Teleport on a VPS: Zero-Trust Infrastructure Access for SSH, Kubernetes, and Databases

Teleport is an open-source infrastructure access platform — it replaces SSH keys with short-lived certificates, provides browser-based terminal access to all your servers, records every session for audit purposes, manages database connections, and enforces MFA for all access. For teams with multiple engineers accessing multiple servers, Teleport replaces the security nightmare of distributing and rotating SSH keys with a unified, auditable access platform.

What Teleport Provides

• SSH access: Certificate-based auth replacing static SSH keys, browser terminal, session recording
• Database access: Connect to PostgreSQL, MySQL, MongoDB via Teleport without direct database credentials
• Kubernetes access: kubectl via Teleport with identity-based access and session recording
• Application access: Proxy internal web apps behind Teleport auth
• Audit log: Every connection, command, and session recorded with full session replay
• MFA: Hardware keys (YubiKey), TOTP, or WebAuthn for all access

Step 1: Install Teleport (Proxy + Auth Server)

<code"># Install Teleport on a dedicated VPS (the Teleport proxy/auth server)
curl https://goteleport.com/static/install.sh | bash -s 15.0.0 oss

# Initialize Teleport:
sudo teleport configure \
    --cluster-name=yourcompany.teleport.example \
    --public-addr=teleport.yourdomain.com:443 \
    --cert-file=/etc/letsencrypt/live/teleport.yourdomain.com/fullchain.pem \
    --key-file=/etc/letsencrypt/live/teleport.yourdomain.com/privkey.pem \
    --output=/etc/teleport.yaml

<code">sudo nano /etc/teleport.yaml

<code">version: v3
teleport:
  data_dir: /var/lib/teleport
  log:
    output: stderr
    severity: INFO

auth_service:
  enabled: "yes"
  cluster_name: "yourcompany"
  listen_addr: 0.0.0.0:3025
  tokens:
    - "node:TOKEN_FOR_NODES"
    - "db:TOKEN_FOR_DATABASES"

proxy_service:
  enabled: "yes"
  public_addr: "teleport.yourdomain.com:443"
  web_listen_addr: 0.0.0.0:443
  tunnel_listen_addr: 0.0.0.0:3024
  https_cert_file: /etc/letsencrypt/live/teleport.yourdomain.com/fullchain.pem
  https_key_file: /etc/letsencrypt/live/teleport.yourdomain.com/privkey.pem

ssh_service:
  enabled: "yes"
  listen_addr: 0.0.0.0:3022

<code">sudo systemctl enable teleport
sudo systemctl start teleport

# Create first admin user:
sudo tctl users add admin --roles=access,editor --logins=ubuntu,root

Step 2: Install Teleport Node Agent on Servers

<code"># On EACH server you want to manage via Teleport:
curl https://goteleport.com/static/install.sh | bash -s 15.0.0 oss

sudo teleport node configure \
    --auth-server=teleport.yourdomain.com:3025 \
    --token=TOKEN_FOR_NODES \
    --labels "env=production,role=web-server"

sudo systemctl enable teleport-node
sudo systemctl start teleport-node

Step 3: Browser-Based Terminal Access

<code"># Install tsh (Teleport Shell) on developer laptops:
# macOS: brew install teleport
# Linux: follow installation script

# Login to Teleport cluster:
tsh login --proxy=teleport.yourdomain.com --user=alice
# Opens browser → authenticate (SSO or email/password + MFA)
# Issues a short-lived certificate (default: 12 hours)

# List available servers:
tsh ls
# Shows: node name, address, labels

# SSH to a server:
tsh ssh ubuntu@web-server-01

# Or use the browser:
# https://teleport.yourdomain.com → Servers → click server → Launch Terminal

# Session recording:
# Every tsh ssh session is recorded and stored in Teleport
# View recordings: https://teleport.yourdomain.com → Activity → Session Recordings

Step 4: Database Access

<code"># On the database server — install Teleport database agent:
sudo teleport db configure \
    --auth-server=teleport.yourdomain.com:3025 \
    --token=TOKEN_FOR_DATABASES \
    --name=prod-postgres \
    --protocol=postgres \
    --uri=localhost:5432

# Connect to database via Teleport (from developer laptop):
# Login Teleport proxy:
tsh db login prod-postgres

# Connect with psql (credentials from Teleport certificate):
tsh db connect prod-postgres -- -U myapp_user -d myapp

# Or get a connection string for applications:
tsh db connect --db-user=myapp_user --db-name=myapp prod-postgres --print-format=cmd

Step 5: Access Control Policies

<code"># Teleport roles control what users can access:
# Admin panel → Access → Roles → Create Role

# Example: Junior developer role (read-only, staging only)
kind: role
version: v6
metadata:
  name: junior-dev
spec:
  allow:
    logins: ['ubuntu']
    node_labels:
      env: [staging]          # Only staging servers
    db_labels:
      env: [staging]
    db_permissions:
      - match: {db_user: '.*'}
        permissions: [SELECT]   # Read-only database access
  deny:
    logins: ['root']            # Never root access

# Example: On-call engineer role (time-limited production access)
kind: role
version: v6
metadata:
  name: oncall-prod
spec:
  options:
    max_session_ttl: 4h        # Auto-expire after 4 hours
  allow:
    logins: ['ubuntu']
    node_labels:
      env: [production]

Step 6: Audit Log and Session Replay

<code"># View audit log:
tctl events show --query 'event="session.start"' --last 24h

# All events logged:
# session.start, session.end, session.data (commands typed)
# user.login, user.logout
# db.session.start, db.session.end
# k8s.request (if Kubernetes configured)

# Session replay:
# Web UI → Activity → Session Recordings → play any session
# See exactly what commands were run, output shown

# Export audit log for SIEM:
# Settings → Audit Log → Export → configure S3 or Splunk forwarding

Getting Started

Teleport Auth+Proxy server uses 200–500 MB RAM. A 2 GB Ubuntu VPS at VPS.DO dedicated to Teleport handles teams of up to 50 engineers accessing dozens of servers. Teleport’s short-lived certificates (default: 12 hours) mean compromised credentials have a limited time window — a fundamental security improvement over static SSH keys that persist indefinitely.

Conclusion

Teleport eliminates static SSH key distribution — the most common source of credential sprawl and security incidents in infrastructure management. Certificate-based access with automatic expiry, MFA enforcement, browser-based terminal, database connection management, and session recording provide a complete zero-trust access platform. For teams managing multiple servers, Teleport’s centralized access management is the operational upgrade that traditional bastion hosts and SSH key files can’t match.