Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale SSH

tailscale.com

Post reply on HN
Print view View original

51–60 of 311 posts

Re: Tailscale SSH

#51

Post by bradfitz »

I'm one of the authors of this. Happy to answer any questions.

One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process.

So it doesn't matter whether you have other processes (or iptables rules, etc) that would prevent the Tailscale SSH server from binding to port 22. This lets people gradually use Tailscale SSH over time without messing with their system one.

The Tailscale SSH server currently only runs on Linux but there's support in git main for macOS too but it's not super well tested yet and not included in the sandboxed GUI builds currently.

Re: Tailscale SSH

#52

Post by Spooky23 »

riobard wrote: post #14

I'll have to ask this since it's bothering me for quite a while… If I connect to a server via WireGuard, would it make more sense to run simpler & unencrypted `rsh` instead of `ssh`? It's kinda pointless to double encrypt.

Not really. Who knows what you’re connecting to once you connect to the tailscale endpoint.

It’s more likely that you’re gonna screw up and end up doing something you don’t intend to do for very little gain. SSH overhead in 2022 is really low.

Re: Tailscale SSH

#53

Post by [deleted] »

ben174 wrote: post #41
riobard wrote: post #14

I'll have to ask this since it's bothering me for quite a while… If I connect to a server via WireGuard, would it make more sense to run simpler & unencrypted `rsh` instead of `ssh`? It's kinda pointless to double encrypt.

Double encryption is twice as effective. I use double ROT-13 for double the security.

[deleted]

Re: Tailscale SSH

#54

Post by pehtis »

bradfitz wrote: post #16
riobard wrote: post #14

I'll have to ask this since it's bothering me for quite a while… If I connect to a server via WireGuard, would it make more sense to run simpler & unencrypted `rsh` instead of `ssh`? It's kinda pointless to double encrypt.

Yeah, but e.g. no rsh (or telnet!) on macOS. It's likewise a bit silly that we had to add TLS support to Tailscale: https://tailscale.com/blog/tls-certs/ But we want to interoperate well with the clients people already have (browsers, their system ssh client, etc...)

You can still use telnet v1.9.4 on macOS. Just copy it from an old version of OSX (pre High Sierra). It still works fine on Monterey.

Re: Tailscale SSH

#55

Post by a-dub »

RL_Quine wrote: post #24
api wrote: post #5

Earlier quoted context omitted.

Totally meta to this discussion: I am disturbed by the SSO/IAM trend because it gives root on the entire universe to a small collection of companies. We are looking at a future where a security breach or misbehavior by one of a handful of companies could mass-compromise millions of businesses and critical infrastructure and possibly hundreds of millions to billions of devices. Even worse this permission is clandestin…

> I feel like people should at least understand what they are doing when they choose to delegate all their authentication to Google. I think this is my biggest concern, it's really scary to have Google Auth as literally the only barrier between no access and complete production access. I understand that a lot of the time Google accounts hold the literal keys to the kingdom anyway (customer data, internal company data…

it may also be a relic of my old age, but the idea that a browser cookie could be all you need for production root has terrified me in sso environments of past.

maybe i have an antiquated view of browser security but it seemed... unnerving.

Re: Tailscale SSH

#56

Post by CaptainJustin »

bradfitz wrote: post #51

I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…

> This lets people gradually use Tailscale SSH over time without messing with their system one.

That is something I have really appreciated about Tailscale. It seems to consistently not mess with the existing environment. Considering it does networking witchcraft and it works on a variety of architectures and OSs this is quite an accomplishment.

I suspect Tailscale's customers have found the same.

Re: Tailscale SSH

#57

Post by Brian_K_White »

runjake wrote: post #42
apenwarr wrote: post #35

Earlier quoted context omitted.

Alas, the real “telnet” protocol has considerably more fanciness than nc. It’s just that the telnet cli command degrades into a simple line-oriented mode if it doesn’t see the telnetd init sequence.

True, but it handles 99% of the use cases of the people who lament the demise of telnet in macOS. :-) For the rest: brew install telnet

macports please

Re: Tailscale SSH

#58

Post by soraminazuki »

riobard wrote: post #14

I'll have to ask this since it's bothering me for quite a while… If I connect to a server via WireGuard, would it make more sense to run simpler & unencrypted `rsh` instead of `ssh`? It's kinda pointless to double encrypt.

In this case, double encryption is a good idea though. Tailscale is a great way to reduce exposure of your infrastructure from the public internet, but it’s not without flaws. In theory, it should be possible for Tailscale and your SSO provider to add new nodes to your Tailnet. Though I don’t believe this is something that they’re actually willing to do, it’s definitely something to keep in mind if you’re planning on delegating SSH/sudo authentication to Tailscale.

Re: Tailscale SSH

#59

Post by ryanisnan »

Sytten wrote: post #10

This seems like the perfect complement to replace the SSM Agent / bastion instance currently used to access AWS VPC (it is super clunky to use). This should allow an easier time to do reverse tunnelling to databases without having to manage SSH keys.

I'm curious, what's really clunky about SSM?

Other than ensuring the pre-requisites are met, and knowing the instance-id, SSM works pretty flawlessly. You can easily write a wrapper that looks up the instance-id from the hostname, if you prefer to use it that way.

Re: Tailscale SSH

#60

Post by Helitico »

riobard wrote: post #14

I'll have to ask this since it's bothering me for quite a while… If I connect to a server via WireGuard, would it make more sense to run simpler & unencrypted `rsh` instead of `ssh`? It's kinda pointless to double encrypt.

Stay secure by default.

CPU overhead for encryption is basically non existend.

Post reply on HN