이 페이지에서는 Linux 호스트에 머신 및 워크로드 아이덴티티 에이전트인 tbot을 배포하는 방법을 설명합니다.

작동 방식#

tbot이 Teleport 클러스터에 처음 인증하는 과정을 조인이라고 합니다. 조인 방법은 봇이 자신의 아이덴티티를 증명하는 특정 기술입니다.

머신에서 사용 가능한 아이덴티티 형태가 없는 플랫폼에서는 token 조인 방법만 사용할 수 있습니다. token 조인 방법은 공유 시크릿에 의존하는 유일한 조인 방법이라는 점에서 특별합니다. 이에 따른 위험을 줄이기 위해 token 조인 방법은 일회용이며 같은 토큰을 여러 번 사용하는 것은 불가능합니다.

사전 조건#

• A running Teleport cluster. If you want to get started with Teleport, sign up for a free trial or set up a demo environment.

• The tctl and tsh clients.

  Installing `tctl` and `tsh` clients

  1. Determine the version of your Teleport cluster. The tctl and tsh clients must be at most one major version behind your Teleport cluster version. Send a GET request to the Proxy Service at /v1/webapi/find and use a JSON query tool to obtain your cluster version. Replace with the web address of your Teleport Proxy Service:

     $ TELEPORT_DOMAIN=
     $ TELEPORT_VERSION="$(curl -s https://$TELEPORT_DOMAIN/v1/webapi/find | jq -r '.server_version')"
     

  2. Follow the instructions for your platform to install tctl and tsh clients:

To check that you can connect to your Teleport cluster, sign in with tsh login, then verify that you can run tctl commands using your current credentials.

For example, run the following command, assigning to the domain name of the Teleport Proxy Service in your cluster and to your Teleport username:

$ tsh login --proxy= --user=
$ tctl status
# Cluster  (=teleport.url=)
# Version  (=teleport.version=)
# CA pin   (=presets.ca_pin=)

If you can connect to the cluster and run the tctl status command, you can use your current credentials to run subsequent tctl commands from your workstation. If you host your own Teleport cluster, you can also run tctl commands on the computer that hosts the Teleport Auth Service for full permissions.

• tbot을 설치할 Linux 호스트.
• 해당 호스트에서 tbot을 실행할 Linux 사용자. 이 가이드에서는 teleport를 사용합니다.

1/4단계. tbot 설치#

이 단계는 Linux 호스트에서 완료합니다.

먼저 머신 및 워크로드 아이덴티티를 사용할 VM에 tbot을 설치해야 합니다.

플랫폼에 적합한 방식으로 Teleport를 설치합니다:

To install a Teleport Agent on your Linux server:

The recommended installation method is the cluster install script. It will select the correct version, edition, and installation mode for your cluster.

1. Assign to your Teleport cluster hostname and port, but not the scheme (https://).

2. Run your cluster's install script:

   $ curl "https:///scripts/install.sh" | sudo bash
   

2/4단계. 봇 사용자 생성#

이 단계는 로컬 머신에서 완료합니다.

봇을 생성합니다:

$ tctl bots add example

조인 토큰이 tctl bots add 결과에 포함됩니다. tbot을 구성할 때 필요하므로 이 값을 기록해 둡니다.

3/4단계. tbot 구성#

이 단계는 Linux 호스트에서 완료합니다.

/etc/tbot.yaml을 생성합니다:

version: v2
proxy_server: example.teleport.sh:443
onboarding:
  join_method: token
  token: (=presets.tokens.first=)
storage:
  type: directory
  path: /var/lib/teleport/bot
# services will be filled in during the completion of an access guide.
services: []

다음을 교체합니다:

• example.teleport.sh:443을 Teleport Proxy 또는 Auth Service의 주소로 교체합니다. Teleport Proxy의 주소 사용을 권장합니다.
• <code>[presets.tokens.first]</code>를 이전 단계에서 tctl bots add가 반환한 토큰으로 교체합니다.

스토리지 디렉터리 준비#

Create the bot data directory and grant permissions to access it to the Linux user (in our example, teleport) which tbot will run as.

# Make the bot directory and assign ownership to teleport user
$ sudo mkdir -p /var/lib/teleport/bot
$ sudo chown teleport:teleport /var/lib/teleport/bot
# Allow teleport user to open directory
$ sudo chmod +x /var/lib/teleport /var/lib/teleport/bot

systemd 서비스 생성#

By default, tbot will run in daemon mode. However, this must then be configured as a service within the service manager on the Linux host. The service manager will start tbot on boot and ensure it is restarted if it fails.

If tbot was installed using the Teleport install script or teleport-update command, the tbot systemd service is automatically created for you.

After tbot.yaml is created, enable and start the service::

$ sudo systemctl enable tbot --now

Check the service has started successfully:

$ sudo systemctl status tbot

Service properties like User and Group may be configured using systemctl edit tbot.`

If tbot was installed manually, service configuration will need to be performed manually as well.

For this guide, systemd will be demonstrated but tbot should be compatible with all common alternatives.

Use tbot install systemd to generate a systemd service file:

$ sudo tbot install systemd \
   --write \
   --config /etc/tbot.yaml \
   --user teleport \
   --group teleport \
   --anonymous-telemetry

Ensure that you replace:

• teleport with the name of Linux user you wish to run tbot as.
• /etc/tbot.yaml with the path to the configuration file you have created.

You can omit --write to print the systemd service file to the console instead of writing it to disk.

--anonymous-telemetry enables the submission of anonymous usage telemetry. This helps us shape the future development of tbot. You can disable this by omitting this.

Next, enable the service so that it will start on boot and then start the service:

$ sudo systemctl daemon-reload
$ sudo systemctl enable tbot --now

Check the service has started successfully:

$ sudo systemctl status tbot

4/4단계. 서비스 구성#

You have now prepared the base configuration for tbot. At this point, it identifies itself to the Teleport cluster and renews its own credentials but does not output any credentials for other applications to use.

Follow one of the access guides to configure a service that meets your access needs.

다음 단계#

• 환경에 맞게 tbot을 계속 구성하려면 접근 가이드를 따릅니다.
• 모든 사용 가능한 구성 옵션을 탐색하려면 구성 레퍼런스를 읽어보세요.
• TELEPORT_ANONYMOUS_TELEMETRY에 대한 자세한 정보.