Removing the Complexity to Securely Access the Infrastructure

Key Takeaways

hey everyone welcome to the new stack makers i'm alex williams today we are discussing teleport 9 in particular teleport machine id and my guest today is ben errant who is a developer relations manager at teleport ben great to have you here thanks for having me so before we get started i always love to talk with the people who were interviewing about themselves and i saw that you uh have an interesting background but i was curious first of all about you know where did you grow up where what what really influenced you kind of in your younger years to be kind of where you are today can you think of anything in particular yeah well i grew up in the south of england currently in oakland and you know growing up big thing that influenced me was you know like early like internet you know i was probably the era of the 56k modem um yeah the uk was always a bit a little bit delayed um i actually remember going to like a career advisor at the time being like something kind of interesting with careers with computers and they're like you know that's not going to be a thing you know you could maybe be a professional programmer you know microsoft was like in the it world um but i think the whole concept of that initial web and we saw like web 2 and all the web 3 things it's that sort of new emergence of like youth coming up um and so basically just like the power and the ability to connect to people over the internet um locally was always an incredible thing that i think the internet really opened up and now everyone can experience it excellent and so you did go into industrial design as your focus of study as i saw on your linkedin why did you decide on industrial design and how did that lead to being at a place like teleport today i mean i love making things and taking things apart which is natural part of my curiosity um and i think a thing that's sort of interesting now we talk a lot about um the s-bomb and as i went through my industrial design process you you design something you mainly get it made in china you get it shipped but you have like a bit of materials and i think the thing that sort of really got me excited about our traditionally was like interaction design so it was like the interface between hardware and software and you know this is even like pre-ipad and so like people who made computers the industrial design is like kind of interesting but it's not as interesting as the software and i think it's working like hardware has disappeared making software is one way easier than having to do like an actual bit of materials in china like if you ship a million widgets that are wrong like you've got a million widgets but if you can like easily iterate with software and i think that's the exciting thing about the movement of you know sas and you can just always redeploy you can give people different variants of your product which is sort of hard to really do in like the physical world and i think that kind of really excited me about um you know the move into software and startups and i moved to the bay area a decade ago for a real estate startup okay and um you know we talk about like bootstrapping i stepped under my desk for the first six months until we had like ramen profitability it took me like a year or so to realize that like most startups don't necessarily are that scrappy and um the real estate startup didn't go anywhere and we got into the developer tool space and so i've worked on except exception trackers uh nosql databases as a provider and i always say to people in the bay area it's like the gold rush you know it's always better to sell pickaxes and jeans than it is to be looking for the next big hit yeah no kidding isn't that true so now you're at teleport and you must have learned a lot along the way about the complexity of those interactions in between the software and the hardware and really that delineation between hardware engineers and software engineers and the delineation between teams and developer teams and a lot of what i see from you all doing at teleport is trying to decrease that complexity so could you tell us a little bit about teleport itself what is the company what does it do and how does it help with that complexity that often comes when you're thinking about security integrating into that software bill of materials which uh you refer to as s-bomb yeah i think if you go back a bit historically you know if you wanted to have your infrastructure you would build out like a rack and you'll be in charge like the physical security you know if someone wanted to like reboot it they could physically go up to it i think the movement to cloud we kind of move to the shared responsibility model we assume that the physical access to the rack is secured up to a certain level and then you're responsible for everything above it so you know in amazon it's the vpcs it's the iam it's everything else all of this extra complexity and what teleport does is it helps teams provide uh easy secure access to all of this infrastructure and we started off in the world of um servers and ssh access but in the last couple of years we sort of covered the full gamut of things you would access everywhere from you know servers kubernetes clusters to even aws management console and the thing that makes sort of teleport unique is one of the core ideas is short-lived credentials so everything is sort of based upon certificates in the background you don't really see it as a user but if you were to each day you log in you get a certificate for that day which is defined as some sort of role and you can go about your day's access once those eight hours have passed your credentials are invalid and you need to go back through uh sso flow to log in again and this sort of fixes many problems that um you traditionally had with you know just infrastructure in general like team members get onboarded they come and go you might have to add like public keys to servers your ansible run and it just the complexity just increases increases as you have more stuff in your applications and so you know as we've added database support we've added more users sort of accessing different services in a sort of a secure manner so one of the things i was recognizing when i was reading about you know the background on on these different capabilities you have you started with you know uh you know with uh ssh nodes for instance you cover kubernetes clusters and there's a lot of discussions on there's a lot of things in there about configurations themselves that's one of the concerns that a lot of people have about kubernetes is it you know is the multiple users might be asking accessing a yaml file or you might have a multiple personas um you know uh do you know working on a configuration right yeah so like common cases if you you know create a fresh kubernetes cluster you might add everyone to a like system masters role which is sort of the default sort of god mode and what happens is teams might pass around like a cube like a long-lived cube config to the whole team and so one problem is like there's any visibility into which users are using that um sort of cube config what are they doing when they sort of access the kubernetes api and two like if that person leaves like are you really rotating that cube config which the most likely answer is probably not right right right so so how are you kind of building on that reduced complexity in in teleport uh nine and i'm you know and you're making a big deal of the teleport machine id preview so i'm curious on what that is but first of all just kind of that that that complexity issue that you're trying to work on all the time well i think it's starting with the principle of least privilege um which is you know a common term of you only give people the permissions that they need and then if they need more you sort of give them on demand and this generally reduces sort of the attack factor so if someone wants to get someone's credentials there's not going to be a like a wider privilege escalation into something else and i think this is a problem with both like aws management console and kubernetes clusters if you have the systems masters rule it's pretty much easy to get access to any pod and once you get access to any pod you can likely get like pop environmental credentials for databases