Skip to content

Teleport identity, MFA & sign-in security checks

Who can sign in, how strongly they authenticate, and whether sessions, passwords and sign-in locations meet the baseline every admin account should clear.

On Teleport, Black Cat runs 11 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Teleport connector needs.

Checks (11)

severity: critical Cluster MFA Disabled fix difficulty: easy #

Enable at least one second factor in the cluster authentication preference

  1. Log in to the Teleport Web UI as an admin or use tctl
  2. Run tctl get auth_preference to inspect the current configuration
  3. Set second_factors to include webauthn or totp (not off or empty)
  4. Apply the updated configuration with tctl create -f auth_preference.yaml
  5. Verify the change with tctl get auth_preference and confirm second_factors is populated

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.5 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

severity: high Session MFA Not Enforced fix difficulty: easy #

Enable require_session_mfa in the cluster authentication preference

  1. Export the current auth preference with tctl get auth_preference > auth_pref.yaml
  2. Set require_session_mfa to true in the spec
  3. Apply the updated configuration with tctl create -f auth_pref.yaml
  4. Test by starting a new SSH session and confirming MFA is prompted

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.5 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

severity: medium TOTP Without WebAuthn fix difficulty: medium #

Add WebAuthn as a second factor alongside TOTP to provide phishing-resistant MFA

  1. Export the current auth preference with tctl get auth_preference > auth_pref.yaml
  2. Add webauthn to the second_factors list in the spec
  3. Apply the updated configuration with tctl create -f auth_pref.yaml
  4. Encourage users to register a hardware security key via the Teleport Web UI

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.5 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

severity: medium Local Auth Enabled With SSO fix difficulty: medium #

Disable local authentication when SSO is configured to enforce centralized identity

  1. Export the current auth preference with tctl get auth_preference > auth_pref.yaml
  2. Set allow_local_auth to false in the spec
  3. Apply the updated configuration with tctl create -f auth_pref.yaml
  4. Verify that SSO login works correctly before disabling local auth
  5. Ensure all admin break-glass accounts use SSO or have emergency access procedures

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.5 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

severity: medium Passwordless Without Hardware Key Policy fix difficulty: medium #

Set a hardware key policy when passwordless authentication is enabled

  1. Export the current auth preference with tctl get auth_preference > auth_pref.yaml
  2. Set private_key_policy to hardware_key or hardware_key_touch in the spec
  3. Apply the updated configuration with tctl create -f auth_pref.yaml
  4. Communicate the hardware key requirement to users enabling passwordless login

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.5 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

severity: high Admin Action MFA Not Enforced fix difficulty: easy #

Enable MFA enforcement for admin actions to protect privileged operations

  1. Export the current auth preference with tctl get auth_preference > auth_pref.yaml
  2. Set admin_action_mfa_enforced to true in the spec
  3. Apply the updated configuration with tctl create -f auth_pref.yaml
  4. Verify by attempting an admin action and confirming MFA is prompted

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.5 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

severity: medium Expired Certificate Disconnect Disabled fix difficulty: easy #

Enable automatic session disconnect when certificates expire

  1. Export the current auth preference with tctl get auth_preference > auth_pref.yaml
  2. Set disconnect_expired_cert to true in the spec
  3. Apply the updated configuration with tctl create -f auth_pref.yaml
  4. Verify that sessions are terminated when certificates expire

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.5 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

severity: low Device Trust Disabled fix difficulty: hard #

Enable device trust mode to restrict access to managed corporate devices

  1. Export the current auth preference with tctl get auth_preference > auth_pref.yaml
  2. Set device_trust.mode to optional or required in the spec
  3. Apply the updated configuration with tctl create -f auth_pref.yaml
  4. Enroll managed devices using the tsh device enroll command
  5. Progressively move to required mode after all managed devices are enrolled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.5 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

severity: medium Role Does Not Require Session MFA fix difficulty: easy #

Enable per-session MFA in the role options to require MFA before each session

  1. Export the role with tctl get role/<name> > role.yaml
  2. Set require_session_mfa to on in the role options
  3. Apply the updated role with tctl create -f role.yaml
  4. Verify that starting a new session prompts for MFA

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.5 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

severity: high Local User Has No MFA Device fix difficulty: easy #

Require the user to register an MFA device to protect their account

  1. Ask the user to log in to the Teleport Web UI
  2. Navigate to Account Settings and select Add MFA Device
  3. Register a WebAuthn hardware key or TOTP authenticator app
  4. Confirm the MFA device appears in the user profile
  5. Consider enforcing cluster-wide MFA to prevent future users from skipping registration

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.5 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

severity: low User Uses Only TOTP for MFA fix difficulty: easy #

Encourage the user to register a WebAuthn hardware key as a stronger MFA option

  1. Ask the user to log in to the Teleport Web UI
  2. Navigate to Account Settings and select Add MFA Device
  3. Register a WebAuthn hardware security key
  4. Optionally remove the TOTP device if WebAuthn is the preferred method

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.5 NIST CSF 2.0 PR.AA-03 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4

More Teleport checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial