Teleport vs shellz for SSH session recording

Teleport sits in front of your servers, Kubernetes clusters, databases, Windows desktops and internal web apps. People sign in once through your identity provider and get short-lived credentials instead of permanent SSH keys.

On top of that, Teleport can require access requests and periodic access reviews. On Enterprise, a second person can join a live session and end it, and you can require one before a sensitive session starts. It records Kubernetes, Windows desktop and database sessions too. shellz does none of this.

Because Teleport records at its gateway, anything that goes around it is unrecorded. Teleport's answer is to make the gateway the only way in: its setup guide tells each server to stop accepting direct logins. Finding and removing old SSH keys and side doors is left to you.

Even for sessions that do go through Teleport, its docs name three gaps:

• ›One-off remote commands such as tsh ssh host uptime are logged as an event with the command and exit code, but the output isn't recorded. A request to record them has been open since 2022.
• ›Users can hide what they run by encoding it or putting it in a script. Teleport's fix is its kernel-level recording mode, which needs Linux 5.8 or newer.
• ›Jobs started through systemd, cron or at can fall outside the recorded session, even in that mode.

Teleport's docs warn that root or sudo users can interfere with recording, for example by altering the Teleport process. They recommend locking the server down with SELinux or AppArmor and limiting who has root.

shellz assumes some users will have root. If root changes the recorder's settings, shellz undoes the change within seconds and reports it. A server that stops reporting raises an alert in about a minute. Uninstalling needs approval from the dashboard, and a login that starts outside the recorder is killed.

Root can still interfere with any software on its own machine. So each piece of a recording is signed and chained to the one before, and a missing or edited stretch shows up as a gap. The security model explains the encryption.

Teleport Enterprise doesn't list prices. Quotes are based on monthly active users and the number of servers, clusters, databases and desktops you protect. The Premium tier adds AI session summaries. Community Edition is free for individuals and for companies under 100 employees and $10 million in revenue. Rolling Teleport out means setting up the cluster, enrolling servers, and designing sign-in and roles.

shellz installs with one command per server and usually shows a live recording within two minutes. Ten active devices are free. Commercial is $10 per team member a month plus $1 per stored GB (plans).

Teleport controls who gets in. shellz records what happens on the server, including sessions that never touch Teleport: the emergency SSH key, a deploy script's remote command, a console login, or an AI agent with its own SSH key.

shellz has real limits. It records Linux terminals only. It can't block commands or end sessions, has no SIEM export, API or self-hosted version, and hasn't had its own SOC 2 audit yet. If you're comparing gateways, see the Boundary alternatives and the StrongDM alternatives.