0:57 Introduction

0:57 Hello. Hello. Hello. Welcome back to the Rawkode Academy. Today, we have another workshop as part of the complete guide to Teleport course. Today, we'll be diving deep into a role based access control. Taking a look at what Teleport provides for us to secure our infrastructure, using a paradigm that we're hopefully all familiar with from other systems such as Kubernetes. All right. Hello, Abdul. Welcome. Hello, Jeffrey. Thank you for joining. So I'm gonna dive straight in. If you've been following along with this course, then you'll know that all the README files are on GitHub. You can find them at github.com/rockwoodacademy/courses.

1:07 Workshop Goals: Access Control & RBAC Deep Dive

1:56 This is part 10, the RBAG deep dive, and we've got six, six exercises. I can't even remember. Six exercises to work through today to kind of introduce us and show us all of the cool things that Teleport brings along with its RPAC model. So we're gonna start off nice and simple. Now, the setup required, if you want to follow along on your own time, or even just do this at your own time, is that you will need a uninitialized Teleport cluster. So what do I mean by uninitialized? Well, just that you have installed Teleport. You can have started Teleport, but we haven't

2:42 really created that first user yet. And that's where I'm gonna start from today. So let's make this a little bit bigger, go. And our first exercise is really just to get familiar with the base roles that Teleport provides out of the box. So by default, Teleport provides editor, auditor, and access roles. The editor role allows editing of cluster configuration and settings. Auditor will allow you to read cluster events, audit logs and playback session records. And access gives you access to the resources that are secured with Teleport, which could be nodes with the agent on it, applications that are heading behind

2:55 The Base Roles

3:33 the proxy, Kubernetes clusters, and as of recently with Teleport eight, Windows desktop access. So all those things that Teleport secures can be available via the access role, which makes sense slightly intimidating, but we're gonna show you today how to get more fine grained permissions with this model. Okay. So Abdul, waiting for this. This is the first time it was scheduled. Yeah. I have had to delete this this session a few times because of sickness and because of bad weather in Scotland, which makes getting to my office a little bit more difficult. It's just been a bit tricky, but I'm

4:15 really glad that we get to do it today. Mozz is asking, does Teleport apply a rule on an active connection? I'm gonna have to interpret what I think you're asking there. So if we if you log in and you have a role that is assigned to you, any changes to that role will apply to your active session. If your role is if you have a role added to your account while you're logged in, you'll have to log out and back in to have access to that role. If you're logged in and a role is removed from you, Teleport gets quite angry and

4:51 will actually encourage you to log back out. So hopefully that answers your question. Excuse me. Jeffrey. Oh, another Jeffrey. Hello, Jeffrey. Welcome. And Mozz, I've just answered that one. Cool. So these workshops are 100% interactive. Please get your questions and I will do my best to answer anything that I can. And anything that I can't answer is material for me to go and research and make more awesome videos sharing this awesome tool. Okay, so we've got three base roles available to us by default. I have included the roles at the bottom and I figured we could

5:31 Examining Default Role Manifests (YAML Structure)

5:32 maybe just take a look at what is available inside of this specification, so we understand how it works. So this is the editor role and you can see they've pretty much got access to all resources and every command available to it. So this is their everything role that allows you to pretty much do whatever you want. And you can see that we can modify the OpenID Connect integration. We can actually modify roles, users, and we can change the SAML configuration, the GitHub authentication integration, everything. All the way down. But there's no ability here to access

5:40 Editor Role

6:12 any applications, nodes, Kubernetes clusters, etcetera. And there is no session replay or other things. So you don't get everything, but you get a lot at least on an administrative or operational point of view. Then we have the auditor role. So we can see here that they have the ability to list and read sessions. They can also list and read the events. Now it doesn't matter if you're not familiar with how these exposed via the CLI or the UI, we'll be taking a look at all of us again in a few short moments. I'm not actually sure what this login is.

6:31 Auditor Role

6:56 I think it's just there to provide an empty list so the default isn't included. I should really check, but we're just gonna ignore that one for now anyway. And then we have the access role, which pretty much ships with a bunch of stars. And we'll talk about what that means and we'll even modify a role very much like this in today's session. So the access gives us access to the applications behind Teleport. Star star means all applications. If we want to be able to access databases, we've got. Now this is where we see this handlebar

7:29 syntax, much less syntax depending on what community and ecosystem you come from. This is interpolation inside of Teleport and this means that the value is going to be handled just in time based on the user that is logged in. When we see internal dot, this is a trait as an exercise where I will explain that in more detail later. But it just means that although the database labels says that you have access to all databases, the names of the databases that you can access and the users that you can access the databases as, is not a star, and that's important.

8:05 I'm not gonna cover impersonation in today's workshop, mostly because of time constraints, but more importantly is that I haven't really found a use case for Teleport's impersonation that I like. The examples from the website, and maybe we'll take a look at them towards the end, I'm talking about having an account and a CICD process that can take on an elevated permissions for a short time. But I haven't been able to find a way to integrate that into my own workflows. And I don't really wanna be disingenuous and show it off. But if you have a use case that makes sense for you,

8:40 share it with me. I'd love to know. But I I personally haven't found a real world use case for impersonation that I want to share with anyone. Okay. We then have access to the Kubernetes scripts, labels and users. We've got logins. So, you know, when you have access to Starstar nodes, well, what logins can I use to access those nodes? By default, it is the ones provided when we create the account. Node labels, and then there's a little bit of rules just meaning you can access notes, then you can listen with the events, which makes a lot of sense. We then

