Unfortunately, the Teleport open-source version has been discontinued and the free version doesn't allow companies above 100 employees or with more than 10 million dollars of revenue per year. Fair enough, everyone should live well.
But Teleport Enterprise is very expensive and I have been priced out. I don't know if I can share the price behind the "contact sales" but if you wonder about the price, you probably are too poor. In my case, it's quite a few orders of magnitude more than the time Teleport saves me.
So, I have been looking for a replacement that is open-source and likely to stay open-source for a while. I can pay for it, but I don't have a "contact us" budget.
For HTTPS, I never used Teleport and will stay with oauth2-proxy. For SSH, I found warpgate and sshportal, which may work but it looks a bit experimental. For Kubernetes, it's a mess but perhaps kubelogin could do.
If you replaced Teleport, how did you do it?
You’d still need something to sign the certificates based on some other identity of course (it can be done manually but kind of defeats the purpose) be it smallstep or something else
I wish the step-ca documentation for OpenSSH certificates was a bit more centralised. I had to look at quite a few pages, blog posts, and shell scripts to understand what to do.
It supports to record each Session and save to various sources.
https://sourcegraph.com/search?q=context:global+repo:github....
https://github.com/juanfont/headscale/pull/847
I’m not sure how well does it support it though, and I can’t open the docs for some reason right now.
Since I was working in an environment where development teams tended to obtain root credentials from CI-CD pipelines and use them to change all the permissions on production servers or fill the storage with database dumps, I ditched teleport, ssh, and logins altogether! We followed the serverless model and there are no logins to any compute resource. The only way to bring data in is via unprivileged ci/cd pipelines or the application's API, the only way to get data out is via stderr or writing to a resource like S3. Nothing runs with privileges, there is no ssh, there are no admin-only access methods. Overnight that eliminated almost everything mysterious or unreproducible. No more permissions issues.
We monetize on a new layer - packet manipulation, like AI data masking. So you get enterprise PAM features without the enterprise price tag.
Might be worth a look as given the strategy these features should remain free. Could save you some serious cash. Repo's public if you wanna kick the tires: https://github.com/hoophq/hoop
https://github.com/jumpserver/jumpserver
Its an open-source PAM solution
We're not using it in-house (we're actually using teleport), and I haven't tried it, but I've heard many good things about it
(Announcement for those who haven’t seen it: https://goteleport.com/blog/teleport-community-license/)
Compiling and distributing binaries for all users and systems doesn't sound trivial. Only taking care of the teleport `tsh` client between windows, mac, and linux, for arm64 and amd64, sounds like a lot of boring work. Add that some users will likely download the forbidden tsh binary, that may call home and bring some unexpected bills, à la Oracle or Mirantis, it's not very appealing.
Companies may use Teleport Community Edition on the condition they have less than 100 employees and less than $10MM in annual revenue (AR).
Like op said in his post..
Not sure if AGPL covers all areas of the codebase?
Key features that are free/open source: 1. SSH, K8s, database access 2. RBAC and just-in-time access 3. Session recording 4. IdP integration
We monetize on advanced layer 7 features like AI data masking and firewall rules. But the core access management stuff stays free. Repo is public if you want to check it out:https://github.com/hoophq/hoop
Good luck finding a solution that fits your needs.