How to install Teleport CE 18.2.2, create a Web server Authentication certificate with EJBCA & desactivate the TOTP in docker version Teleport CE on Debian 12

[Angela69322]

1- To install Teleport CE 18.2.2 in docker pre-requisites is

install docker : https://docs.docker.com/engine/install/debian/ and run docker

install a NTP server and synchronize the time very carefully

2- create the directories :

sudo mkdir -p /opt/teleport/{config,data,certs}

3 -create the certificate with EJCA :

Create the Certificate Profile “TLS Server Teleport ” on the EJBCA (KeyUsage : DigitalSignature, KeyEncipherment ; Extended KU : ServerAuth ; tailles RSA ≥ 3072 (4096).

Create an End Entity For TLS Server Teleport on the EJBCA (DNS=teleport.mydomain.com avec SAN : DNS:teleport.mydomain.com (et DNS:*.teleport.mydomain.com, IP address 1, IP address 2 if necessary).

Generate the certificate request with non crypted key in the Debian/Teleport :

    > openssl genrsa -out /opt/teleport/certs/teleport.key 4096
   > openssl req -new -key /opt/teleport/certs/teleport.key \
            -subj "/CN=teleport.mydomain.com" \
            -addext "subjectAltName=DNS:teleport.mydomain.com,DNS:*.teleport.mydomain.com" \
            -out /opt/teleport/certs/teleport.csr

Enroll the CSR in RA/EJBCA with the TLS server Teleport profile and End entity

> download the PEM certificate : teleport_server.pem

> Download the full chain of the CA in PEM format : ejbcaCA_chain.pem

Create a fullchain on debian :

   cat /opt/teleport/certs/teleport_server.pem \
           /opt/teleport/certs/ejbcaCA_chain.pem \
    > /opt/teleport/certs/teleport_fullchain.pem
   chmod 600 /opt/teleport/certs/teleport.key

4 - Install and configure Teleport

cd /opt/teleport

docker run --hostname teleport.mydomain.com --rm \

--entrypoint=/usr/local/bin/teleport
public.ecr.aws/gravitational/teleport-distroless:18.2.2 configure --roles=proxy,auth > /opt/teleport/config/teleport.yaml

create the docker compose.yml (see github.zip)

adapt the /opt/teleport/config/teleport.yaml (see github.zip)

Run the docker compose

   sudo docker compose up -d && sudo docker compose logs -f

Vérificate the TLS certificate

  curl https://teleport.mydomain.com/webapi/ping

5- initialize the cluster and create the first user (for example an admin admin )

sudo docker exec -it teleport tctl users add admin --roles=editor,access

Suis le lien/jeton affiché pour finaliser l'authentification sans TOTP

Github.zip
teleport.yaml
docker-compose.yml