9:18 Windows Desktop Integration

9:18 got the Windows desktop integration and then some boring stuff at the bottom. So you can see these manifests look like Kubernetes manifests. So they feel instantly familiar. They're using the same concept of resource and verb again, instantly familiar if you're coming from a Kubernetes background. So after a little bit of trial and error and playing and customizing roles with your own Teleport clusters, this becomes really easy to work with. So I hope you have some fun with it. Okay. So let's go back up to this first exercise and we've entered just the roles. What we wanna do is now just get

9:53 access to the cluster that we have that is uninitialized, and we're gonna just kinda cover this command. Like we've typed this many times throughout this course, but never really digged into what it meant to be an editor, an auditor, and have access to Teleport resources. And now we do. Okay. Let's see. We got a couple more hellos and then I'll start typing some stuff in a terminal. Evan Ash, welcome back. And Russell, welcome back to you too. Hello. I have been tweaking and playing with my audio like mad. So I hope that I sound all right. And if there are any

10:31 problems, please do let me know. Alrighty. Let's see. So here is my Teleport cluster, teleport.rockode.live, there's no user created yet, I cannot log in, we have to do that first. So I'm gonna jump over to here and log in to teleport.rawcode.live. I feel like my font has gotten smaller. It has, hasn't it? If I've been changing my font size, let's just quickly bump that back up. There we go. Russell. He still sounds Scottish, is that intentional? Aye, it is. Just be glad you're getting my English voice on these dreams and not my Scottish voice. Anyway,

11:00 Creating the Initial User (`tctl users add`)

11:34 okay. Focus. We wanna run back to my course. We wanna run this command. So Teleport Control, TCTL, users add, I'm going to add a user for me, Rawkode. We're going to assign the roles, editor, auditor, and access. I hit return, we get the link that will allow us to pop this open and register our account. I will say use this password, we'll call this Rawkode live stream. My username is Rawkode and we'll hit save and I'll just need to copy Rawkode livestream. Where is it? That password just appeared. Oh, but it's showing up there. That's okay.

12:43 I'm gonna have to open this here. So that I can scan my QR code and paste this in. Sweet. We now have access to our Teleport cluster and let's see. Okay. So Jeffrey, what about impersonate a Kubernetes grouper user to see what kind of access and permissions that user would have? Yeah. That's interesting. Hey, I guess you could have it configured in a way where, yeah, you could elevate your privileges inside of a Kubernetes cluster to run some integration tests or something like that. There could be something there, I'm gonna think about that a little bit more.

13:00 Initial Web UI Overview and Missing Server Debugging (Part 1)

13:38 And Khalid, hey man, welcome back. Okay, so we have access to our cluster, there's nothing in this, this is uninitialized Teleport, at least it was until we got started creating our account, but you can see that we've got the ability to view activity and recession records and auto logs. This is the auditor role. The editor role is the one where I can modify users roles and off connections also available here. Custers not doing anything with, but what we do want to do is just I actually expected the server to be here. We will just enable that then. We

14:15 wanna take a look at something I omitted intentionally from our TCTL command here. And if you've already spotted that, feel free to say in the comments, but I am going to quickly modify our Teleport YAML here. We do have an SSH service on. Peculier. I don't wanna debug on this show. Come on. I already have that running. Alright. Quickly, what have I missed? What have I missed? What have I missed? This is I'm gonna restart Teleport. I can always start another SSSSSSSSSS proxy. Okay. So I'm a bit confused normally. In fact, every other time that I have

16:19 done this, the server where our Teleport process is running would show up here. And that is not the case. Alright. Well, you know what? We can fix this. Let's go to the Teleport documentation. Or docs. Oh, what's that? There we go. And server access, getting started. I can always add a static node and start this proxy on my own. That is exactly how I set up my cluster. Okay. Let's just make it work. Not important. I'm not offended. Teleport is all good. This is a node token. Probably shouldn't show you that. And we'll start another teleport thing.

17:46 Change that token path. I really should just do the static one, shouldn't I? I was trying to be better than that. ML server is Teleport.Rawkode.live44three. E S c h. Classy. Cool. Connected. Teleport. Is this a permission this year already? I haven't done anything exciting yet. Oh, and now my building is having Pericos. Am I still alive? This is the start of a horror movie, isn't it? I think I'm still alive. Well, Moza has given me hints for my Teleport cluster problem, so hopefully I'm still alive. Okay. I'm confused, but I'm gonna assume I have done something wrong,

19:34 but we can fix that. And I've done this all this Teleport cluster today. I'm not sure if I'm on the well, I will be on the definitely on a % on the latest version. I don't know if something has changed. So we're gonna try and fix it all. So we're gonna do I'm gonna close this thing because I don't think I need to be running this. And I don't see servers, so I think it's permission issue. Now let's go back to the workshop for a second and we'll cover what I should have covered. So if we look So we're created a user

19:48 Exercise 2: User Traits and Logins Explained

20:02 and exercise two is to introduce us. Thank you, Miles. Thank you for confirming the install online even though power did appear to go out for a few seconds. So I wanna introduce you to traits and Teleport. And what I'm saying here is that before we talk about that, I want you to Teleport using to SSH enter the node using Teleport and run Whoami. And you actually can't do that yet because we didn't specify which logins our user had access to on our tctl users add command. Typically, when we've done this before in the course, we see logins root,

