Tailscale SSH

I've been using Tailscale for years but will likely not use this feature, even though I would like to.

The fundamental problem with the approach really is that connections are different over the tailnet and over the local network. Here is a specific use case that is painful:

1. There exists a cluster of machines, each with large amounts of locally attached storage. They are all on the same local network and connected with 10Gb (and likely soon 40Gb ethernet interfaces).

2. Each machine is individually on the same tailnet so they can be accessed remotely.

3. Remote users frequently need to move large amounts of data between machines. A user copying a few hundred gigabytes of data with "scp" is normal.

4. For performance reasons, it's preferred to avoid the Tailscale/wireguard overhead when copying data between adjacent machines in a rack.

At this point, if I enable tailscale ssh for remote login, it appears that the problem of key management for connections between local machines (using ssh over the normal interface, not the tailnet) still remains, and in fact, the overall authentication configuration is more complex than it was before.

What I would love to exist, and would make me instantly use this feature, is if the tailnet issued SSH certificates (probably injected into its own ssh-agent?), the existing tailscale SSH implemention worked just like it currently does (it's great!), AND I could manually configure servers to accept certificates issued by the tailnet. Then SSH paths like "laptop --> (over tailnet) --> server 1 --> (over local network) --> server 2" could be made to work transparently, for those machines that need it, and for regular users, it still "just works".

This is spot on. One interesting approach I've seen before is that all commands executed as the superuser must be written in file, and the only command accessible via sudo is "please_save_to_audit_log_then_run_it_in_sandboxed_env ". For particularly high-risk situations, there might be a second person reading your script before running an approval command that actually lets the script run. Things don't move quickly, but the number of mistakes via typo is certainly reduced.

Thank you to the Tailscale team for altering my belief that VPN could only stand for Vexing Productivity Neutralizer.

Features like Tailscale SSH represent the ruthless removal of annoyances.

edit: grammar

Teleport developer here — sorry about that. We’re aware that initial setup is at times a pain point and are prioritizing improving this. If you can provide more details about what specifically went wrong for you I’m interested in getting to the bottom of it. Feel free to reply here or you can email me isaiah@goteleport.com

Hey bradfitz, guy who previously had 32150 here. :-) This looks insanely cool, a couple questions:

I know it says it's linux-only right now, but is that client side or server only? Can my Windows users TailSSH into linux boxes?

Would be cool if somehow it could wedge into sudo auth so you could login as a a user and sudo without password if allowed by ACLs, especally if I could add "check" to the ssh. agent pam module?

One thing that has prevented me from trying Tailscale, despite the great word on the street, is I can't figure out pricing, despite contacting sales. I'd like to run it on ~120 dev+stg+prod VMs, with 10 people (devs, testers, ops). I'd like every box to talk over tailscale directly, as an overlay network, but servers I hope aren't users, that'd get expensive fast. But I need more devices than 10/user. I presume "custom" would help with that but I got no reply from sales. We are probably too small fry. Now that I'm typing this, I realize I guess we could just buy ~15-20 users despite needing only 10.

I think I've resolved myself to setting up Nebula for the server overlay network, and using Tailscale for physical users, with a traditional firewall bridging them.

Again, Tailscale SSH looks very nice, job well done!