TELEPORT_ENABLE_RDP_NLA environment variable

[jvirot]

Hello.
I need to ENABLE NLA on my teleport (community edition self hosted V16).
i see to enable NLA i need to set the TELEPORT_ENABLE_RDP_NLA environment variable to yes

But i don't know how to to this and i don't find information in the online doc.
So someone can help me?

I try this :
sysadmin@stg-vs-bastion-t0:~$ tsh env export TELEPORT_PROXY=stg-vs-bastion-t0.my.group:443 export TELEPORT_CLUSTER=stg-vs-bastion-t0.my.group sysadmin@stg-vs-bastion-t0:~$ export TELEPORT_ENABLE_RDP_NLA=yes sysadmin@stg-vs-bastion-t0:~$ tsh env export TELEPORT_PROXY=stg-vs-bastion-t0.my.group:443 export TELEPORT_CLUSTER=stg-vs-bastion-t0.my.group sysadmin@stg-vs-bastion-t0:~$ TELEPORT_ENABLE_RDP_NLA=yes sysadmin@stg-vs-bastion-t0:~$ tsh env export TELEPORT_PROXY=stg-vs-bastion-t0.my.group:443 export TELEPORT_CLUSTER=stg-vs-bastion-t0.my.group sysadmin@stg-vs-bastion-t0:~$ set TELEPORT_ENABLE_RDP_NLA=yes sysadmin@stg-vs-bastion-t0:~$ tsh env export TELEPORT_PROXY=stg-vs-bastion-t0.my.group:443 export TELEPORT_CLUSTER=stg-vs-bastion-t0.my.group
but each time the rdp connect have nla false.

i don't know how to define the environnement variable and stay to yes after reboot and for all users?

my log when i try to RDP connect on a server with NLA activated
{ "addr.local": "10.10.x.x", "addr.remote": "10.10.x.x:3389", "allow_user_creation": false, "cluster_name": "stg-vs-bastion-t0.my.group", "code": "TDP00I", "desktop_addr": "10.10.x.x:3389", "desktop_labels": { "teleport.dev/computer_name": "STG-VS-ADMT01", "teleport.dev/dns_host_name": "STG-VS-ADMT01.my.group", "teleport.dev/origin": "dynamic", "teleport.dev/os": "Windows Server 2016 Datacenter Evaluation", "teleport.dev/os_version": "10.0 (14393)", "teleport.dev/ou": "OU=Servers,OU=Harden_T0,DC=my,DC=group", "teleport.dev/windows_domain": "my.group" }, "desktop_name": "STG-VS-ADMT01-my-group-fa820187", "ei": 1, "event": "windows.desktop.session.start", "login": "Administrator", "nla": false, "private_key_policy": "none", "proto": "tdp", "sid": "995ca0c0-0b3c-4429-9771-2626252625", "success": true, "time": "2025-02-12T18:17:48.77Z", "uid": "db2d2ab9-0cda-4814-9f70-626252656", "user": "95623989", "user_kind": 1, "windows_desktop_service": "7dd57a48-9f09-46ff-9ba3-ae4be5f3b7c4", "windows_domain": "my.group", "windows_user": "Administrator" }

[zmb3]

The process for setting an environment variable varies widely depending on the environment in which you are running Teleport.

If you're running Teleport in Kubernetes, you'll need to edit the pod configuration.

If you're running Teleport as a systemd service, then you'll want to use systemctl edit as described here.

If you're running Teleport via some other method, let us know what that is and we'll try to provide some more detailed guidance.

[jvirot]

Hi ZAC.
Thanks for reply.
My teleport server is install under a debian 12 with systemctl.
I ran téléport with systemctl start téléport.
I will truy with the link, but i'm not really sure about the process exact

[jvirot]

OK i try:

sudo systemctl edit teleport

i have :
`

Editing /etc/systemd/system/teleport.service.d/override.conf

Anything between here and the comment below will become the new contents of the file

Editing /etc/systemd/system/teleport.service.d/override.conf

Anything between here and the comment below will become the new contents of the file

/lib/systemd/system/teleport.service

[Unit]
Description=Teleport Service
After=network.target

[Service]
Type=simple
Restart=always
RestartSec=5
EnvironmentFile=/etc/default/teleport.conf
ExecStart=/usr/local/bin/teleport start --config /etc/teleport.yaml --pid-file=/run/teleport.pid

# systemd before 239 needs an absolute path

ExecReload=/bin/sh -c "exec pkill -HUP -L -F /run/teleport.pid"
PIDFile=/run/teleport.pid
LimitNOFILE=524288

[Install]
WantedBy=multi-user.target

and in my /etc/default/teleport.conf

only this:
TELEPORT_ENABLE_RDP_NLA=yes
after sudo systemctl daemon-reload

i try to restart teleport but :
Failed to restart teleport.service: Unit teleport.service has a bad unit file setting. See system logs and 'systemctl status teleport.service' for details.
> ○ teleport.service - Teleport Service Loaded: bad-setting (Reason: Unit teleport.service has a bad unit file setting.) Drop-In: /etc/systemd/system/teleport.service.d └─override.conf Active: inactive (dead) since Thu 2025-02-13 00:09:49 CET; 13min ago Duration: 5h 59min 30.234s Main PID: 11506 (code=exited, status=0/SUCCESS) CPU: 42.019s

[jvirot]

Ok i try methode without EnvironnementFile=.... juste a teleport_env.conf and it's work...
Thanks Zac

"ei": 1, "event": "windows.desktop.session.start", "login": "Administrator", "nla": true, "private_key_policy": "none", "proto": "tdp", "sid": "b17dd509-72dd-4a37-a967-74ba7e32352c",