20:12 Modifying User Traits to Enable Server Access

20:41 which means I will have the ability to log in to all of the machines as the root user. So we can't actually do that and the reason why is because of Teleport's traits. Now when we went through the role YAML at the start, we kind of, I introduced it a little bit and said that anytime you see interpolation syntax, mustache slash handlebars with internal dot, that this is going to be a trait that is applied or inherited from the user and to the role just in time. So, well, the access role allows connecting to Teleport node, it does use a it does

21:18 use a trait. So, what I suggest we do here is to pull down our user. Now you can edit some stuff from the UI, but I'm gonna try and use the CI as much as possible and the YAML format, because this is what at the end of the day is gonna be automatable by you and your systems. And while we're doing this, we're gonna try and debug why I don't have access to the node. So the first thing I'm going to do is pull down my user, my user is actually Rawkode here, not my email address,

21:56 like so. And this will get me the YAML for my user. So we can ignore the metadata, we can see that I do have the rules that I expected to have. We've got some Kubernetes traits that we don't need to worry about at the moment and logins is null. What I'm gonna do is get myself access to, to the root user, and we can save this. I can then use TCTL create dash F Rawkode to apply this back to the cluster. Now, if we come to the server and go to team and users, If I click on edit, you'll see we

22:45 only have the ability to change the rules. We can't actually do the traits through the UI. Although when it comes to rule stuff, you can change most, if not everything for the UI. So let's see how this access thing works with that trait that we have. So we've got the access rule where app is star star, Kubernetes is not star star, node labels is star star. There is no reason I shouldn't be able to SSH onto this node right now. But logins here, you can see that it's using that logins value trait from my user

23:00 Verifying Server Access and Trait Application

23:26 account. I could also modify this rule and just say that anyone with access has root access to the box, and that would also work just fine. Let's jump back in. This looks good. Oh, there we go. And now it's showing up. So let's work out why, because I'm not happy with that. I'm gonna change this back to the trait for the logins, right? So, because I've added that to my user account login, like so, and that's save. And it's not there. Cool. So this makes a little bit of sense. This must be something new that the Teleport

24:19 has changed. And I'll explain that in just a second. In fact, we can test my hypothesis, which is gonna be even more fun. So when I changed the role, because I am logged in with the role access right now, I immediately seen the server when I changed the role and to not use the trait and to be hardcoded with Root. However, when I modified my user, I did not re log in again and that trait is not part of the certificate that identifies me. And my hypothesis is that Teleport Agent is now user aware on the host and knows that I have

25:00 no users available on that machine to connect to. What used to happen was you could click connect, use the trait value of your username, and then it would crash or at least you'd get the terminal, but it would say there is no user. And I really wanna test this. Although I'm I'm now curious if I create a user, the add user, user add Rawkode, whether the agent will detect that or I'll have to restart Teleport. But I'm still more than happy to find out. Now if I want to get myself a home directory, I can't remember how to do

25:34 that. Dash d for defaults. So, nope. Alright. User add Rawkode is. Okay. Home there. I don't know what's gonna happen. But let's let's test. Okay. So it's not allowing me. Restart Teleport. I thought it was good to take the user and let me do it. Anyway, let's log out, get our trait value into our certificate, and then we'll have access to that machine. There we go. Cool. That's interesting. Yeah. Let's see. Normally that's with less my trait value of Rawkode two, but it's not. So I'm gonna work that out, but I'm not gonna do it on this stream because

26:32 we've got too much to cover. Okay. Let's see. Mozz says, can see me. Thank you. Mozz has a question. Is it possible to set the login to star so the user can I've never tried. I have never tried, but we can try it. So let's just do it. Right? Does Teleport keep logs what users do within their sessions? Oh yeah. Everything is logged. Let's see. So let's click connect. I don't know why my one password thing keeps showing up there. Type who am I? It says root, close the session. We'll come over to activity from there. If we had an active session,

26:51 Teleport Audit Logs and Session Recordings

27:17 we could actually join it. We have session recordings, which will actually allow me to see my typing. And what I love, that is my favorite feature in the whole world, that you could scroll back. So you can watch the entire session, see every command, every piece of output, you know exactly what they did. It's just an amazing feature. And we also have the audit log, so you'll see all the sessions that were opened, when I logged in again, certificate session, users created, everything is available here too. Can pop in here. There's some cool things you can do that we're gonna try and

27:38 Audit Log

27:54 do on Mondays. So the last workshop is where we talk about how to move Teleport into production, And we'll be looking at turning on some of the more sophisticated eBPF options that give you much better visibility into the commands that were used. So, yeah, we'll cover more of that then, Jeffrey. Cool. So let's test because it's slightly off script, but I think that'll be fine, is just to add a star to the login tree. Yeah, I'll just do my trait and I'm load back in. So, we can modify my user and here, I have no idea what's going to happen.

28:42 Now we modified the trait and not the rule, so we do need to log back in. You get a star. So normally that would say Rawkode by default. And then you would get a thing saying unknown user, which is why I thought I couldn't see the server, but I did see the server when we added me the logins. Okay. Very cool. That's what it is. If your user has an empty login tree, it doesn't show you servers. Whereas I guess I was expected to list the servers, but it didn't. Normally I would get my username.

