Lion Cipher Lab
Record and replay every SSH session with Teleport (a full session-recording access platform)
- Identity & Access Management
- Intermediate
- 60-75 minutes
- Free · no account required
Why it matters
You have already built the hand-rolled versions of this: a bastion is one hardened SSH front door, and sudo_logsrvd ships session recordings off-box so root cannot erase them. Each solves one slice. An access platform like Teleport is what those slices are reaching toward — it is the single control plane that gives you all of them at once, across many hosts, for every person on the team. Instead of long-lived SSH keys scattered across laptops (each one a standing liability that never expires and nobody remembers to revoke), Teleport hands out short-lived certificates that expire on their own.…
What you'll learn
- standing up Teleport, an identity-aware access platform, in Docker
- enrolling a host as an SSH node in a Teleport cluster
- connecting through the Teleport proxy with tsh ssh instead of raw ssh
- logging in for a short-lived certificate with tsh login (no static SSH keys)
- replaying a recorded terminal session with tsh play and in the Web UI
- reading a Teleport audit log of who connected and what they ran
- choosing a session-recording mode (node vs proxy, sync vs async) on purpose
- recognising that recording only covers access that passes through the proxy
- articulating why per-user certificates + RBAC beat shared static SSH keys
Steps in this lab
- What an 'access platform' is, and why it is the rung above a bastion
- Get Teleport onto a throwaway machine
- Write a tiny config and start the platform
- Create a named user — and see certificates replace keys
- Connect THROUGH the proxy with tsh ssh
- Replay it like a video — Web UI and tsh play
- Do it better: choose a recording mode, and design RBAC instead of trusting defaults
- Know the limit: recording only covers what goes through the proxy
- Tear it down, and take the instinct with you