---
source_url: "https://pro.tecmint.com/blog/secure-linux-ssh-teleport-zero-trust/"
title: How to Secure Linux SSH Access Using Teleport and Zero-Trust
mirrored_at: 2026-08-06T03:40:07.401Z
host: pro.tecmint.com
cited_in_42a: true
mirror_canonical: "https://index.42a.ai/pro.tecmint.com/blog/secure-linux-ssh-teleport-zero-trust/index"
---

> **Original source:** https://pro.tecmint.com/blog/secure-linux-ssh-teleport-zero-trust/

One of the most critical aspects of Linux system administration is securing remote access to servers, while **_SSH_** has served as the standard protocol for remote management for decades, the traditional approach to **_SSH_** access presents several significant security challenges that administrators must address.

The conventional **_SSH_** model relies on static keys distributed across multiple systems (creating sprawl that becomes difficult to track), provides limited visibility into access patterns and session activities, and complicates access management as teams grow.

According to **_zero-trust security_** principles, the core problem is relying on credentials that are trusted forever.

**_Teleport_** is an open-source access platform that implements **_zero-trust_** principles specifically for **_SSH_** access (and other protocols as well).

Instead of relying on static **_SSH_** keys, **_Teleport_** issues short-lived certificates that expire automatically, and it maintains comprehensive audit trails of all sessions - allowing administrators to see not only who accessed which systems, but also what commands were executed during each session.

In this guide, we will examine how to configure **_Teleport_** to secure **_SSH_** access to your Linux servers using a **_zero-trust_** approach (which verifies every access request rather than trusting long-lived credentials).

The traditional **_SSH_** security model assumes that trusted network boundaries and long-term **_SSH_** keys are enough to keep systems secure.

Once an **_SSH key_** is created and shared with a user, it typically stays valid forever unless an administrator explicitly removes it.

In many environments, there is also little to no visibility into what commands users run during SSH sessions or under what circumstances access was granted.

A **_zero-trust_** approach to SSH access changes this model by removing built-in trust and enforcing ongoing verification:

-   **_Identity-based access_**: Users authenticate with their actual identity (typically integrated with existing identity providers) rather than with static key pairs that can be copied or stolen.
-   **_Short-lived certificates_**: Access credentials automatically expire after a short time (often hours), removing the risk of permanent credentials lingering across systems..
-   **_Complete audit trail_**: Every session is recorded and logged, capturing not only connection events but also the commands executed and the context of each access request.
-   **_Fine-grained permissions_**: Role-based access control (**_RBAC_**) defines exactly what users can access such as specific servers, commands, and time windows, rather than a simple all-or-nothing access model.
-   **_Just-in-time access_**: Users request access only when they need it, instead of holding permanent credentials, ensuring permissions match current responsibilities.

Teleport applies these **_zero-trust_** principles by acting as both a certificate authority and an access gateway between users and SSH servers.

Instead of connecting directly to servers, users first authenticate with **_Teleport_**, which verifies their identity using configured authentication providers.

**_Teleport_** then issues short-lived SSH certificates, proxies the connection, and records the entire session for auditing and compliance.

### Prerequisites

**Before starting, you'll need**:

-   Two **_Ubuntu 24.04 LTS_** servers with at least **_2GB RAM_** each.
-   **_Root_** or **_sudo_** access on both servers.
-   Basic [understanding of SSH](https://pro.tecmint.com/secure-ssh-setup-on-linux/) and [Linux system administration](https://pro.tecmint.com/ubuntu-advanced-system-administration/).
-   Servers should be able to communicate with each other over the network.

**For this tutorial**:

-   _**Server 1**_ (_teleport-cluster_): Will run the **_Teleport_** cluster (**_Auth_** and **_Proxy_** services).
-   _**Server 2**_ (_teleport-node_): Target **_SSH_** server that we'll secure with _**Teleport**._

## Installing Teleport on the Cluster Server

First, let's install **_Teleport on Server 1_**, which will act as our cluster.

### Step 1: Add Teleport Repository