29:29 Interesting. All right, moving on. So the star doesn't work. Would have been cool. Although I'm not sure what I would want it to do, would it like list? Would it give me access to every user and the password file? Like, would I be able to connect as message bus or at least try to? Some of these accounts are obviously no login, but yeah, I'm not sure why I would expect the behavior to be there. Maybe I should only see ones with an actual shell. Okay. Oh, yeah. Workshop. We're busy. So now that we have added the logins

30:00 Exercise 3: Modifying User Roles (`tctl users update`)

30:02 trait to my user, we can well, we did SSH in and run whoami. We modified the trait include root and do that. Done. Okay. Exercise three has where we're going to edit some rules. We've already kind of done this and prompt you because I was debugging why I couldn't see the servers, but let's do this properly this time. So what I'm seeing here is, well, we can use t control users username to pull down the YAML. There is a helper that will allow you to modify the rules. And this is quite interesting. So let's cover some of the

30:44 things that happen here. So if I do users update Rawkode and I set it to editor and access, this will remove my auditor role, like so. And in fact, I think what's gonna happen here, if I refresh this, it's still working. Normally it would complain at me. Let's all go back in. Well, maybe my, maybe my, oh, my access rule gives me ability to audit as well. So let's remove that too. Let's just give me editor. Cool. Now we can come in here. I still got some stuff. Let's log out. Okay. So the roles were encoded into my certificate,

31:48 I guess. So even though I was removed, I'd have to wait for the certificate to expire before I lost my access. I guess what I did during my testing, it made me think it was gonna yell at me. It was I actually deleted the rules that I had access to and it really doesn't like that. Anyway, we we no longer see our server. There's no applications anyway. If we come to activity, there's no audit log here, there's no events. Though I still have the ability to modify users and roles. So I've got editor, but I've got nothing else.

32:19 So let's just add all of that back in. It's just good to know that if you don't really want to do a T control, get users, modify the YAML, there is the ability just to quickly update the rules from there. Omar is asking, am I too late? Nope. We're gonna be here for another thirty minutes playing with the Rawk features of Teleport. Assuming that's what you're asking if you're late for. Cool. All right. So let's try and everything we've seen for so far has been relatively permissive, right? We've got star stars and a lot of our roles, and that's not where you

32:57 wanna be when you're shipping Teleport into production. But we actually want to restrict this access a little bit, right? So what we wanna take a look at is how do we limit access to the control plane node by using a node label and an edit the rule to include the node label. This will be really straightforward. If you wanna go read the docs and feel free, but we're just gonna go straight in and play with this. Now, the way that you add roles, labels, the way that you add labels to your infrastructure is in the Teleport configuration.

33:07 Limit Access to the Control Plane Node

33:34 And we've covered this in a previous episode two of the course, but I'll give you the very quick TLDR, is that if we come into the SSH service, you'll see here that we have a static label. Static label means that it's hard coded in this file. So I can see environment equals staging. You can have dynamic labels, which run commands. So you'll see commands here, and then we've got the name, and this is the name of the label, which is going to be host name. The command to run and any arguments that it requires to get that value back, but

34:12 here we're just in host name. And then just in case these values change over time for whatever reason, unlikely with the host name, but you never know, how often should we run this command to get the value for that label? So let's add one more just because we can, we'll call this sessions count and the command we're going to run will be who this is even gonna work with a pipe in it. Maybe I'm getting too too silly here. Period thirty seconds. I have no idea. Like, so who gives you this? Obviously, it's actually also giving me the count

35:00 one user. Now, whenever you change the Teleport configuration, you do need to restart it. And now if I can't access Teleport, it did not like that dynamic pity label thingy. Alright. Not too bad. Now, don't have any surfers and that's because we changed my rules. I'm gonna log back in. Executable not found. Alright. I am gonna make that work though. So the challenge here is bash dash c restart. I don't know why I'm so happy with that. But I am going to open a new session just so I can see that too. Teleport. Rawkode. Live. Cool.

36:12 So in thirty seconds time, I'm again, I'm hoping I'm still here. Hoping I'm still here. Alright. The software seems to say I'm still online. Twice. We are having I think not Justin's gone. Most lots of The UK. I think some of Europe's on The US. There's the storms at the moment, which is why I think the power is going out. Yeah. Russell's in dark mode. But my my five g router seems to be handling this more blip, which is great because it means that I'm not having to restart the stream. So let's go back. So in thirty seconds, in fact, if I

37:10 refresh this now, it's been thirty seconds, we should see session counter two. Not important for what we're doing right now. I just thought that was fun. So, but we do have a environment staging label on this machine. And if we come back to here, then what we want to do is to restrict access to this role, to these machines. But I'm gonna do that for the CLI. So we'll do a TCTL get roles, roles. Yaml. And does that say create a role or modify a role? Let's create a role. Why not? In fact, I do rules down here, don't

37:30 Restricting Access via Role Labels (Modifying Access Role)

38:00 I? Okay, cool. Let's just edit a rule for now. So we're gonna modify our access rule, which is our catch all rule here for anyone who wants to be able to SSH into machine. And instead of node labels being star star, I could set up the session count where two, and I'd only be able to access the machine when I have two local sessions. How stupid would that be? And I'm totally gonna do it. Two. Alright. I know sometimes I just do silly things, but I think it's gonna be funny. At least I'm laughing. So

38:38 let me recover what I'm doing here. I will only be able to, as someone, as a user with access, with the role called access, be able to connect to a machine when it has two active sessions. Why? It should have been environment staging. And in fact, we can add let's do that in a minute. Let's just do session count first. So let's tctl create dash f roles. Oh, what did I break? Not a list of the map. There we go. And then we'll jump over to the UI, and we no longer have access to the

39:30 server. Cool. Until I have a second session. And this may take thirty seconds, but that's gonna come back and I'm gonna be so happy. So we can and let's talk about this rule again. I can't if we close it, I'll never get back on. No. Good question. Russell said, can you do it as less than two single access only? No. You can't because it's just not what's intended. There's no actual it's not like an expression that can be parsed and evaluated. Especially it's just after label contains session count of a value of two. It's just not

40:15 the right match. It's not supposed to be used in a stupid way. It's just something that I thought would be funny. Well, it's not work, Jay, anyway. We'll give out an hour, ten seconds before I revert it to something more sensible as environment station. Can I create a third session? I can 100% create a third session, but then my matcher won't work and I won't have access to my node. Not that I have access to it yet anyway. Now I wonder if that's just because of the string. Where did I create that file? Do Teleport,

40:57 vp 10. Nope, my rules aren't there. TCTL, get rules, rules dot yaml. BIM edit. Let's do a sensible, my silly idea. Yeah. It isn't working. And I wonder if it's the string number thing. Access. Oh, did that on the server. Okay. Well, why did the get rules? Did I apply it? Am I connected to a different cluster here? Yes. That's my Teleport Cloud account. Okay. Stop being silly, David. Alright. So let's set this to an appropriate value of env staging. So now anyone with the access rule can only access staging machines, which for us is the only

42:33 machine we have. So let's refresh. We have it back. Cool. Don't know why that session can't do doesn't work. I really thought it would. Okay. Okay. So now we're gonna do something really fun. And we're gonna talk about elevated permissions for Teleport, requesting access and setting up a workflow to really provide an environment where you don't want to tell people they can't go onto a machine, but you want to make it an exception. Like going onto production machines, production databases using SSH is Oh shit, something is happening. And I should probably make other people aware that this is

42:52 Elevated Permissions with Teleport

43:20 going to happen or I'm going to do this because of the thing, right? We don't wanna normalize people just jumping around on machines, making changes, right? Bad, bad, bad, bad, bad. So what we want to do is have a workflow for that. And what we're gonna do here is build a workflow, where everybody that has Teleport, everybody that we want to have access to Teleport has a role called SRE. And we all have the same access, we're all one big team, but that access doesn't actually allow us to get onto production machines. So then we're going to have another role

43:53 called production, which is going to use the Teleport feature for requesting access, which could be approved by any other SRE. So we set up a dynamic where it's like, we all can get to production, but we have to make someone else aware that we want access to production and we get it. And we get it for a certain period of time. And then the access will be de escalated and nobody can get back onto production. Hopefully that makes sense. So we're gonna work through it. So what we need to do is first I need a second user.

44:26 Creating Workflow Users (Mozz, Russell) and Roles (SRE, Production)

44:26 This will be my teammate. So we will do users at, and I will call this user, Mozz has been in the chat, so I'm going to create Mozz. Roles, access. I'm gonna give you everything. Auditor. Cool. And we will copy this. I'm gonna have to log out. But that's okay. And register. I hate it. When that happens, this seems to be the port. So we're going to get started. I'm gonna use the same password because why not? Like so. And then we need to scan a second to FA because that is not going to get confusing.

45:27 Code two and that is my Moz account. Nice. I didn't give you any login traits, which is why you can't see in the machine, but we're not gonna worry about that. Okay, next on the task list. So I have created a new user, but we don't have our SRE role yet, so let's create that. So that we can just do on the command line, so we'll call this SRE role dot YAML. I am not going to remember all of this, so I'm going to click show me the YAML, and here is my SRE role. Let's go through this. So we have the

46:08 name, metadata, all Kubernetes, we have a spec, feels like Kubernetes, only this time we're going to have an allow condition where I can request access to production if I get two approvals. We don't want two, we want one because there's no I'm not gonna create a start account, not not for today. Where thresholds are set to one on one. So if one person denies it, I do not get the access. If this was three, I would require three people to approve it before I got the access. But for today, we're doing one on Also, this is not something I've seen in the

46:46 Teleport docs, but it'll test us and this works. And again, I'm using this approach because it's one team commoditizing access and setting new norms, not hierarchical you cannot get onto this machine thing. So I'm actually making it so that anyone with the SRE role can also approve. Russell's saying, yes, this was the two NSE's now need to wake up in the middle of night for problems. Well, this is just the example I am using. If you have very limited selection of SREs following the clock, following the sun, then you may wish to tweak it. However,

47:31 stick with me for the demo. So what I'm doing different from a Teleport documentation here is allowing this same role to be the approver. Because again, it's not hierarchical thing. It's not you are not on my level, you cannot approve this. It is, hey, we're a team. So we're going to save this. And in fact, I'm just gonna in the interest of time, I know my segues have meant we're a little bit behind, as I'm gonna copy the production rule. So what we're going to do, let's say, okay. The production rule allows route access to machines

47:57 Copy the Production Rule

48:06 marked as production. Not just to make this work, we're gonna go to teleport.yaml. We can remove my session count now as fun as that was. We're gonna call this machine production, restart teleport. The Moz user doesn't have logins, so that won't matter. Will it? That won't matter. So let's come here, Teleport. Now what I should really do is have one in a browser and one in a CLI. So I could build a little request, just kinda look at it like a silly person. So, and I wanna show both floors, so we just need to send two requests.

