hackcasual: teleport starts its own unprivileged copy for scp requests. for other exec requests, including interactive shell, it launches those processes directly, dropping privileges as well. [1]

> the bit listening on the network is also the bit running as root.

well, being root is a requirement to listen on privileged <1024 ports, in that sense teleport is no different from sshd or nginx. once the request is received and authenticated, it launches another process with the privileges of the authenticated user.

[1] https://github.com/gravitational/teleport/blob/master/lib/sr...

In fact, this is precisely the reason we paid for the independent audit, to proactively answer questions like this.