What it does here
Teleport provides privileged access. Administrators reach servers through it rather than with standing SSH credentials: access is just-in-time, protected by a mandatory second factor, and every session is recorded and replayable.
How it is deployed
Container teleport, built on Debian so recorded sessions have a real shell, running auth, proxy and node in one — the container is the managed server golonex-app-01. Behind Caddy its public address is teleport.iamlab.genbay.co; see Installation §4.6.
Settings in the web console
Your first visit is a one-time invite link, not a password — see Appendix §A.5.
First sign-in: password + second factor
The invite asks you to set a password and enrol an authenticator app. Teleport 18 will not let you turn MFA off, which is the correct posture for privileged access and worth noticing: the tool encodes the policy rather than trusting you to configure it.
Resources — what you are allowed to reach
Resources lists the servers your roles permit. You should see golonex-app-01, labelled env: production. Connect and you get a terminal in the browser as golonex-ops.
You never typed a server password, and none is stored on your machine — Teleport issued a short-lived certificate instead. That is the heart of modern PAM.
Session recordings — the accountability
Session Recordings lists every session, with a player. Open your own and watch it back keystroke by keystroke.
This is what auditors ask for and what CRD 7 means by accountability: not just who had access, but what they did with it.
Access — roles and users
Under Access (users and roles) sits the role golonex-pam-ops. It defines the whole grant in a few lines:
| Setting | Value here | Meaning |
|---|---|---|
| Logins | golonex-ops | the only OS user you may become |
| Node labels | env: production | you may reach production servers only |
| Max session TTL | 8 hours | access expires — nothing is permanent |
| Record session | on | recording is not optional |
Audit log
The audit log records logins, session starts and ends, and certificate issuance. Alongside Keycloak's events, this is the privileged half of your audit story.
Try this
- Open a session, run
whoamiandhostname, close it, then replay the recording. - Compare it with Guacamole: two different routes to a recorded privileged session, with different strengths.