Teleport configuration hardening security checks
Vendor-recommended secure defaults, patch levels and housekeeping settings that drift as tenants grow and admins change.
On Teleport, Black Cat runs 3 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Teleport connector needs.
Checks (3)
severity: low Trusted Cluster Is Disabled fix difficulty: easy #
Remove disabled trusted cluster configurations that are no longer in use
- Confirm whether the trusted cluster relationship is still needed
- If no longer needed, delete the trusted cluster with tctl rm trusted_cluster/<name>
- If it should be active, enable it by setting enabled to true in the spec
- Apply the change with tctl create -f trusted_cluster.yaml
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: medium No Client Idle Timeout Configured fix difficulty: easy #
Set a client idle timeout to automatically disconnect inactive sessions
- Export the cluster networking config with tctl get cluster_networking_config > cnc.yaml
- Set client_idle_timeout to an appropriate value such as 15m or 30m
- Apply the updated configuration with tctl create -f cnc.yaml
- Verify that idle sessions are disconnected after the configured timeout
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: medium Node Running Outdated Teleport Version fix difficulty: medium #
Upgrade the Teleport agent on the node to a supported version (v15 or later)
- Identify the current Teleport version on the node with teleport version
- Follow the Teleport upgrade guide for the target operating system
- Download the new Teleport binary from goteleport.com/download
- Replace the binary and restart the teleport service
- Verify the node re-registers with the cluster and shows the updated version in tctl get nodes
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10