48:52 Cool. So I have moz here. I'm gonna log in. Tctl tsh login. That's the clustered link. We don't want that one today. Teleport. Rokode.io. Password. Is that in here yet? Rawkode test teleport. That's not one with two codes. I don't know why it's not doing a proper sync. One pass through a day. Rawkode livestream. Maybe I just got the name wrong. Rawkode livestream. No, it's not a sync. To FA code for me, not for Moz. Yeah. I'm not applied the role yet. Oh, good point. I need to log in again. Good catch, Mozz. Tctl create Azure F

49:50 Applying Workflow Roles and Node Label

49:55 SRE rule. There we go. Funnily enough, was testing this against an enterprise, and I didn't know that was a constraint. Allow request threshold is only available in enterprise subscriptions. Alright. But privilege elevation is available on open source. Maybe I just can't set the threshold. I'm gonna have to do this against my Teleport Cloud account. Looks like it's still set request. Maybe I don't know about approval. I don't know whether to test this or just go through my other one. Let's see what happens. So I'm gonna re log in here. These computers are just mean to me.

51:03 A lot of times I am mean to them. So, one second again. Cool. So we're gonna do tctl request ls. Now this will allow me to list all the requests. Currently, there are none. If we do dash dash help, they will see that we can request access to another role. So we'll do tctl request create, and then we specify the roles that we need access to and a reason. So here I can say, well, I Rawkode roles. I want production. And the reason is live stream. I didn't modify my user. User. Yeah. Users Rawkode. Alright. We need to get myself.

51:14 Attempting Access Request (CLI)

52:25 S r e rule. T c t l create dash f Rawkode. And I'm 100% gonna have to log in again, but I am just gonna try. Oh, it worked. Okay. I don't care. That means I don't have to log in again and do that password then. Now we can do request ls. What we can see here is Rawkode has requested the permission role production and the reason why is that it's a live stream. Yeah. Teleport knows blah blah blah blah blah. Very funny. Okay. So let's go back to our Moz user and Moz doesn't have anything.

53:16 Debugging Access Request and Approval Process (Multi-User/Cluster Issues)

53:32 Normally, I would see requests. SRE, refresh. So I'm starting to think that this isn't avail the UI component isn't available there. So I am gonna have to pctl tsh login again and juggle some accounts. Okay, Moz, your turn. I'll show you the enterprise UI as well, just so you can see where the differ. I wasn't aware of this. Second code. Oh, m user moz. Log in. Second code. Okay. Alright. So it's logged me out of my other user, but that's okay. So we should now be able to do TCTL request ls. We'll see Rawkode require.

55:23 That is the because Rawkode logged out. Is it because Rawkode logged out? You You know, I'm just going to use my enterprise one to show this. Yeah. It's correct. Okay. Because I can't have two people logged in and through the CLI, so I can't show you the CLI flow. I'm just gonna have to use my other one. Okay. So I do have a Teleport cloud account and I can log in with me. And for some reason, one password just seems to mess this bit up every single time. Okay. I'll make that bigger. And now we have access requests and you'll see I

56:26 was playing with this earlier. I don't know why that okay. Doesn't matter. We have access requests here and you'll see that we can view it. And I said help me five hours ago. And my SRE user said, sure thing and approved it. So let's do that again then. So let me update my current profile to be Rawkode Teleport. S h. Bless requests. There's my approved one, and let's just remove it. Okay. I thought okay. We'll make a new one. Quests, create. Okay. It's still there. Rally stream two. Oh, my username here is david@rokode.com. And I'm hoping it doesn't say you already

57:57 have. Probably because I already have access to production. Oh, well. So once it's approved, you can assume the rule. What? I've broken everything. There isn't a production rule. So this is the thing I was talking about earlier when I deleted the rule and it complained at me because I still had their role. I am having the best time. Alright. We have the roles here. Let's do this one more time and walk through. And I don't mind that I'm gonna go a bit over because this is fun. I was having a great time with this feature.

58:52 Okay. Rules dot YAML, apply TCTL create dash f. Oh, wrong one. Rules. Hopefully that doesn't have the server. Alright. SRE and production were created. We can refresh and there we go. Alright. So now I'm gonna create that new request again. Production. Hopefully that works. It doesn't tell me I already have. Yeah. I wonder if the RM would work now with that. Maybe that was just because the rule didn't exist. I just don't have permission. Okay. Delete on access request. Well, I am an editor. Whatever. Oh, we do have the moz user. Moz hasn't requested that. Okay, let's do that.

1:00:07 So I'm gonna We have the SRE user. Let's close it or not. Not much. SRE. Got to get me on. My one password says password you're telling me is wrong. Computers are tough. TCTL users add moz roles, auditor access, editor, login, go. I should have given you. Should have given users. Users, Mozz. Let's see if I can modify you before I've created you. Awesome. Roles, so I don't have to log in 14,000 times. SRE. Awesome. Create dash f moz. Okay. Now we're gonna register your account moz. Just open it in my browser. Okay. Cool. And I am going to use the s

1:01:40 Register Your Account Mods

1:01:53 r e user's password. And scanny scanny scanny. That's gonna be the second code because I I I just like making this much more difficult for myself. Great. Thank you. Okay. So now I am going to request access. So this is the Moz user who is in the SRE role, who can request access to production and say live stream would really like working and demo, please. Thanks. Can't leave the table in there. Okay. Send request. Awesome. So now we can see this. Now me can do requests l s Approve request ID. Computer. I did all of this this morning.

