41–50 of 311 posts
I'll have to ask this since it's bothering me for quite a while… If I connect to a server via WireGuard, would it make more sense to run simpler & unencrypted `rsh` instead of `ssh`? It's kinda pointless to double encrypt.
Earlier quoted context omitted.
FWIW for those reading (I figure Brad already knows): echo "alias telnet=nc -v" >> ~/.zshrc && source ~/.zshrc
Alas, the real “telnet” protocol has considerably more fanciness than nc. It’s just that the telnet cli command degrades into a simple line-oriented mode if it doesn’t see the telnetd init sequence.
For the rest: brew install telnet
What would be the advantages of this compared to say Teleport ? Teleport is working fine for us, but I wonder if the network based approach (+ wireguard) of Tailscale would be better in terms of network redundancy ?
Earlier quoted context omitted.
I edited the original to contain more detail as I posted it but it seems to have been lost somehow. The login flow for Tailscale is weird due to the need to accommodate things like a headless server being added, when combined with their use of SSO as the only method of authentication things get confused very easily. When I add a new server I get given a URL that looks like https://login.tailscale.com/a/c44a243b to vi…
SSO is not the only method of authenticating things. They have auth keys specifically for the purpose of authing headless servers. e.g. sudo tailscale up --authkey tskey-abcdef1432341818 You can also apply an ACL tag to it so that it is no longer authorized as the user and instead takes on the permissions of the tag. In our deployments we have the headless servers pull the tagged auth key from secrets manager on boot…
Earlier quoted context omitted.
This is correct. One answer is to have many, many SSO/IDP systems -- and for anyone technical enough to set up a homelab to be able to be their own IDP.
I'd love to know of well supported, secure IDP software to use for this. I'm afraid of OpenLDAP due to its long history of security issues. What are the open source alternatives that are both minimal in configuration and solid enough to be exposed to the internet if necessary?
It supports both SAML and OpenID Connect/OAuth2. With an LDAP backend you can also use that LDAP backend for other services that don't support those two protocols for SSO, but it is not required.
Earlier quoted context omitted.
Yeah, but e.g. no rsh (or telnet!) on macOS. It's likewise a bit silly that we had to add TLS support to Tailscale: https://tailscale.com/blog/tls-certs/ But we want to interoperate well with the clients people already have (browsers, their system ssh client, etc...)
From the blog post on TLS support: > However, if your service doesn’t have a valid TLS certificate, despite the fact that your connection is encrypted using Tailscale, your browser will warn you that the connection is not secure (it’s doing the right thing—it doesn’t know about Tailscale!). So, to avoid confusing your users, you might want to provision a TLS certificate to validate your internal services. Browser war…
Earlier quoted context omitted.
This is correct. One answer is to have many, many SSO/IDP systems -- and for anyone technical enough to set up a homelab to be able to be their own IDP.
I'd love to know of well supported, secure IDP software to use for this. I'm afraid of OpenLDAP due to its long history of security issues. What are the open source alternatives that are both minimal in configuration and solid enough to be exposed to the internet if necessary?
Keycloak offers a much more "roll your own" design.
Earlier quoted context omitted.
Yeah, but e.g. no rsh (or telnet!) on macOS. It's likewise a bit silly that we had to add TLS support to Tailscale: https://tailscale.com/blog/tls-certs/ But we want to interoperate well with the clients people already have (browsers, their system ssh client, etc...)
Is there an option to avoid double encryption on systems that do have e.g. rsh?
I'll have to ask this since it's bothering me for quite a while… If I connect to a server via WireGuard, would it make more sense to run simpler & unencrypted `rsh` instead of `ssh`? It's kinda pointless to double encrypt.
Unless you’re transferring large files the overhead of double encryption on ssh is totally blown away by waiting for human input.
IIRC There’s a fork of SSH that supports not encrypting things if you are trying to transfer large files.
Is anyone using tailscale on an organizational level? I'm curious to hear about some of the use cases, and whether some companies and organizations are attempting to adopt this instead of traditional VPN.
I would have loved this at a company a couple of years ago which was massively all in on Google Auth for literally everything. If you're fine with that being your concrete level of authentication for everything; internal tools, external tools, etc, then tailscale sort of just slots right in, and SSH makes it even more so. I would be very hesitant to build around this personally, hijacking Google accounts is already s…