is involved in deploying a Teleport cluster by moving the self-hosting documentation into the Installation section. This way, we can include all information related to running Teleport processes in the same part of the docs. Docs related to Teleport features but not first-time deployments do not belong in the Installation section, so this change moves them into the Management section instead: - Configure Trusted Clusters - TLS Routing Migration - Guides in `zero-trust-access/deploy-a-cluster/reliability` Also edit the Installation landing page to make self-hosting guidance clearer. Merge the H2 sections re: self-hosting and cluster setup and provide a clearer experience for users, with a table of cluster components.
231 lines
10 KiB
Plaintext
231 lines
10 KiB
Plaintext
---
|
|
title: Teleport FAQ
|
|
description: Frequently Asked Questions About Using Teleport
|
|
tags:
|
|
- faq
|
|
- platform-wide
|
|
---
|
|
|
|
This page includes answers to frequently asked questions about setting up,
|
|
managing, and using Teleport. If you are new to Teleport, read our [Getting
|
|
Started Guide](./get-started/get-started.mdx).
|
|
|
|
## Can I use Teleport in production today?
|
|
|
|
Teleport has been deployed on server clusters with thousands of hosts at
|
|
Fortune 500 companies. It has been through several security audits from
|
|
nationally recognized technology security companies, so we are comfortable with
|
|
the stability of Teleport from a security perspective.
|
|
|
|
## Can I connect to nodes behind a firewall?
|
|
|
|
Yes, Teleport supports reverse SSH tunnels out of the box. To configure
|
|
behind-firewall clusters, see [Configure Trusted Clusters](zero-trust-access/management/trustedclusters.mdx).
|
|
|
|
## How is Teleport's Community Edition different from Enterprise?
|
|
|
|
Teleport provides two editions:
|
|
|
|
- Teleport Enterprise
|
|
- Teleport Community Edition
|
|
|
|
For a detailed breakdown of features by edition, alongside a description of the
|
|
products available to Teleport users, see [Teleport
|
|
Editions](./feature-matrix.mdx).
|
|
|
|
## Should we use Teleport Enterprise or Teleport Community Edition for connecting resources to our Teleport cluster?
|
|
|
|
(!docs/pages/includes/ent-vs-community-faq.mdx!)
|
|
|
|
## Can individual agents create reverse tunnels to the Proxy Service without creating a new cluster?
|
|
|
|
Yes. When running a Teleport Agent, use the `--auth-server` flag to point to the
|
|
Proxy Service address (this would be `public_addr` and `web_listen_addr` in your
|
|
file configuration). For more information, see
|
|
[Adding Nodes to the
|
|
Cluster](installation/agents/join-token.mdx).
|
|
|
|
## Can Nodes use a single port for reverse tunnels?
|
|
|
|
Yes, Teleport supports tunnel multiplexing on a single port. Set the
|
|
`tunnel_listen_addr` to use the same port as the `web_listen_addr` address
|
|
setting in the `proxy_service` configuration. Teleport will automatically use
|
|
multiplexing with that configuration.
|
|
|
|
## Can Teleport be deployed in agentless mode?
|
|
|
|
Yes. All Teleport services support agentless mode, where the service proxies
|
|
traffic to an upstream infrastructure resource not available on `localhost`.
|
|
|
|
With Teleport in agentless mode, you can easily control access to SSH servers,
|
|
Kubernetes clusters, desktops, databases, and internal applications without
|
|
running any additional software on your servers. Agentless mode supports session
|
|
recordings and audit logs for deep understanding into user behavior.
|
|
|
|
For capabilities such as kernel-level logging and user provisioning, we
|
|
recommend Teleport as a drop in replacement for OpenSSH. Since Teleport replaces
|
|
the OpenSSH agent while preserving OpenSSH's functionality, you get more
|
|
functionality without a net addition of an agent on your system.
|
|
|
|
## Can I use OpenSSH with a Teleport cluster?
|
|
|
|
Yes, this question comes up often and is related to the previous one. Take a
|
|
look at [Using OpenSSH Guide](enroll-resources/server-access/openssh/openssh-agentless.mdx).
