That is too bad, Teleport is how I learned a lot of the crypto APIs in Golang. It also provided me with a glimpse into part of openssh which was never very well thought out - signed keys.
Since I was working in an environment where development teams tended to obtain root credentials from CI-CD pipelines and use them to change all the permissions on production servers or fill the storage with database dumps, I ditched teleport, ssh, and logins altogether! We followed the serverless model and there are no logins to any compute resource. The only way to bring data in is via unprivileged ci/cd pipelines or the application's API, the only way to get data out is via stderr or writing to a resource like S3. Nothing runs with privileges, there is no ssh, there are no admin-only access methods. Overnight that eliminated almost everything mysterious or unreproducible. No more permissions issues.
Purely for the SSH part if you’re uncomfortable using anything outside of OpenSSH itself for authentication you could consider certificates[^1]
You’d still need something to sign the certificates based on some other identity of course (it can be done manually but kind of defeats the purpose) be it smallstep or something else
I have also been priced out. Exact same situation you're in. We're crossing our fingers that something good comes quickly from Cloudflare's purchase of BastionZero. Otherwise, I've heard good things about StrongDM but don't know pricing and don't have first hand experience.
That is too bad, Teleport is how I learned a lot of the crypto APIs in Golang. It also provided me with a glimpse into part of openssh which was never very well thought out - signed keys.
Since I was working in an environment where development teams tended to obtain root credentials from CI-CD pipelines and use them to change all the permissions on production servers or fill the storage with database dumps, I ditched teleport, ssh, and logins altogether! We followed the serverless model and there are no logins to any compute resource. The only way to bring data in is via unprivileged ci/cd pipelines or the application's API, the only way to get data out is via stderr or writing to a resource like S3. Nothing runs with privileges, there is no ssh, there are no admin-only access methods. Overnight that eliminated almost everything mysterious or unreproducible. No more permissions issues.
Purely for the SSH part if you’re uncomfortable using anything outside of OpenSSH itself for authentication you could consider certificates[^1]
You’d still need something to sign the certificates based on some other identity of course (it can be done manually but kind of defeats the purpose) be it smallstep or something else
[^1]: https://smallstep.com/blog/use-ssh-certificates/
If you need only SSH, you can try ContainerSSH[1] - it's pretty simple to setup & integrate using OPA for authorization.
It supports to record each Session and save to various sources.
[1]: https://github.com/ContainerSSH/ContainerSSH
Do you only need authentication? Give Tailscale SSH a look.
I have also been priced out. Exact same situation you're in. We're crossing our fingers that something good comes quickly from Cloudflare's purchase of BastionZero. Otherwise, I've heard good things about StrongDM but don't know pricing and don't have first hand experience.