1:02:22 Request Access

1:03:24 Prove request ID. What have I done to my user account? I am confused. Is that not Miles's request? Oh, you're right. Where is Maltese request? If I had broken my user. Yeah. Jeffrey's on there too. Yeah. I am approving the wrong quest. User Rawkode. I don't have the the SRE role. Okay. So we're gonna get my user. I don't have the SRE rule. Why? I did it. That's because I've been jumping between clusters. Alright. Let's do that. And I'm probably gonna have to re authenticate, but desperation, I'm going to list request. Awesome. I didn't. Now I can approve

1:05:35 Just want it to work. It worked earlier. I am I'm going to give myself the ability to do everything on this machine and tell Teleport to to just stop it. It's late. I'm tired. Editor. Edit. Alright. Rules. Resources. Access request. Verbs. That's the list right? Yep. List, create, read, delete, update. Anything else? No. Save. Not a valid resource declaration. And why are you yelling at me? I can't do it. Star star. You know, it let me list it, but I did think I was gonna have to log out. So for the last time, that's the wrong cluster now because we switched.

1:07:02 I'm going to log in and just make sure I have the right rules that I need to do this job. Thank you all for your extreme patience as I confuse the fucker of myself. Request alias. Gonna list it on my rules this time. Prove. Yeah. I just have to laugh, don't I? I didn't change my SRE rule today. Yeah. So I can request production threshold, but we want one. I think it's because I have that function already. I think that's the problem. I think it's doing some checks and then oh, no. Wait. That's wrong. Oh, no. That's right. I can review the

1:08:48 quests for the production role. And if I go to production yeah. Perfect. I mean, I can't confirm because I can't delete my old my rule assumption. My only option right now is to create a third user. Russell rules, auditor, access, editor, logins, route, h one Russell, says the day. You know the only impartial user in this current Teleport code set up. And I yeah. Open. Okay. I'm not adding a third. Russell. Russell. Russell. Scan, scan, scan. Russell. Alright. So let's try this. Right? And then I'll I'll I'll talk about why I think this is what's happening.

1:10:16 Rawkode can't see shit. I then give him SRE rule. Oh, David. What are you doing? Cool. Okay. Now, I can do this to the UI or I can log myself out of the CLI and do it from there. You give ten seconds, say CLI or UI and I'll go, I'll do it. But we have now what appears to be a working approval process. And then I will explain my hypothesis about why I got in such a convoluted situation in the first place. Oh, ten seconds. Do you wanna see the UI flow or the CLI flow?

1:11:05 Maybe you just don't care. CLI from Russell. Okay. So I am going to log out of Russell on the UI. We are going to become Moz. Jeffrey wants a CLI too. Good. Right. Same. Good. So this is going to log me in. Hopefully as Moz, who sent the approval process. He is waiting for his access to this server. Now, on the CLI, I am gonna have to TSH login this time as Russell on the server. Russell, Russell, Russell. Russell, Russell, Russell. Cool. And now Russell should be able to see that Mars put in a request

1:12:15 for production access. Request ls. Approve. I'm pretty sure you can add a reason. Go for it. I bet you it's broken on the CLI. Is that what the problem is? So it's not me being stupid. Right? My my weird hypothesis that I was making up in my head to explain what the fuck was going on. Oh, I really need to change that recovery code now. No. So my hypothesis is kinda right. Like, I can't approve Moz because Moz approved me. So now I'm going to log in as Mars. Wait, Mars opened the request. Russell. Russell.

1:13:45 Russell. Just keep saying the name. And Russell can approve Mozzie's request. Prove. These are all being so patient. Jeffrey, let's see the UI. Russell, yeah, sure. Let's see the UI. Awesome. I have I have no idea anymore. Approved. Approved. No, it didn't. It did approve it. That request was created while the threshold was still set to two. I'm a media. Who am I on the CLI? Who who I'm Russell. And I bet you the CLI is not gonna let me delete the request because the CLI apparently cannot deal with request. RM. Yeah. Fuck it. I'm so upset.

1:15:39 And it didn't work in that. Okay. That's right. Okay. The CLI does not work for approval processes. That is 100% broken. Unfortunately, the module request was created while the threshold was set to two. So we're gonna adjust very quickly because sure I'm gonna be able to get it to work quickly. I sent this to one, isn't actually gonna fix it because at least for the existing request, because if I come back in, there's definitely one. Yep. It goes to access request, it's still gonna be stuck there. However, what we can do what we can do

1:16:32 is have Russell submit a request from the CLI. And I'm Russell here. Right? Okay. Request create Russell rules production reason, please, please, please. So you can create them. Let me start something. And now I am Russell. Let's see if David's gonna prove it. Fuck it. Why not? No. Assuming because I've already assumed the role. Moz hasn't had his request approved yet. This is more complicated than some very complicated films I'm thinking of. Hey, come on, Moz. It's your turn to save the day. Prove. Approve. Wow. Russell now has axe to sumer rule. Yes. Okay. Which means

1:18:36 I can do TSH login proxy request ID. I need the request ID first. Well, in fact it was here. PSH login request ID. This is how I assume the role as Russell. Update my certificate. PSHLF. It's just because fuck it. I don't know. Did I restart it after setting the node to be production? Who knows anymore? So Russell should have the production role right now. In fact, I do have the production role right now. But it would appear I can't list the machines because I have no idea what day of the week is anymore. ENV

1:20:03 production. Same. Right? When I created Russell, did I give him logins? Who knows? I I'm I think I'm giving up. I'm I'm just gonna record a video on this later because I have no idea what day of the week is anymore. And you can't modify traits from the UI. Users. Russell. Russell. At least we're learning Teleport stuff. Right? Log in through. Yeah. Yes, it's status. I am Russell web production role enabled. Why the hell can I not see the note? Why can I not see the node? I'm not faint anymore. There is a forty minute version of

1:21:48 role escalation and teleport, which worked first time on my testing this afternoon, and I feel like everything that could go wrong did go wrong. Russell may be right. Actual Russell, not my fakers or Russell. And that maybe the CLI just can't see the notes. So I'm more than happy to test that. Russell. Why is that server not showing up? Doesn't matter. Alright. Well, this is a really cool feature. I don't know what crazy magic I have done to be able to break that, but the last task that we were gonna be taking a look at is to enforce MFA.