|
|
|
|
## Can I copy files from one Teleport node to another?
|
|
|
|
Yes, Teleport supports node-to-node file transfers. Here is an example of copying from one
|
|
SSH server to another.
|
|
|
|
```code
|
|
$ tsh scp bob@foo:/path/1.txt bob@bar:/path/2.txt
|
|
1.txt 100% |█████████████████████████████████████████████████████████████████| (779/779 B, 8.2 kB/s)
|
|
```
|
|
|
|
In addition Teleport supports [Headless Authentication](zero-trust-access/authentication/headless.mdx),
|
|
which allows you to perform operations like `tsh ssh` or `tsh scp` from remote systems where you
|
|
are not logged in to Teleport or may not have access to a browser to authenticate.
|
|
|
|
## `tsh` is very slow on Windows, what to do?
|
|
|
|
If your host machine is joined to an Active Directory domain, you might find
|
|
user lookups take a lot longer than you expect. If possible, we recommend
|
|
updating `tsh` to v18 or later, which contains an optimized user lookup
|
|
algorithm.
|
|
|
|
If upgrading is not possible, you can use environment variables to set default
|
|
account information for your Teleport user. If you are experiencing long lookup
|
|
times on Windows, do the following:
|
|
|
|
- Either set the `TELEPORT_USER` environment variable or set the `--user` flag to the name of your Teleport user.
|
|
- Either set the `TELEPORT_LOGIN` environment variable or set the `--login` flag to the name of current host user. This setting can be overridden if you open a new SSH session on a machine as a different user.
|
|
- Set the `TELEPORT_HOME` environment variable to be the home directory of your current host user + `\.tsh`. For example, if your home directory is `C:\Users\Me`, you'd set `TELEPORT_HOME` to `C:\Users\Me\.tsh`.
|
|
|
|
You can set these environment variables globally in Windows so that you don't have to set them every
|
|
time you run `tsh`.
|
|
|
|
## Which version of Teleport is supported?
|
|
|
|
See [Upcoming Releases](upcoming-releases.mdx) for the versions of Teleport that
|
|
we support and how long we plan to continue supporting them.
|
|
|
|
## Does the Web UI support copy and paste?
|
|
|
|
Yes. You can copy and paste using a mouse.
|
|
|
|
## What TCP ports does Teleport use?
|
|
|
|
Please refer to our [Networking](reference/deployment/networking.mdx) guide.
|
|
|
|
## Does Teleport support authentication via OIDC, SAML, or Active Directory?
|
|
|
|
Teleport offers this feature for the Enterprise (Cloud) and Enterprise
|
|
(Self-Hosted) versions of Teleport.
|
|
|
|
## Why do changes to a user's role set only take effect on the next login?
|
|
|
|
A Teleport user's assigned roles are embedded in the client certificate they
|
|
receive upon logging on. This certificate remains valid and can be used until
|
|
its expiry, even if the user's role set has changed.
|
|
|
|
To get a new certificate with the new role set, the user will need to log out
|
|
and log back in.
|
|
|
|
Revocation of Teleport access should be done with Teleport's
|
|
[session and identity locks](identity-governance/locking.mdx),
|
|
not by removing roles.
|
|
|
|
## Does Teleport support provisioning users via SCIM?
|
|
|
|
Teleport supports [SCIM](https://scim.cloud/) provisioning for Okta via the
|
|
hosted Okta integration, available in the Enterprise (Cloud) and Enterprise
|
|
(Self-Hosted) versions of Teleport.
|
|
|
|
Refer to the [hosted Okta integration guide](identity-governance/integrations/okta/okta.mdx)
|
|
for details on setting up and configuring SCIM support.
|
|
|
|
You can also set up Teleport to integrate with a SCIM provider to automatically
|
|
synchronize SCIM group memberships with Teleport Access Lists. For details, see
|
|
the [SCIM integration
|
|
documentation](identity-governance/integrations/scim/scim.mdx).
