Teleport is a zero-trust access platform that provides identity-based access to infrastructure resources such as Linux servers, Kubernetes clusters, databases, and applications. Teleport uses authentication and authorization controls to determine both the identity of a connecting entity and the resources that entity is permitted to access.
Teleport Machine & Workload Identity provides identity-based authentication for non-human identities such as automation services, CI/CD workloads, and other machine processes. Teleport uses short-lived certificates for these identities rather than relying on long-lived static credentials.
In this use case, a controlled Teleport Zero Trust access infrastructure is deployed on Ubuntu Linux inside an isolated VirtualBox laboratory. A second Ubuntu or Linux target server is enrolled into the Teleport cluster as the protected infrastructure resource. Kali Linux is used as the authorized security-testing environment.
A controlled service identity is created to represent a laboratory automation workload. The service identity is assigned a narrowly scoped Teleport role that permits access only to a designated laboratory resource identified through Teleport resource labels.
The security assessment attempts to bypass this policy by using the valid service identity to request or establish access to a resource outside the identity's permitted scope. The assessment does not attempt to forge Teleport certificates or compromise the Teleport Certificate Authority. Instead, it validates whether the authorization boundary correctly rejects a valid identity when that identity requests a resource outside its assigned policy.
Teleport RBAC uses allow and deny rules, with deny rules taking priority. Teleport roles can also restrict which resource labels and Linux logins an identity can access.
The controlled assessment therefore evaluates whether identity authentication is incorrectly treated as sufficient authorization, or whether Teleport continuously evaluates the authenticated service identity against its assigned resource and access policies. When the service identity attempts to access an unauthorized resource, Teleport's authorization policy should deny the connection.
The remediation focuses on least-privilege role design, resource-label restrictions, permitted-login restrictions, short-lived identity credentials, and continuous authorization validation. Teleport documentation recommends restricting roles to only the resources and permissions required by the workload and notes that resource labels can be used to control which infrastructure resources a bot can access.
The complete Zero Trust security workflow is: Service Identity Creation → Short-Lived Identity Issuance → Role Assignment → Resource-Label Authorization → Legitimate Resource Access → Unauthorized Resource Request → Identity and Policy Verification → Access Decision → Unauthorized Access Denied → Security Event Logging → Policy Validation → Post-Remediation Access Testing.
Teleport provides the controlled identity-based access infrastructure for the security assessment. Teleport users and machine identities are assigned roles that govern access to infrastructure resources. Teleport roles can define allowed resources, Linux logins, and other permissions. Resource labels can be used to restrict access to specific infrastructure resources. Teleport Machine & Workload Identity provides short-lived credentials for machines and workloads. These credentials are tied to the identity of the service and automatically expire.
A service identity may be correctly authenticated but still attempt to access a resource outside the scope of its assigned role. The security problem occurs if the access infrastructure incorrectly accepts the authenticated identity without enforcing the complete authorization policy for the requested resource. For example, a service identity permitted to access a development server may attempt to access a production-labeled server, a different Linux login, or another resource outside its assigned policy.
The security problem is therefore:
The proposed Zero Trust solution continuously validates the authenticated service identity against its role, resource labels, permitted login, and requested resource before allowing access.
The controlled attack scenario evaluates whether a valid Teleport service identity can bypass its assigned authorization policy and access an infrastructure resource outside its permitted scope. The service identity is intentionally given access only to a designated laboratory resource. The objective is to determine whether Teleport validates the requested resource against the identity's authorization policy or incorrectly allows the authenticated service to proceed.
The primary security concept is continuous identity verification. Teleport authentication establishes the identity of a connecting machine or workload using short-lived certificates. Teleport states that certificates are tied to user or service identity and that short-lived certificates automatically expire. Authentication alone is not treated as permission to access every infrastructure resource. After identity authentication, Teleport authorization evaluates the identity's assigned roles and permissions against the requested resource. The second security concept is least-privilege authorization: the service identity is assigned only the permissions required for its intended laboratory function. Teleport recommends using restrictive roles and resource labels so that machine identities receive access only to the hosts and resources they actually need.
The secure processing flow is:
The controlled workload authenticates to Teleport using its assigned machine/workload identity. Teleport Machine & Workload Identity is designed to replace long-lived secrets with short-lived certificates for non-human identities.
Establish a verifiable identity for the connecting service before resource access is evaluated.
The service uses Teleport-issued credentials with a defined lifetime. Teleport documents that short-lived certificates automatically expire.
Limit the useful lifetime of service credentials and require continuing identity issuance.
The service identity is assigned a Teleport role defining its permitted infrastructure access. Teleport roles use allow and deny rules, with deny rules taking priority.
Ensure that service access is governed by explicit authorization policy.
The service role is restricted to specific resource labels, such as a designated laboratory environment. Teleport documents resource labels as a mechanism for controlling which resources a role can access.
Prevent the service identity from accessing resources outside its assigned environment.
The service role specifies only the Linux login required by the workload. Teleport roles can define permitted Linux/Unix logins for infrastructure access.
Prevent a valid service identity from using an unauthorized operating-system account.
The service role is designed with only the permissions and resources required by the laboratory workload. Teleport recommends restrictive roles instead of broadly permissive roles.
Reduce the authorization scope available to a service identity.
Each resource-access attempt is evaluated against the service identity's current authorization policy.
Prevent a successfully authenticated identity from bypassing resource-specific authorization.
Access requests targeting resources outside the permitted label and role scope are denied.
Prevent service identities from crossing defined trust boundaries.
Teleport security and audit activity is monitored during the assessment.
Provide visibility into service authentication and authorization decisions.
The original policy-bypass attempt is repeated after the least-privilege controls are implemented.
Verify that unauthorized service-resource access remains blocked while legitimate access continues to function.
Teleport provides the controlled zero-trust infrastructure access environment.
Teleport Machine & Workload Identity provides identity-based authentication for non-human workloads using short-lived credentials.
`tbot` is Teleport's lightweight Machine & Workload Identity agent used to provision short-lived credentials to workloads and automation systems.
`tctl` is used to configure and inspect Teleport resources and roles.
`tsh` is used to perform controlled Teleport access operations.
Kali Linux provides the authorized security-testing environment.
Ubuntu Linux provides the controlled infrastructure resources enrolled into Teleport.
Wazuh monitors relevant Ubuntu and Teleport security activity.
OpenSearch provides centralized security-event investigation.
VirtualBox provides the isolated Zero Trust security laboratory.
Research Breakthrough Possible @S-Logix