Tutorial Setup Teleport: Akses Server & Database VPS Berbasis Zero Trust

Bahaya SSH Key Statis dan Port Publik Terbuka

Akses infrastruktur tradisional pakai SSH key statis dan port DB terbuka bawa risiko besar. Private key bocor, IP whitelisting rapuh, port forwarding publik rawan brute force attack scanner bot. Arsitektur Zero Trust ganti model ini. Verifikasi tiap request. Batasi hak akses minimal. Hapus total kredensial statis.

Vulnerabilitas Utama Metode Lama

• SSH Key Leak: Private key tersimpan di laptop engineer rawan dicuri. Tidak ada masa kadaluarsa otomatis. Privilege escalation terjadi saat laptop terkompromi.
• Port Database Open: Exposure port 5432 atau 3306 ke publik picu serangan port scanning dan exploit zero-day layer aplikasi.
• Audit Log Tersebar: Log /var/log/auth.log terpisah di tiap node. Analisis forensik saat insiden lambat. Tidak ada recording session interaktif TTY.
• VPN Overhead: VPN konvensional beri akses broad subnet. Peretas jebol VPN, lateral movement ke node lain mudah.
• Manual Offboarding: Karyawan resign butuh hapus public key manual di ratusan server. Human error buat backdoor tetap aktif.

Teleport amankan akses lewat arsitektur Identity-Aware Proxy. Client hubungi Teleport Proxy via HTTPS (port 443). Identity Provider (IdP) verifikasi user. Certificate Authority (CA) terbit sertifikat x509 dan SSH ephemeral. Masa aktif pendek (contoh: 8 jam). Tanpa simpan private key statis di target server.

Arsitektur Komponen Utama Teleport

Teleport bagi sistem jadi tiga komponen utama. Komunikasi antar komponen pakai TLS 1.3 mTLS.

• Auth Service: Certificate Authority (CA) internal cluster. Simpan state, audit log, terbit sertifikat singkat untuk user dan node.
• Proxy Service: Gateway publik pautkan client luar ke node internal. Tangani TLS termination, Web UI, multiplexing protokol via ALPN.
• Node / Target Service: Agent jalan di target server/database. Buat outbound reverse tunnel ke Proxy. Tidak butuh open inbound port di target host.

Instalasi dan Konfigurasi Teleport Community Edition (CE)

Setup Teleport Auth Service, Proxy Service, dan Node Service pada Ubuntu 22.04 LTS VPS.

Prasyarat System

• VPS Ubuntu 22.04 LTS (minimal 2 vCPU, 4GB RAM).
• Domain Fully Qualified Domain Name (FQDN) terarah ke IP VPS (misal: teleport.example.com).
• Port open di firewall: 443 (Proxy HTTPS & Web UI), 3023 (SSH Proxy), 3024 (Reverse Tunnel Agent), 3025 (Auth API).

Langkah 1: Install Teleport Binary

Pasang GPG key dan repository resmi Teleport di VPS main host:

sudo curl -fsSL https://apt.releases.teleport.dev/teleport-pubkey.asc | sudo apt-key add -
sudo add-apt-repository ppa:teleport/teleport-14
sudo apt update
sudo apt install teleport

Cek versi terinstall untuk verifikasi binary:

teleport version

Langkah 2: Konfigurasi Auth & Proxy Node

Buat file konfigurasi /etc/teleport.yaml di node utama. Integrasikan sertifikat Let's Encrypt otomatis via ACME:

version: v3
teleport:
  nodename: auth-proxy-node
  data_dir: /var/lib/teleport
  log:
    output: stderr
    severity: INFO

auth_service:
  enabled: "yes"
  cluster_name: teleport.example.com
  listen_addr: 0.0.0.0:3025
  authentication:
    type: local
    second_factor: otp

proxy_service:
  enabled: "yes"
  web_listen_addr: 0.0.0.0:443
  public_addr: teleport.example.com:443
  acme:
    enabled: yes
    email: admin@example.com

ssh_service:
  enabled: "yes"
  labels:
    env: production
    role: management

Start service Teleport dan aktifkan auto-start systemd daemon:

sudo systemctl enable --now teleport
sudo systemctl status teleport

Langkah 3: Buat User Administrative Pertama

Generate invite link admin lokal pakai command line tool tctl:

sudo tctl users add admin --roles=editor,access --logins=root,ubuntu

Buka link hasil output terminal di browser. Scan QR code pakai app Authenticator. Set password user admin.