|
|
|
|
## Why do I see an alert that some agents are out of date?
|
|
|
|
Teleport monitors the inventory of all cluster components and compares their
|
|
Teleport versions with the latest release on our GitHub page. If a component is
|
|
not on the latest release, Teleport will create a cluster alert encouraging
|
|
users to upgrade.
|
|
|
|
This check is performed against all cluster components, including the Proxy
|
|
Service and Auth Service, as well as agents running other Teleport Services.
|
|
|
|
## What is the minimum TLS version that Teleport requires?
|
|
|
|
Teleport requires a minimum of TLS version 1.2.
|
|
|
|
This means that when applications and clients establish or accept TLS
|
|
connections with Teleport processes, they must use TLS 1.2 or a higher protocol
|
|
version. Teleport enforces this requirement in all operations that involve TLS
|
|
connections.
|
|
|
|
## Can I suppress warnings about available upgrades?
|
|
|
|
Yes. The `tctl alerts ack` command can be used to acknowledge an alert and
|
|
temporarily prevent it from being displayed to users. To acknowledge an alert,
|
|
you need its ID. You can get a listing of all alerts and their IDs with the
|
|
`tctl alerts list` command.
|
|
|
|
For detailed information on this family of commands, see the
|
|
[CLI Reference](./reference/cli/tctl.mdx#tctl-alerts-list).
|
|
|
|
## Does Teleport send any data back to the cloud?
|
|
|
|
The open source edition of Teleport does not send any information to our
|
|
company, and can be used on servers without internet access.
|
|
|
|
The commercial editions of Teleport can optionally be configured to send
|
|
anonymized information, depending on the license purchased. This information
|
|
contains the following:
|
|
|
|
- Teleport license identifier;
|
|
- anonymized cluster name and Teleport Auth Service host ID;
|
|
- for each Teleport user, the anonymized user name and a per-protocol count of
|
|
interactions - Teleport logins, SSH and Kubernetes exec sessions, Application
|
|
access web sessions and TCP connections, SSH port forwards, Kubernetes API
|
|
requests, SFTP actions.
|
|
|
|
The anonymization is done by passing names and IDs through HMAC-SHA-256, with a
|
|
HMAC key that's randomly generated when the Teleport cluster is initialized for
|
|
the first time and is never shared with us; this makes it infeasible for anyone
|
|
without access to the cluster to deanonymize the data we store.
|
|
|
|
The code that aggregates and anonymizes this data can be found [in our
|
|
repository on
|
|
GitHub](https://github.com/gravitational/teleport/tree/master/lib/usagereporter/teleport/aggregating).
|
|
|
|
For more details, see the [Usage Reporting and Billing](./usage-billing.mdx)
|
|
guide.
|
|
|
|
Reach out to `sales@goteleport.com` if you have questions about the commercial
|
|
editions of Teleport.
|
|
|
|
### Teleport Connect
|
|
|
|
(!docs/pages/includes/teleport-connect-telemetry.mdx!)
|
|
|
|
If you no longer want to send usage data, see [disabling telemetry](connect-your-client/teleport-clients/teleport-connect.mdx#disabling-telemetry).
|
|
|
|
### How do I update my security and business contacts?
|
|
|
|
Teleport Enterprise Self-Hosted users can configure up to 3 security contacts and 3 business contacts for their cluster. It's important to
|
|
keep these up to date so that we always know who to notify of important updates and alerts.
|
|
|
|
To do this, log in to your Teleport License dashboard with the email address of the user that created the dashboard initially. Open
|
|
the user dropdown menu on the top right of the navigation bar, and select "Help & Support," then scroll down until you see the contacts sections.
|
|
Once you add a contact, they will receive an invitation email which they must accept within 14 days.
|
|
|
|
|
|
|
|
If you don't see the contacts lists on the Help & Support page, ensure that you are logged into the Teleport License dashboard and not your self-hosted cluster,
|
|
and ensure that your user has the `dashboard-admin` role. Users with the `dashboard-user` role cannot edit contacts.
|