Pages

Friday, March 12, 2021

OCI Teleport

Here's a fun lil project, configure Gravitational Teleport on Oracle Cloud Infrastructure Free Tier

Teleport is a "Unified Access Plane" for your infrastructure. In this example I'm going to show how I configured Web SSH Access to OCI via Teleport.

Setup OCI

  • Sign up for a free account here: https://www.oracle.com/cloud/free/
    • Verify email
    • In creating an account you will need to give them a credit card. You shouldn't ever be charged anything as long as you don't use any non-free resources.
    • Once you create an account you will get an email after the setup completes.

Create Virtual Cloud Network (VCN)

  • OCI Cloud Console > Set up a network with a wizard
  • Select root compartments from Comartments drop down on left side of screen.
  • This should start the VCN Wizard
    • You want "VCN with Internet Connectivity" > Start VCN Wizard
      • VCN Name: vcn-demo
      • Compartment: username(root)
      • Defaults for the rest:
        • VPN CIDR Block: 10.0.0.0/16
        • Public Subnet CIDR Block: 10.0.0.0/24
        • Private Subnet CIDR Block: 10.0.1.0/24
        • Use Hostnames in this VCN: Checked
      • Next
      • Create
    • View Virtual Cloud Network

Create Teleport Host

  • Settings > Compute > Instances
  • Create Instance
  • Name: instance-teleport
  • Compartment: username(root)
  • Placement and Hardware > Edit
  • Change Image to Oracle Linux 8
  • Make sure Always Free AD & Shape selected
  • Networking: Make sure vcn-demo is selected, and in public subnet
  • Add SSH Keys
    • - Generate & Save Private Key
  • Click Create
  • Wait a few minutes for Instance to be created

Verify Connecitivity

  • Settings > Compute > Instances
    • Make a note of the Public IP, use it in the following as $node_ip_addr
  • Go to noip.com
    • Sign up for free teletele.ddns.net hostname
    • Setup hostname teletele.ddns.net to point to $node_ip_addr
  • nslookup teletele.ddns.net
  • chmod 600 ssh-key-2021-03-12.key
  • ssh -i ssh-key-2021-03-12.key opc@teletele.ddns.net
Install Teleport
  • sudo su -
  • sudo yum-config-manager --add-repo https://rpm.releases.teleport.dev/teleport.repo
  • sudo yum install teleport

Setup TLS

  • Install Certbot
    • Prereq install snapd, docs here https://snapcraft.io/docs/installing-snap-on-red-hat
      • sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
      • sudo dnf upgrade
      • sudo yum install snapd
      • sudo systemctl enable --now snapd.socket
      • sudo ln -s /var/lib/snapd/snap /snap
      • Log out and back in to update paths
      • sudo snap install core
      • sudo snap refresh core
    • sudo snap install --classic certbot
    • sudo ln -s /snap/bin/certbot /usr/bin/certbot
    • # Fix firewall issue on  next command by opening port 80
      • sudo firewall-cmd --zone=public --permanent --add-port=80/tcp
      • sudo firewall-cmd --reload
      • Update network firewall
        • OCI Settings > Networking > VCNs > Root Compartment > vcn-demo
        • Security Lists > Default Security List for vcn-demo
        • Add Ingress Rules
          • Source CIDR: 0.0.0.0/0
          • Destination Port Range: 80
    • sudo certbot certonly --standalone
      • Enter email address
        • Read TOS and Agree to share email address
        • Enter domain name: teletele.ddns.net
    • Delete Network firewall rule allowing traffic on port 80
Configure & Launch Teleport

  • vi /etc/teleport.yaml which should be a new file and consist of the following:
    • teleport:
          data_dir: /var/lib/teleport
      auth_service:
          enabled: true
          cluster_name: "teleport"
          listen_addr: 0.0.0.0:3025
          tokens:
          - proxy,node,app:f7adb7ccdf04037bcd2b52ec6010fd6f0caec94ba190b765
      ssh_service:
          enabled: true
          labels:
              env: staging
      app_service:
          enabled: true
          debug_app: true
      proxy_service:
          enabled: true
          listen_addr: 0.0.0.0:3023
          web_listen_addr: 0.0.0.0:3080
          tunnel_listen_addr: 0.0.0.0:3024
          public_addr: teletele.ddns.net:3080
          https_keypairs:
          - key_file: /etc/letsencrypt/live/teletele.ddns.net/privkey.pem
            cert_file: /etc/letsencrypt/live/teletele.ddns.net/fullchain.pem
  • Start Teleport
    • teleport start --config=/etc/teleport.yaml
  • Open firewall to port 3080
    • Host firewall
      • sudo firewall-cmd --zone=public --permanent --add-port=3080/tcp
      • sudo firewall-cmd --reload
    • Network firewall
      • OCI Settings > Networking > VCNs > Root Compartment > vcn-demo
      • Security Lists > Default Security List for vcn-demo
      • Security Lists > Default Security List for vcn-demo
      • Add Ingress Rules
        • Source CIDR: 0.0.0.0/0
        • Destination Port Range: 3080
  • Verify teleport is accessible
    • https://teletele.ddns.net:3080/

Running teleport
  • Cancel the session we previously started teleport and start via
  • service teleport start
  • Create a user
    • adduser devuser
    • /usr/local/bin/tctl users add devuser --logins=devuser,root --roles=admin
    • Should see something like the following:
      • User "devuser" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
        https://teletele.ddns.net:3080/web/invite/sometoken

        NOTE: Make sure teletele.ddns.net:3080 points at a Teleport proxy which users can access.
  • Visit the tokenized URL to configure a password & MFA for devuser


This was a fun exercise to tinker with a new app. The next iteration of this install would be to include OCI VPN options so the app is never intentionally exposed at any point, and spend a little more time with certs to see if I can simplify the install & config process.