Where does each teleport node store its private key and certificate?

[alwaysastudent]

Where does each teleport node store it's private key and certificate?

[alwaysastudent]

root     2388599  0.1  0.9 1499440 70400 ?       Ssl  Dec05   1:49 /usr/local/bin/teleport start --config=/var/lib/teleport/teleport.yaml --pid-file=/var/run/teleport.pid

# cat /var/lib/teleport/teleport.yaml

teleport:
  nodename: sshnodename

  data_dir: /var/lib/teleport

  # Invitation token used to join a cluster. it is not used on subsequent starts
  auth_token: c7792ab71f5dea9608cf6e10b8adc1b1
  ca_pin: "sha256:c6f2488f5e3ef5f5085b282cc29dc01229575d256c8b9ac0d385c8c7fbf35da4"

  auth_servers:
    - 10.231.12.236:3025

  connection_limits:
      max_connections: 1000
      max_users: 250

  log:
    output: /var/lib/teleport/teleport.log
    severity: ERROR
    format:
      output: text
      extra_fields: [level, timestamp, component, caller]

  storage:
    type: dir
    audit_events_uri: ['file:///var/lib/teleport/log']

auth_service:
  enabled: "no"


ssh_service:
  enabled: "yes"
  listen_addr: 0.0.0.0:3022
  labels:
    group: teleport_node
  commands:
  - name: hostname
    command: [hostname]
    period: 1m0s

proxy_service:
  enabled: "no"

# find /var/lib/teleport/ -type f

/var/lib/teleport/teleport.log
/var/lib/teleport/cache/node/sqlite.db
/var/lib/teleport/teleport.yaml
/var/lib/teleport/proc/sqlite.db
/var/lib/teleport/host_uuid

I can not find where the node stores the key pair and certificate, issued by the auth service, can you please help me understand this?

[klizhentas]

It's in local SQLite database sqlite3 /var/lib/teleport/proc/sqlite.db it's a key value storage and it should be in ids/name/current

[klizhentas]

@alwaysastudent we consider this state internal to the system, what's your use case? You also might want to change the join token as you published this one just in case

[alwaysastudent]

@klizhentas - Thank you for clarifying. We are evaluating teleport to govern access to our hosts, and I am just trying to understand the internals.

I have follow-up questions on how the "teleport-proxy" is able to establish an ssh session from the user's host machine to the teleport node? How does the ssh handshake look like in this situation?

user host -> teleport proxy -> teleport node

[SealinGp]

same issue here. It confused me when i try to add a Self-Hosted MySQL/MariaDB in step 2/4 link here

[stevenGravy]

Hi, typically you store this with your MySQL sensitive files. These files need to be accessed by the MySQL process not Teleport.

[SealinGp]

ok, got it