Teleport

ssh azureuser@<vm-ip>

Confirm that Teleport (OSS Community) and nginx are running. Note the single-port TLS-routing listeners.

teleport version | head -1 sudo systemctl is-active teleport.service nginx.service
sudo ss -tlnp | grep -E ':443 |:80 '

On first boot, Teleport generates its own certificate authorities onto the dedicated data disk. These checks show three things:

• tctl status shows the cluster's per-VM CAs.
• The SAN of the self-signed TLS certificate is unique to this VM.
• The shipped config contains no static join token.

sudo tctl status
sudo findmnt /var/lib/teleport
sudo openssl x509 -in /var/lib/teleport/certs/teleport.crt -noout -subject -ext subjectAltName echo "static join tokens in teleport.yaml: $(sudo grep -cE 'static_tokens|auth_token:' /etc/teleport.yaml || true)"

The Teleport proxy serves its web UI over TLS on port 443. The small nginx on port 80 answers an unauthenticated health probe and redirects everything else to HTTPS.

curl -sk -o /dev/null -w 'web/login HTTP %{http_code}\n' https://127.0.0.1/web/login
curl -s -o /dev/null -w 'healthz HTTP %{http_code}\n' http://127.0.0.1/healthz

Set the proxy's public address

First boot writes the address that Azure reports into the proxy's public_addr, the TLS certificate and the one-time sign-up link. With a Standard SKU public IP (the Azure default), the current image records the VM's private address (10.0.0.x).

As a result, the sign-up link and every address that Teleport hands to browsers and tsh point at a private address you cannot reach. The certificate also does not name the public IP. Check the recorded address:

sudo grep 'public_addr' /etc/teleport.yaml

If it shows a 10. address and you have not used the sign-up link yet, set the public IP on the VM and issue a fresh link. Azure's instance metadata service reports the public IP to the VM itself, and nothing leaves the VM:

PUBLIC_IP=$(curl -s -H Metadata:true 'http://169.254.169.254/metadata/loadbalancer?api-version=2020-10-01' | grep -o '"frontendIpAddress":"[^"]*"' | head -1 | cut -d'"' -f4)
PRIV=$(hostname -I | awk '{print $1}'); echo "public $PUBLIC_IP, private $PRIV"
sudo openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
  -keyout /var/lib/teleport/certs/teleport.key -out /var/lib/teleport/certs/teleport.crt \
  -subj "/CN=$PUBLIC_IP" \
  -addext "subjectAltName=IP:$PUBLIC_IP,IP:$PRIV,DNS:$(hostname -s),DNS:localhost,IP:127.0.0.1" sudo chmod 0600 /var/lib/teleport/certs/teleport.key
sudo sed -i "s/public_addr: \"$PRIV:443\"/public_addr: \"$PUBLIC_IP:443\"/" /etc/teleport.yaml
sudo systemctl restart teleport sleep 15
sudo tctl users rm teleport-admin >/dev/null 2>&1
INVITE=$(sudo tctl users add teleport-admin --roles=editor,access | grep -oE 'https://[^ ]*/web/invite/[a-f0-9]+')
sudo sed -i -e "s#https://[^ ]*/web/invite/[a-f0-9]*#$INVITE#" -e "/cluster_name/!s/\b$PRIV\b/$PUBLIC_IP/g" /root/teleport-credentials.txt
sudo sed -i "/Cluster:/!s/\b$PRIV\b/$PUBLIC_IP/g" /etc/update-motd.d/90-teleport

The cluster name stays the private address. Teleport fixes the name when it creates the cluster, and it is only a label. Use the new link in Step 5.

For a DNS name, set PUBLIC_IP to the name and write DNS:$PUBLIC_IP in place of IP:$PUBLIC_IP. Alternatively, follow Step 12 for a trusted certificate.

The image ships no admin password. On first boot, each VM creates a teleport-admin user with a single-use sign-up URL. Read the URL, then open it in your browser. Set your own password and enroll an authenticator (TOTP).

sudo grep 'web/invite' /root/teleport-credentials.txt

The sign-up link is single-use and expires. If it lapses, generate a new one on the VM with sudo tctl users add teleport-admin --roles=editor,access.

Browse to https://<vm-ip>/web/login. The VM uses a per-VM self-signed certificate, so your browser shows a certificate warning the first time. Accept it. For production, replace the certificate as described in Step 12. The Teleport Community sign-in form then opens.

After you sign in, you land on the unified Resources dashboard. It lists the servers, Kubernetes clusters, databases and apps you can reach through the access plane. The VM itself appears as an SSH resource.

Teleport records every action, including certificate issuance, MFA enrollment, user creation and session start and stop. The Audit Log view and Session Recordings give you a full, tamper-evident record of access.

Manage local users and their roles under Zero Trust Access > Users. The per-VM teleport-admin has the built-in access and editor roles.

Enroll additional nodes, databases, Kubernetes clusters and apps so you can access them through Teleport with short-lived certificates and full session recording.

sudo tctl tokens add --type=node sudo tctl nodes ls

Run the printed teleport start ... command on the target server to join it to the cluster. The server then appears in the Resources dashboard.

Component and path:

Teleport binary: /usr/local/bin/teleport (tctl and tsh alongside)

systemd unit: teleport.service (plus teleport-firstboot.service)

Config: /etc/teleport.yaml (version v3, all-in-one auth, proxy and SSH)

Cluster state: /var/lib/teleport/ (dedicated data disk holding CAs, audit log and recordings)

Per-VM TLS cert: /var/lib/teleport/certs/teleport.{crt,key}

First-boot script: /usr/local/sbin/teleport-firstboot.sh

Credentials: /root/teleport-credentials.txt (mode 0600 root:root)

Health probe: nginx on :80 serves /healthz and sends a 301 redirect to HTTPS

• Replace the self-signed certificate. Place your own domain certificate in /var/lib/teleport/certs/ and update key_file/cert_file in /etc/teleport.yaml. Alternatively, enable Teleport ACME with a real DNS name. Then run sudo systemctl restart teleport.
• Set a real public_addr. Point proxy_service.public_addr in /etc/teleport.yaml at your DNS name, so that tsh and the web UI use it.
• Add an SSO connector. Configure GitHub, SAML or OIDC as your identity source for production sign-in.
• Enable WebAuthn MFA. With a real domain, switch authentication.second_factor to webauthn for phishing-resistant MFA. TOTP is the appliance default.
• Restrict the NSG. Keep 443 open to your users and 80 open for the health probe and redirect. Limit 22 to your management CIDR.
• Patch regularly. The official Teleport apt repository keeps teleport current within the stable/v18 channel through unattended-upgrades. Subscribe to https://goteleport.com/download/ for release news.