Keeper Connection Manager vs Teleport: Feature Comparison

Keeper Connection Manager is the best Teleport alternative because it’s easy to deploy on any
device, unlike Teleport which has an extremely complex deployment model.
Teleport
Robust platform vs Stand-alone tool
Keeper Security offers powerful connection management andPrivileged Access Management (PAM) functionalities tothousands of enterprises and millions of users. These
capabilities are seamlessly integrated into a highly secure
enterprise password management and secrets management
platform.
Keeper Connection Manager, a remote access gateway, is fully
integrated into the Keeper ecosystem, which protects
organizations from password-related data breaches andcyberthreats..
cyberthreats

Teleport is a stand-alone connection tool for software
engineers that provides access to infrastructure through theuse of short-lived certificates.

Installation
Keeper Connection Manager is 100% agentless and clientless.
No configuration or 3rd party services need to be installed on
the target instances, and there is no risk of breach from thirdparty agents. Keeper Connection Manager only requires asimple Docker container to be installed in the target
environment.
EKeeper Connection Manager is both zero-knowledge andzero-trustst.. Keeper cannot access the infrastructure that is
managed by the customer. When coupled with Keeper Secrets
Manager for credential storage, Keeper provides zeroknowledge encryption of service account passwords and otheraccess credentials.

Teleport requires installation of agent software on every
endpoint that will be accessed. In addition, it requires theinstallation of an Auth Server and a proxy server. Dependingon what the users are accessing, organizations may also needto install clients like “tsh.”

ncryption
Teleport Cloud is hosted by Gravitational and routes allconnections through a centralized proxy. Unauthorized accessto the Auth Server grants certificates that can log in to any
managed host. Depending on the use case, the TLS session
may be decrypted on the server.

Deployment model

Keeper Connection Manager is easy to deploy on any device
using a lightweight Docker container.

Teleport's deployment model is extremely complex andrequires an agent, a central proxy and a central Auth Server.
Additionally, per Teleport’s own documentation, the solution
utilizes features that are not considered "production-ready."
Teleport software must be deployed on every instance.

Support for native RDP and SSH protocols
Keeper Connection Manager uses standard RDP connections
that do not require an admin to reconfigure the organization’s
entire data environment. The credentials used to access thedestination server are managed by the admin and are never
exposed to the end user. Session recordings are available forauditing purposes.

Teleport requires access to the domain controller for RDP
access, a Linux instance, GPO changes, approval of a Teleport
CA, and implementation of Smart Card APIs. This method ofdesktop access is extremely complex and works outside of thenorm for the typical enterprise setup. Additionally, Teleport’s
RDP sessions cannot be recorded for auditing purposes.

Security model
The Keeper Connection Manager gateway can be completely
locked down to the customer's infrastructure to limit accessbetween the client device and target server. Secrets that areused to connect to target servers can be managed within theKeeper Secrets Manager encrypted vault. Pass-throughcredentials also provide dynamic access to target instances
for any user without storage of secrets anywhere in thegateway.

Teleport Auth Server issues short-lived credentials and is asingle point of compromise. Compromise of the Teleport AuthServer would permit access to any node running the Teleportagent. This system also hosts a User CA -- this is a long-lived
key, and exfiltration of this signing key permits an attacker tomint their own credentials to any Teleport-managed host. The
Teleport architecture provides a much larger attack surface.

Monitoring, auditing and reporting options
Keeper offers extensive reporting on privileged user behavior.
In addition to providing aggregate security audits, Keeper also
provides event logging for over 140 event types, event-basedalerts and integration with popular third-party SIEM solutions.
Keeper’s compliance reporting functionality also allows
admins to monitor and report access permissions of privileged
accounts across the entire organization, in a zero-trust andzero-knowledge security environment.
O

Teleport has limited reporting and monitoring tools. It offers
no password event data logging or robust compliancereporting functionality.

rganization and sharing capabilities

n Keeper Connection Manager's model, end users have noaccess to the underlying credentials used to broker theconnection. Keeper allows users to access systems the way
they currently use them, with service accounts, local accounts,
admin credentials or pass-through dynamic credentials.
I

Teleport requires the use of certificate-based authentication
for desktop access, which involves modifying the way teams
currently connect to targets and making configuration
changes on the organization’s domain controllers.

Secrets management
Keeper Secrets Manager is a fully managed, cloud-based,zero-knowledge platform for securing infrastructure secrets
such as API keys, database passwords, access keys,
certificates and any type of confidential data – integrated
directly into Keeper.

Teleport does not offer secrets management or encryption ofdigital assets.