91–100 of 311 posts
Tailscale is my absolute dream networking solution, I would go as far as to say it will ultimately change how we develop applications in the future
I'm very interested in Tailscale for both personal and business use-cases, but I'm rather put off by the stark centralization of offered identity providers: Microsoft, Github (Microsoft), Google, okta (?). What are the chances that Tailscale would offer authentication using decentralized/self-hosted identity providers like Ory ( https://www.ory.sh/ )?
Unfortunately they are locked behind Enterprise pricing because of the extra help and debugging needed to get them working. Maybe at some point this will be offered standard though.
Earlier quoted context omitted.
Could you share some details about the embedded SSH server? I'm curious if this would work to add SSH capabilities to devices that run Tailscale but don't include a built-in SSH server. Previously I've used dropbear, so it'd be really nice to be able to drop that requirement!
If you're already running recent-ish Tailscale on them, they're already running an SSH server that's just disabled. Run "tailscale up --ssh" to turn it on. The code's at https://github.com/tailscale/tailscale/tree/main/ssh/tailssh for all the details. Which details in particular are you curious about?
Is anyone using tailscale on an organizational level? I'm curious to hear about some of the use cases, and whether some companies and organizations are attempting to adopt this instead of traditional VPN.
We just adopted it to consolidate multiple different OpenVPN installations. Why? * The Tailscale clients are dead simple and good quality (but not perfect). OpenVPN clients for mac and iOS are pretty bad. Onboarding OpenVPN users was a large document that generated a lot of questions and support issues. Tailscale onboarding is about two minutes for most users and we had nearly no support requests rolling it out widel…
How would users not know to check their phone? They had to specifically set up this MFA method.
I'm not entirely convinced I want a feature that adds even more exposure to the sort of goofy login flow Tailscale has.
It's helpful for people to know, from context later in the thread, that one of the core concerns behind this comment is the idea of using SSO at all, and thus giving "the keys to the kingdom" to Google. Of course, it's also worth knowing that SSO is basically a universal best-practice for security teams, and while it's not de jure required by SOC2, it's almost de facto required. For once, I think the best-practices a…
For business users that isn't as much the case since there are good support options and it isn't likely you'll get locked out.
Great for businesses, potentially risky for individuals.
Earlier quoted context omitted.
It's helpful for people to know, from context later in the thread, that one of the core concerns behind this comment is the idea of using SSO at all, and thus giving "the keys to the kingdom" to Google. Of course, it's also worth knowing that SSO is basically a universal best-practice for security teams, and while it's not de jure required by SOC2, it's almost de facto required. For once, I think the best-practices a…
Probably the main concern around Google is for personal accounts where it sounds like people often find no way of recovering their accounts when Google thinks you did something bad. For business users that isn't as much the case since there are good support options and it isn't likely you'll get locked out. Great for businesses, potentially risky for individuals.
Earlier quoted context omitted.
> (...) the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. > So it doesn't matter whether you have other processes (or iptables rules, etc) that would prevent the Tailscale SSH server from binding to port 22. This sounds like a great feature when explo…
How do you figure? The idea is that Tailscale is bypassing the kernel, which it can only do for requests coming in over the tailnet --- it gets those packets raw, directly from WireGuard, unlike the normal IP packets your kernel routes to/from localhost or an egress interface.
Earlier quoted context omitted.
How do you figure? The idea is that Tailscale is bypassing the kernel, which it can only do for requests coming in over the tailnet --- it gets those packets raw, directly from WireGuard, unlike the normal IP packets your kernel routes to/from localhost or an egress interface.
It's not the same, but "Docker Network bypasses Firewall, no option to disable" https://github.com/moby/moby/issues/22054 (2016)
you're essentially using google as your machine login, which seems like weaker security, imo.
edit: I'll caveat this and say, I think Tailscale is fantastic! I've been using it personally on my machines for a few months now, and it is awesome.
Good! Boundary ( https://www.boundaryproject.io/ ) by Hashicorp needs some healthy competition. Teleport is also a tool in this space, for those looking for alternatives.
And for anyone looking at Tailscale, I should also mention ZeroTier ( https://www.zerotier.com/ ). In my opinion they have better tech, but they are pretty bad at packaging it, and bad at making it work for actual use-cases. Tailscale seems to be much more clever around building out stuff (like this one, SSH) that actually goes all the way for a particular use-case. ZeroTier feels more like a building block, where yo…