Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale SSH

tailscale.com

Post reply on HN
Print view View original

111–120 of 311 posts

Re: Tailscale SSH

#111

Post by soSadm4n »

freeplay wrote: post #103
soSadm4n wrote: post #9

Earlier quoted context omitted.

One of my clients, an industrial/commercial property realtor (to contextualize the environment; we’re not talking military secrets here), uses it. Day to day I interact with it like any other VPN client except I auth via the Google workspace account they gave me. It’s Tailscale, or hosted OpenVPN and cross your fingers they’re not snooping, or DIY Wireguard or OpenVPN and all the usual ups and downs of DIY. Software…

> It’s Tailscale, or hosted OpenVPN and cross your fingers they’re not snooping... The "cross your fingers they're not snooping" applies to Tailscale as well.

That’s what I meant.

Re: Tailscale SSH

#112

Post by leohonexus »

newfonewhodis wrote: post #61

What happens if I use Tailscale SSH and Google (or whatever IDP) decides to ban my account? Is there a break-glass or something that would let me either change IDPs or re-enable openssh-based access without losing my servers?

Totally, I’m a happy customer, but completely relying on Tailscale for out-of-band SSH doesn’t sit right with me, especially for personal machines. One ban and poof, you can’t access your own servers.

And to be honest, I understand the appeal of not having to muck around with the system, but SSH isn’t that cumbersome once you’ve set up your /etc/hosts, and encrypt your id_rsa files. Couldn’t get any easier than `ssh `.

Re: Tailscale SSH

#114

Post by alexk »

outworlder wrote: post #90
tptacek wrote: post #68

Earlier quoted context omitted.

The big thing you get with Teleport that you don't yet get with Tailscale --- apart from entirely owning the source of truth for SSH authentication on your own infra, which is a very minor issue for almost everyone but is a major issue for some people --- is that Teleport gives you transcript-level audit logs of your SSH sessions. Teleport also has that web-based SSH console (it's one of the better web-based consoles…

> is that Teleport gives you transcript-level audit logs of your SSH sessions That is extremely valuable. Just in case 'transcript-level audit' didn't sink in, it's a session recording – not only you can see the all keystrokes typed but you can see all the outputs, the whole state. Someone doing a TOP command for an hour? You can watch the same thing later. Think asciinema ( https://asciinema.org/ ).

Sasha, CTO@ Teleport here. Thank you for the kind words! And congrats to the Tailscale team on launching SSH product.

Let me share a bit more about our auditing capabilities:

Teleport captures session PTY output and stores it in S3 or any S3 compatible storage for your records by default.

If you would like to get additional, more in-depth insight into the session, Teleport captures syscalls, file access calls and network calls done during SSH session by correlating it with sessions' cgroup using our BPF module:

https://goteleport.com/docs/server-access/guides/bpf-session...

Teleport provides a lot of other in-depth SSH integration for auditing and compliance, for example we support moderated sessions access control with a required session moderator, or per session-MFA.

Re: Tailscale SSH

#115

Post by dimitar »

maisem wrote: post #107
dimitar wrote: post #104

Earlier quoted context omitted.

Can you do ssh tunnelling?

You can do local port forwarding today, remote port forward is still a WIP. What do you want to use it for? Disclaimer: I am one of the engineers who built Tailscale SSH.

Accessing Clojure nREPL servers, local port forwarding works for that. This allows me to inspect and modify running applications, a Lisp superpower.

Re: Tailscale SSH

#116

Post by atonse »

bradfitz wrote: post #51

I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…

What would we need to have open in our security groups for this to work?

I think ingress wouldn't be necessary since tailscaled creates a tunnel right?

But how about egress traffic? UDP for WireGuard or something else?

Re: Tailscale SSH

#117

Post by sandstrom »

doublepg23 wrote: post #101
infogulch wrote: post #89

I'm very interested in Tailscale for both personal and business use-cases, but I'm rather put off by the stark centralization of offered identity providers: Microsoft, Github (Microsoft), Google, okta (?). What are the chances that Tailscale would offer authentication using decentralized/self-hosted identity providers like Ory ( https://www.ory.sh/ )?

There is also the self-hostable Headscale implementation.

In case anyone is looking for the URL: https://github.com/juanfont/headscale

5k stars on Github, and lots of activity. Seems very interesting!

Re: Tailscale SSH

#118

Post by jasonlotito »

If I have to use a browser to make use of this (which the demo shows), I never want to use it. It's like the abomination of Okta and Luminate. Absolutely horrible UX.

Nope. Will fight very hard to avoid ever having to use this.

Antagonistic toward developers at best.

Re: Tailscale SSH

#119

Post by stavrianos »

api wrote: post #5
RL_Quine wrote: post #3

I'm not entirely convinced I want a feature that adds even more exposure to the sort of goofy login flow Tailscale has.

Totally meta to this discussion: I am disturbed by the SSO/IAM trend because it gives root on the entire universe to a small collection of companies. We are looking at a future where a security breach or misbehavior by one of a handful of companies could mass-compromise millions of businesses and critical infrastructure and possibly hundreds of millions to billions of devices. Even worse this permission is clandestin…

I've seen this conversation before, but I've never been clear on what exactly the consequences of the SSO are. I imagined, it might be that the provider gets an IP address when you connect or something. You're saying they potentially get _access as you_? Am I understanding that correctly?
Post reply on HN