A security audit is nice, but it doesn't provide ongoing protection.
> the bit listening on the network is also the bit running as root.
well, being root is a requirement to listen on privileged <1024 ports, in that sense teleport is no different from sshd or nginx. once the request is received and authenticated, it launches another process with the privileges of the authenticated user.
[1] https://github.com/gravitational/teleport/blob/master/lib/sr...
In fact, this is precisely the reason we paid for the independent audit, to proactively answer questions like this.
I am assuming you and hackcasual aren't familiar with Golang, since you aren't seeing familiar fork()/setuid()? I'll try to explain:
"dropping privileges" term comes from the old tradition of forking a child process from a privileged parent. Teleport, instead of calling fork() directly as you'd probably expect C code to work, uses Golang's syscall.StartProcess(), which does the entire fork-and-drop privileges logic, and the new privileges (user-specific ones) are passed as shown in the line of code above.
User SSH sessions are sandboxed in unprivileged processes just like you'd expect.
a lot of proper-distro-packaged apps (e.g. nginx on centos yum/ubuntu apt) spawn 'nobody' processes