mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-03 16:38:35 +08:00
Noah Stride
6f6545d201
* Remove references to role creation in deployment guides * Update access guides to demo role creation * Explain permissions assignment better * Fix reference to role
118 lines
3.6 KiB
Plaintext
118 lines
3.6 KiB
Plaintext
---
|
|
title: Deploying Machine ID on Linux
|
|
description: How to install and configure Machine ID on a Linux host
|
|
---
|
|
|
|
This page explains how to deploy Machine ID on a Linux host.
|
|
|
|
The process in which `tbot` initially authenticates with the Teleport cluster is
|
|
known as joining. A join method is a specific technique for the bot to prove its
|
|
identity.
|
|
|
|
On platforms where there is no form of identity available to the machine, the
|
|
only available join method is `token`. The `token` join method is special as
|
|
it is the only join method that relies on a shared secret. In order to mitigate
|
|
the risks associated with this, the `token` join method is single use and it
|
|
is not possible to use the same token multiple times.
|
|
|
|
## Prerequisites
|
|
|
|
(!docs/pages/includes/edition-prereqs-tabs.mdx!)
|
|
|
|
- (!docs/pages/includes/tctl.mdx!)
|
|
- A Linux host that you wish to install Machine ID onto.
|
|
- A Linux user on that host that you wish Machine ID to run as. In the guide,
|
|
we will use `teleport` for this.
|
|
|
|
## Step 1/4. Install `tbot`
|
|
|
|
**This step is completed on the Linux host.**
|
|
|
|
First, `tbot` needs to be installed on the VM that you wish to use Machine ID
|
|
on.
|
|
|
|
Download the appropriate Teleport package for your platform:
|
|
|
|
(!docs/pages/includes/install-linux.mdx!)
|
|
|
|
## Step 2/4. Create a bot user
|
|
|
|
**This step is completed on your local machine.**
|
|
|
|
Create the bot:
|
|
|
|
```code
|
|
$ tctl bots add example
|
|
```
|
|
|
|
A join token will be included in the results of `tctl bots add`, record this
|
|
value as it will be needed when configuring `tbot`.
|
|
|
|
## Step 3/4. Configure `tbot`
|
|
|
|
**This step is completed on the Linux host.**
|
|
|
|
Create `/etc/tbot.yaml`:
|
|
|
|
```yaml
|
|
version: v2
|
|
proxy_server: example.teleport.sh:443
|
|
onboarding:
|
|
join_method: token
|
|
token: (=presets.tokens.first=)
|
|
storage:
|
|
type: directory
|
|
path: /var/lib/teleport/bot
|
|
# outputs will be filled in during the completion of an access guide.
|
|
outputs: []
|
|
```
|
|
|
|
Replace:
|
|
- `example.teleport.sh:443` with the address of your Teleport Proxy or
|
|
Auth Server. Prefer using the address of a Teleport Proxy.
|
|
- `(=presets.tokens.first=)` with the token that was returned by `tctl bots add`
|
|
in the previous step.
|
|
|
|
<Notice type="note">
|
|
The first time that `tbot` runs, this token will be exchanged for a certificate
|
|
that the bot uses for authentication. At this point, the token is invalidated.
|
|
This means you may remove the token from the configuration file after the first
|
|
run has completed, but there is no tangible security benefit to doing so.
|
|
</Notice>
|
|
|
|
### Prepare the storage directory
|
|
|
|
When using the `token` join method, `tbot` must be able to persist its state
|
|
across restarts. The destination used to persist this state is known as the
|
|
bot's "storage destination". In this guide, the directory
|
|
`/var/lib/teleport/bot` will be used.
|
|
|
|
As this directory will store the bots sensitive credentials, it is important
|
|
to protect it. To do this, you will configure the directory to only be
|
|
accessible to the Linux user which `tbot` will run as.
|
|
|
|
Execute the following, replacing `teleport` with the Linux user that you will
|
|
run `tbot` as:
|
|
|
|
```code
|
|
# Make the bot directory and assign ownership to teleport user
|
|
$ sudo mkdir -p /var/lib/teleport/bot
|
|
$ sudo chown teleport:teleport /var/lib/teleport/bot
|
|
```
|
|
|
|
### Create a systemd service
|
|
|
|
(!docs/pages/includes/machine-id/daemon.mdx!)
|
|
|
|
## Step 4/4. Configure outputs
|
|
|
|
(!docs/pages/includes/machine-id/configure-outputs.mdx!)
|
|
|
|
## Next steps
|
|
|
|
- Follow the [access guides](../access-guides.mdx) to finish configuring `tbot` for
|
|
your environment.
|
|
- Read the [configuration reference](../reference/configuration.mdx) to explore
|
|
all the available configuration options.
|
|
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../reference/telemetry.mdx)
|