Machine ID Getting Started Guide

In this getting started guide, you will configure Machine ID to issue certificates that enable a bot user to connect to a remote host.

Here's an overview of what you will do:

• Download and install tbot on the host that will run Machine ID.
• Create a bot user.
• Start Machine ID.
• Use certificates issued by Machine ID to connect to a remote machine with SSH.

This guide covers configuring Machine ID for development and learning purposes. For a production-ready configuration of Machine ID, visit the Deploying Machine ID guides.

Prerequisites

• A host that you wish to assign an identity to using Machine ID.

• A running Teleport cluster version 15.2.4 or above. If you want to get started with Teleport, sign up for a free trial or set up a demo environment.

• The tctl admin tool and tsh client tool.

  On Teleport Enterprise, you must use the Enterprise version of tctl, which you can download from your Teleport account workspace. Otherwise, visit Installation for instructions on downloading tctl and tsh for Teleport Community Edition.

To check that you can connect to your Teleport cluster, sign in with tsh login, then verify that you can run tctl commands using your current credentials. tctl is supported on macOS and Linux machines.

For example:

tsh login --proxy=teleport.example.com --user=[email protected]
tctl status
Cluster  teleport.example.com
Version  15.2.4
CA pin   sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678

If you can connect to the cluster and run the tctl status command, you can use your current credentials to run subsequent tctl commands from your workstation. If you host your own Teleport cluster, you can also run tctl commands on the computer that hosts the Teleport Auth Service for full permissions.

Step 1/4. Download and install Teleport

In this step, you will be downloading and installing Teleport binaries onto the machine you wish to assign an identity to.

Each Teleport package hosted on our downloads page ships with several useful binaries, including teleport, tctl, tsh, and tbot:

• teleport is the daemon used to initialize a Teleport cluster; this binary is not used in this guide
• tctl is the administrative tool you will use to create the bot user (step 1/4)
• tsh is the client tool you will use to log in to the Teleport Cluster (steps 2/4 and 4/4)
• tbot is the Machine ID tool you will use to associate a bot user with a machine (step 3/4)

Download the appropriate Teleport package for your platform:

Install Teleport on your Linux server:

1. Assign edition to one of the following, depending on your Teleport edition:

   Edition	Value
   Teleport Enterprise Cloud	cloud
   Teleport Enterprise (Self-Hosted)	enterprise
   Teleport Community Edition	oss

2. Get the version of Teleport to install. If you have automatic agent updates enabled in your cluster, query the latest Teleport version that is compatible with the updater:

   TELEPORT_DOMAIN=example.teleport.com
   TELEPORT_VERSION="$(curl https://$TELEPORT_DOMAIN/v1/webapi/automaticupgrades/channel/default/version | sed 's/v//')"

   Otherwise, get the version of your Teleport cluster:

   TELEPORT_DOMAIN=example.teleport.com
   TELEPORT_VERSION="$(curl https://$TELEPORT_DOMAIN/v1/webapi/ping | jq -r '.server_version')"

3. Install Teleport on your Linux server:

   curl https://goteleport.com/static/install.sh | bash -s ${TELEPORT_VERSION} edition

   The installation script detects the package manager on your Linux server and uses it to install Teleport binaries. To customize your installation, learn about the Teleport package repositories in the installation guide.

Step 2/4. Create a bot user

Before you create a bot user, you need to determine which role(s) you want to assign to it. You can use the tctl command below to examine what roles exist on your system.

tctl get roles --format=text

You will see something like the output below on a fresh install of Teleport with the default roles—your cluster may have different roles. In this example, let's assume you want to give the bot the access role to allow it to connect to machines within your cluster.

Role    Allowed to login as                           Node Labels Access to resources
------- --------------------------------------------- ----------- ----------------------------------------
access  {{internal.logins}}                           <all nodes> event:list,read,session:read,list
auditor no-login-6566121f-b602-47f1-a118-c9c618ee5aec             session:list,read,event:list,read
editor                                                            user:list,create,read,update,delete,...

The internal.logins trait is replaced with values from the Teleport local user database. For full details on how traits work in Teleport roles, see the Teleport Access Controls Reference.