Langkah 4: Hubungkan Target SSH Node Tambahan

Generate join token di Auth Node utama. Token berlaku 1 jam:

sudo tctl nodes add --ttl=1h --roles=node

Install Teleport di target node VPS second. Buat file /etc/teleport.yaml target node:

version: v3
teleport:
  nodename: db-vps-01
  auth_token: [JOIN_TOKEN_HERE]
  auth_servers:
    - teleport.example.com:443

ssh_service:
  enabled: "yes"
  labels:
    env: production
    db_type: postgresql

auth_service:
  enabled: "no"
proxy_service:
  enabled: "no"

Start agent service di target node. Agent buat outbound connection tunnel otomatis ke Proxy:

sudo systemctl enable --now teleport

Langkah 5: Integrasi PostgreSQL Database

Konfigurasi target database PostgreSQL terima SSL connection dari Teleport DB Service. Edit postgresql.conf:

ssl = on
ssl_ca_file = '/var/lib/teleport/db.ca'
ssl_cert_file = '/var/lib/teleport/db.crt'
ssl_key_file = '/var/lib/teleport/db.key'

Edit pg_hba.conf untuk mewajibkan client verifikasi mTLS certificate:

hostssl all all 0.0.0.0/0 cert clientcert=verify-full

Tambahkan blok db_service pada file /etc/teleport.yaml di agent node:

db_service:
  enabled: "yes"
  databases:
    - name: "prod-postgres"
      description: "Production PostgreSQL Server"
      protocol: "postgres"
      uri: "localhost:5432"
      static_labels:
        env: "production"
        role: "db"

Restart service Teleport di target host:

sudo systemctl restart teleport

Konfigurasi RBAC, Audit Logging, & Session Recording

1. Role-Based Access Control (RBAC)

Definisikan role pengguna granular via deklaratif YAML. Buat file developer-role.yaml:

kind: role
version: v5
metadata:
  name: developer
spec:
  allow:
    logins: [ dev, ubuntu ]
    node_labels:
      'env': 'staging'
    db_names: ['staging_db']
    db_users: ['dev_user']
    db_labels:
      'env': 'staging'
  deny:
    node_labels:
      'env': 'production'
    db_labels:
      'env': 'production'

Apply role ke cluster pakai tctl CLI:

tctl create -f developer-role.yaml

2. Session Recording & Audit Log

Teleport rekam aktivitas TTY real-time. Stream data tersimpan di storage lokal /var/lib/teleport/log atau S3 object storage.

• SSH Session Playback: Putar ulang video sesi interaktif ketikan keyboard terminal lewat Web UI atau CLI: tctl play [session-id].
• Structured Audit Log: Log format JSON terpusat. Tercatat event login attempt, query SQL execution, file transfer SCP, perubahan RBAC state.
• Non-bypassable Recording: Jika storage log penuh atau agent recording gagal, Teleport terminate SSH session otomatis demi security.

Cara Akses Server & DB dari Machine Lokal

Client install tsh CLI di laptop lokal.

Login ke Teleport Proxy

tsh login --proxy=teleport.example.com:443 --user=admin

Akses SSH Node

List server aktif:

tsh ls

Connect SSH ke node target:

tsh ssh ubuntu@db-vps-01

Akses Database PostgreSQL

List database aktif:

tsh db ls

Login ke PostgreSQL instance:

tsh db login prod-postgres --dbuser=postgres --dbname=staging_db

Jalankan client psql bawaan Teleport:

tsh db connect prod-postgres

Checklist Hardening VPS dengan Teleport

• Tutup Port SSH Standar (22): Blokir port 22 di UFW firewall dan Security Group VPS. Sisakan akses via Teleport Proxy.
• Disable Password Auth & Root Login: Set PasswordAuthentication no dan PermitRootLogin no pada /etc/ssh/sshd_config.
• Aktifkan WebAuthn / Hardware Key: Tambah FIDO2/YubiKey support di auth_service untuk cegah OTP phishing.
• Limit TTL Sertifikat: Set Max Certificate Life 8 jam. Sesi kadaluarsa paksa user re-authenticate tiap hari kerja.
• Isolasi Database User: Batasi permission PostgreSQL role dev_user dengan privilege minimal.
• Backup Direktori Auth State: Buat cronjob backup rutin folder /var/lib/teleport ke storage offsite terenkripsi.

Kesimpulan

Teleport hapus kebutuhan SSH key statis dan port DB publik. Akses terpusat, terenkripsi, berbasis sertifikat ephemeris, diaudit penuh. VPS aman tanpa ganggu produktivitas tim devops.