and then you pop the database then you get all that information and you know like bad things can happen in teleport 9 we've taken the same concept for user access but applied it to sort of computers and services to access those clusters i think a classic example for us is both ci cd servers and sort of ansible runs you you can think of them almost in the same way so like let's say jenkins is you know he's like a funny waiter this is like mascot but what you do is the ops team will set up jenkins they'll give you know jenkins like a very long certificate probably a public private key once that's configured you know you may rotate it once a year you may not but jenkins just goes about his business and um there's many sort of problems here and we're seeing this a lot more with um you know both solarwinds attack which was uh compromise of the build infrastructure and so people know that these like build infrastructures they'd not only run your like tests but often if they're doing continuous deployments they might have specific credentials that get access to your aws account and then if you have a privileged credential in aws account it's pretty easy to then like escalate something else and what machine id does is it provides the same access of short-lived certificates but for these machine-to-machine communication hmm so let's go through teleport 9.0 and how it reflects about you know teleport itself and its mission and how you're trying to help users with these issues that you're talking about what is teleport machine id pre and what is the preview so the preview is our first release of um machine id and so this lets teammates listen this lets teleport customers enroll robots into their clusters so instead of using sort of you know the jenkins example public private keys you set up tbots which is another service that you run and sort of two bots once it's issued it will automatically retrieve new certificates every 20 minutes this is also customizable and what this does is by issuing these short-lived credentials for access if there is a compromise on your machine you can easily lock those credentials and the other benefit is there's a full audit log of what's happening during those runs so if you notice that it was um like ansible the way in which ansible runs for example it like scps a file into the host and then it runs that file we get all this information in teleport to know oh what are these machines doing um and how are they accessing it okay so it gives you more of a window into in into that doesn't it yeah if like one it reduces like the human error so um often you might have like a person which would run the like public private keys on some machine you know accessing and securely rotating those credentials can be difficult or it might be on disk somewhere it reduces that problem once the t-bot service is joined it's only a one-time token even if you try to get those certificates we have certain mechanisms in place to secure those tokens and um the second thing is if they are compromised because it's such a short window of access it means that you know they're sort of useless in that sort of short time period i'm currently reducing privileged escalation one of the questions i have is about the database features that you're adding to teleport nine and you offer lots of capabilities with databases now and there's multiple databases that you now support and you know there's a lot of things that i think i'm hearing from what you're talking about in previous discussions that apply here to databases what can you say about you know the changes that you that people will see in teleport nine yeah database is an interesting addition to teleport you know it's sort of many of the crown jewels of your applications are in databases you know you might pop a server you guys have you know like some service or program but there's not much sensitive information in here database is likely to have like pii and so if you're in a hipaa or you have like pci or you're going through stock 2 you want to make sure that people are you know who's accessing your databases and what are they doing and so teleport 9 just extends our features that we have in place for um mariby db redis and microsoft sql server both uh aws hosted rds editions and then also self-hosted versions um you know my favorite one is redis i used to run a redis as a service product and our product would we would provide people with long passwords or username and passwords for accessing their cluster and all the time people would check them into github and so they wouldn't put them in an env file or they check their amv file maybe not anything that bad will happen if you access a reddit server but you'll be surprised with um what can get infiltrated into these servers and two you don't want people accessing your machines and even if they did access you wouldn't necessarily have the visibility into knowing exactly what people did once they connected to that database so even if someone does get teleport credentials the teleport proxies have been placed that keeps a full order log of the activity and actions of that user um during that session and so with that new database access what is it what are some of the problems that you're seeing out there that this helps resolve it's the same problem of you know as team members come and go you provide access to the database so likely you'll have like a shared user so they say the data science team might all use one shared login and they might have one dedicated password um you know the best practice in aws is you set up like a bastion host you need to configure that to you know get into your vbc because you don't want your database in like a public subnet that's all extra work that you need to do and teleport sort of solves that for you sort of out of the box um to provide that sort of bastion access to your database and then if you're you know your data science team is all using one shared login teleport will be able to identify which person in the data science team was accessing which database um and so you can sort of know like what's happening at the database level so you know where the access is you know what what the access is the database yeah cool um the last thing i want to ask about were these moderated sessions for servers and kubernetes access can you talk to that yeah this is um you know interesting addition that we've had through talking to our customers and um you know i started off with the two party rule and this is sort of a concept that you see in um both accounting and in a more extreme version is like the american nuclear missile silos you know you require actually have the four-party system and this is a system in which you need an observer to witness the actions that are taking place to sort of either approve that someone can start a session and this is both for ssh and kubernetes and also the option to provide them the ability to terminate their session for example and moderated sessions is highly configurable you know you could add as many people as you like but an example you might want to request like three people another developer and maybe someone from the compliance team to make sure whatever's happening during that session on a kubernetes cluster on a server is fully observable um and it also provides all of the other controls so if the audit didn't like what was happening they have the ability to terminate the session of the individual hoodstuff excellent any concluding thoughts about teleport 9 that you'd like to talk about i think the last one is we've really finished up our support for windows desktop access this was added in teleport 8 but in teleport 9 we have clipboard supports and we have the ability to record the sessions so we have full session playback which i can add in the demo they'll be on youtube great yes and we're gonna do a demo now so we'll go over to that for anyone who is listening to this podcast the demo is available on the news the new stack youtube channel so we'll uh we'll we'll start that right now but ben i thanks for your time here and we'll we'll carry on with the demo if you like this video please give us a thumbs up and if you'd like to see more videos like this you can always subscribe to our youtube channel we're on all the major social media platforms you can always find us at the newstac.io we hope to see you soon [Music]