1:22:51 Exercise 6: Enforcing Session MFA

1:22:53 So this is another really cool feature and I do want this to work and to show you it. So let's log in as me, actual real me, my account. Okay. If I can't assume and see my server, this didn't me assume the role. I've got five hours left, but the server just isn't showing up. So to be honest, all I'm going to do is, I'm just gonna do it through the UI, just so it's quick, is modify the access. We'll table star star. My trade login. Teleport. Just remove the labels. See when it clicks. See when it clicks.

1:24:18 Course this isn't working. I haven't added that node to the cloud account. How did nobody notice that? Funny. Alright. Funny. So so funny. I'm not gonna add the label back. I will fix this and then we're gonna do something cool. Teleport cloud password. Because my node that I'm using and modifying the config on is the node, which is connected to the teleport I spun up on a scale AVM and not my teleport cloud instance. Now I need to log in as me on the CLI, I have to generate a token for node access and register this node

1:25:14 with the cluster. So we can use the TSH tokens command. Oh, yeah. Talking. We had a role. What's a role type node TTL. You know what? I just I don't even need I don't even need an ever. Just giving the damn thing. One each. And then we'll grab this and then here, I'm just going to stop Teleport, go away. Now it's gonna be registered as a node on my Teleport Cloud account. And now I'll be able to do TSHLS. If I assume my thing again. Not connected yet. Oh, come on. Off server is Rawkode Teleport SH 3025.

1:27:02 Why is that not working? Well, the IP address is different for a star. I am Mimi. Right? Yeah. I'm Mimi. I created a token. My cloud account. Awesome. Alright. Let's just modify Teleport. Yaml. That's gonna be a bit awkward. Roles mode. That's my token. You know, I'll even take this pen off. I don't care. Just work. Rawkode. Teleport. Oh, yeah. Four four three. I'm using the single proxy mode, which means I probably obviously have to pay. Why is it not working there? Okay. I just did that. I'm doing that too. Teleport start rules. No. There's my token. Okay.

1:29:14 Four four three is what the UI says I should do. And then it complained. No. Firewall's not nice. Nice gas. What to be certain to me? Can I just run it on my own machine? Cat e dot s h. I just want a machine. Alright. I don't care about this and real stuff anymore. Teleport here. Livestream account. There's more labels. Could we delete them for a test? Probably. I don't remember anything anymore. Why can I not see that machine? Oh, there's a load labels here. Wise man would have just left. Okay. So now if I try and connect to

1:31:52 this machine Azure, it'll work. What we want to enable is MFA. So we can add this to a role. This will require any session MFA to be enabled when we try and connect to a machine. I wanted to do this on the production one to show a viable use case, but we are ninety minutes into this and I need something to work. So I'm just going to modify the role for the UI. I'm gonna just say access spec require MFA. I don't know if I have to log out and log back in. I have no idea.

1:32:45 No. Cool. Well, yep. This doesn't work. I may not even say bye. I may just turn off my computer. Did I enable you? Did I? It got merged. Okay. Yeah. That was silly. If I view this again, now it should be there. Yeah. Okay. Cool. I'll take that one. That was that was all me. So finally. Alright. So now from here, we go t s h l s. What account is that? Teleport Rawkode. Live. Really? Really, really, really, really. Okay. The mod is on that cluster. Rawkode. Okay. And then I need this password again. I need this TFA again.

1:33:38 Demonstrating Session MFA Requirement

1:34:47 And now, Teleport. They tell me that we need OTP, which I can copy from here. Now that's complaining because I see I I tried to log in twice or use the same one time password within a thirty second period. So let's copy that. And we're in. So Teleport. Wow. There's a really cool feature, which is available in open source. You can use request elevation in open source. I think some of it is hidden from the UI. I'm gonna speak to the team and work out exactly what went wrong tonight cause I'm not entirely sure. But you can elevate your permissions, you can

1:35:41 assume the role, access the infrastructure, really awesome feature. And then there's the final piece of our back end stuff is we can enable that a one time password is required at the session level. Now from a CLI, that's my OTP, from the web, it would be a hardware token. And there are plenty of ways to add the hardware token to your account. TSH MFA, where you can add stuff from here. So I am not even gonna attempt to do anything else. There isn't anything else that was everything in the tutorial, but that was quite a slog. So thank

1:36:16 you for your patience. I'm gonna pop back over here. So Russell says that is a nice feature only allowing an MFA code once. Yep. I had no idea until you had it and then you realize and it's annoying. But I hope that was useful. I know that we spend a lot of time in this session debugging and fighting with the roles and juggling users and juggling clusters and I got myself a little bit in a fluster, but you know, do go wrong. I like to show things when they go wrong And I hope that the process of

1:36:17 Conclusion and Wrap-up

1:36:52 pulling out roles, editing roles, playing with users was viable or useful to some of you. So again, thank you for staying with me. I hope it was I hope you enjoyed this. What I would say now is enjoy your weekend. Russell is telling me to go get a drink and have a good one. I'm gonna go have a few drinks now for sure. I'll be going home and cracking off a cold one pretty soon. But we'll be back on Monday. I'm gonna be talking about moving Teleport into production. So join us then. Have a wonderful weekend,

1:37:18 and I'll see you all soon. Thanks.