Machine ID can join with a token or the IAM Method on AWS.

Assuming that you are using the default access role, ensure that you use the --logins flag when adding your bot to specify the SSH logins that you wish to allow the bot to access on hosts. For our example, we will be using root.

tctl bots add robot --roles=access --logins=root

kind: token
version: v2
metadata:
  # The token name is not a secret because instances must prove that they are
  # running in your AWS account to use this token.
  name: iam-token
spec:
  # Only allow bots to join using this token.
  roles: [Bot]

  # Set the join method to be IAM.
  join_method: iam

  # Define the name of the bot that will be allowed to use this token.
  bot_name: robot

  allow:
  # Restrict the AWS account and (optionally) ARN that can use this token.
  # This information can be obtained from running the
  # "aws sts get-caller-identity" command from the CLI.
  - aws_account: "111111111111"
    aws_arn: "arn:aws:sts::111111111111:assumed-role/teleport-bot-role/i-*"

$ tctl bots add robot --token=iam-token --roles=access --logins=root

Step 3/4. Start Machine ID

Now start Machine ID using the tbot binary. The tbot start command will start running Machine ID in a loop, writing renewable certificates to /var/lib/teleport/bot and the short-lived certificates your application will use to /opt/machine-id.

In a production environment you will want to run Machine ID in the background using a service manager like systemd. However, in this guide you will run it in the foreground to better understand how it works.

export TELEPORT_ANONYMOUS_TELEMETRY=1
sudo tbot start \   --data-dir=/var/lib/teleport/bot \   --destination-dir=/opt/machine-id \   --token=abcd123-insecure-do-not-use-this \   --join-method=token \   --proxy-server=example.teleport.sh:443

export TELEPORT_ANONYMOUS_TELEMETRY=1
sudo tbot start \   --data-dir=/var/lib/teleport/bot \   --destination-dir=/opt/machine-id \   --token=iam-token \   --join-method=iam \   --proxy-server=example.teleport.sh:443

TELEPORT_ANONYMOUS_TELEMETRY enables the submission of anonymous usage telemetry. This helps us shape the future development of tbot. You can disable this by omitting this.

Replace the following fields with values from your own cluster.

Now that Machine ID has successfully started, let's investigate the /opt/machine-id directory to see what was written to disk.

tree /opt/machine-id
machine-id├── identity├── key├── key-cert.pub├── key.pub├── known_hosts├── ssh_config├── teleport-database-ca.crt├── teleport-host-ca.crt├── teleport-user-ca.crt└── tlscert
0 directories, 10 files

This directory contains private key material in the key.* files, SSH certificates in the identity file, X.509 certificates in the tls* and *.crt files, OpenSSH configuration in the ssh_config and known_hosts files to make it easy to integrate Machine ID with external applications and tools.

Step 4/4. Use certificates issued by Machine ID

To use Machine ID, find a host that you want to connect to within your cluster using tsh ls. You might see output like the following on your system.

tsh ls
Node Name Address        Labels--------- -------------- -----------------------------node-name  127.0.0.1:3022 arch=x86_64,group=api-servers

To use Machine ID with the OpenSSH integration, run the following command to connect to node-name within cluster example.com.

ssh -F /opt/machine-id/ssh_config [email protected]

In addition to the ssh client you can use tsh. Replace the --proxy parameter with your proxy address.

tsh ssh --proxy=teleport.example.com -i /opt/machine-id/identity root@node-name

tsh ssh --proxy=mytenant.teleport.sh -i /opt/machine-id/identity root@node-name

ssh -F /opt/machine-id/ssh_config [email protected]
root@node-name: Permission denied (publickey).kex_exchange_identification: Connection closed by remote host

Now you can replace any invocations of ssh with the above command to provide your applications and tools a machine identity that can be rotated, audited, and controlled with all the familiar Teleport access controls.

Next Steps

• Read the architecture overview to learn about how Machine ID works in more detail.
• Check out the deployment guides to learn about configuring tbot in a production-ready way for your platform.
• Check out the access guides to learn about configuring tbot for different use cases than SSH.
• Read the configuration reference to explore all the available configuration options.
• More information about TELEPORT_ANONYMOUS_TELEMETRY.