Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale SSH

tailscale.com

Post reply on HN
Print view View original

191–200 of 311 posts

Re: Tailscale SSH

#191

Post by dekhn »

mike_d wrote: post #163
bradfitz wrote: post #51

I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…

How was the decision made to roll this functionality out before announcing it to customers (we found it during a previous security audit)? While it might seem logical in your mind to bolt on extra features and add value, your customers evaluate risk based on functionality of the software they are approving. Customer buys a VPN solution, magically gets remote access that bypasses firewalls. Can we trust Tailscale to n…

Ohhh, this explains why my corporation placed a total firewall block on the Tailscale website.

This is a postmortem-worthy incident on Tailscale's part.

Re: Tailscale SSH

#192

Post by lupire »

soSadm4n wrote: post #9
ratg13 wrote: post #2

Is anyone using tailscale on an organizational level? I'm curious to hear about some of the use cases, and whether some companies and organizations are attempting to adopt this instead of traditional VPN.

One of my clients, an industrial/commercial property realtor (to contextualize the environment; we’re not talking military secrets here), uses it. Day to day I interact with it like any other VPN client except I auth via the Google workspace account they gave me. It’s Tailscale, or hosted OpenVPN and cross your fingers they’re not snooping, or DIY Wireguard or OpenVPN and all the usual ups and downs of DIY. Software…

> or DIY Wireguard or OpenVPN

What is I that YD?

Re: Tailscale SSH

#193

Post by dekhn »

tptacek wrote: post #142
password4321 wrote: post #105

Earlier quoted context omitted.

All I'm trying to point out is that advertising "this bypasses the firewall, by design" has been abused in the past. [edit] It boils down to principle of least surprise, managing expectations, etc. - proper documentation is indeed key.

You have to explicitly enable Tailscale SSH, both on the host and in the ACLs that allow users to use the feature. Tailscale's ACLs are much, much better than iptable rules (for instance: they have built-in unit testing). (I'm not impartial about Tailscale.)

> Tailscale's ACLs are much, much better than iptable rules (for instance: they > have built-in unit testing).

Humility helps a lot on the internet- the important thing about iptables is that it runs on millions, possibly billions of machines. Production systems that don't have unit tests but run at scale aren't worse than systems which are newly introduced but have fairly unknown implications.

Re: Tailscale SSH

#194

Post by raggi »

bhawks wrote: post #173
bradfitz wrote: post #51

I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…

Any interest in adding mosh like features ( https://mosh.org/ )? Low latency typing, session resumption etc

Tailscalar here, it should just work using the normal ssh bootstrapped method.

Re: Tailscale SSH

#195

Post by bradfitz »

linsomniac wrote: post #189
bradfitz wrote: post #51

I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…

Hey bradfitz, guy who previously had 32150 here. :-) This looks insanely cool, a couple questions: I know it says it's linux-only right now, but is that client side or server only? Can my Windows users TailSSH into linux boxes? Would be cool if somehow it could wedge into sudo auth so you could login as a a user and sudo without password if allowed by ACLs, especally if I could add "check" to the ssh. agent pam modul…

> I know it says it's linux-only right now, but is that client side or server only? Can my Windows users TailSSH into linux boxes?

Linux-only on the server right. macOS support is kinda there (in git) but not entirely done and not included in the GUI builds. Windows server support is tracked in https://github.com/tailscale/tailscale/issues/4697.

You can use any SSH client from any OS.

> Would be cool if somehow it could wedge into sudo auth so you could login as a a user and sudo without password if allowed by ACLs

Some of the start of that is in https://github.com/tailscale/pam

> One thing that has prevented me from trying Tailscale, despite the great word on the street, is I can't figure out pricing, despite contacting sales. I'd like to run it on ~120 dev+stg+prod VMs, with 10 people (devs, testers, ops). I'd like every box to talk over tailscale directly, as an overlay network, but servers I hope aren't users, that'd get expensive fast. But I need more devices than 10/user. I presume "custom" would help with that but I got no reply from sales. We are probably too small fry. Now that I'm typing this, I realize I guess we could just buy ~15-20 users despite needing only 10.

You only pay for unique humans, not tagged role account devices. I wonder if your email got eaten as spam or something. Email me (username at tailscale) and copy sales@ and I'll make sure somebody replies. But I don't think you need a custom plan.

> I think I've resolved myself to setting up Nebula for the server overlay network, and using Tailscale for physical users, with a traditional firewall bridging them.

Hey, if you've got something that works, stick with it. :)

Re: Tailscale SSH

#196

Post by e12e »

tptacek wrote: post #155
e12e wrote: post #148

Earlier quoted context omitted.

> [only for..] requests coming in over the tailnet Well, that's certainly different from "all TCP port 22 packets" - I suppose some emphasis should be on "after the WireGuard decryption" (ie: over the wireguard interface). It's not entirely clear from the comment (but probably clear to engineers working on the tailscale code). I read it as if tailscale snapped up packets before the kernel from (all) network interface…

How could it possibly work otherwise? Tailscale owns the WireGuard connection, so it gets raw packets from WireGuard before the kernel .

It could work like a full userspace network stack, getting the packets on the wire before (instead of) the kernel (network stack)?

Re: Tailscale SSH

#197

Post by bradfitz »

structural wrote: post #181
bradfitz wrote: post #51

I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…

I've been using Tailscale for years but will likely not use this feature, even though I would like to. The fundamental problem with the approach really is that connections are different over the tailnet and over the local network. Here is a specific use case that is painful: 1. There exists a cluster of machines, each with large amounts of locally attached storage. They are all on the same local network and connected…

I agree that'd be fun. We have something similar in the works for other protocols, but maybe SSH isn't a huge stretch to extend it to!

Re: Tailscale SSH

#198

Post by bradfitz »

Syzygies wrote: post #167
bradfitz wrote: post #51

I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…

I have Tailscale on all my Macs. I use MacOS default SSH between my machines, but only via the Tailscale interface. Nevertheless, I had to open SSH on each machine, and it's a nightmare to close up the firewall so only Tailscale gets through. You'd think this was the whole point of Tailscale; there should be a one click lock to restrict to Tailscale. But the Tailscale documentation is wanting. I actually paid for a c…

> Tailscale SSH should do the same.

It does. You can "turn the fucker off" (as you say) at the OS level and Tailscale SSH will still work. We don't send the Tailscale SSH packets through the OS for it to block them.

Well, Tailscale SSH server support for macOS is still not entirely done. You can build it from source if you're brave (and set an env var to turn it on), but it's not in the product yet by default.

Re: Tailscale SSH

#199

Post by ngcc_hk »

CaptainJustin wrote: post #56
bradfitz wrote: post #51

I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…

> This lets people gradually use Tailscale SSH over time without messing with their system one. That is something I have really appreciated about Tailscale. It seems to consistently not mess with the existing environment. Considering it does networking witchcraft and it works on a variety of architectures and OSs this is quite an accomplishment. I suspect Tailscale's customers have found the same.

That is not a feature it is a bug and a big hole.

The firewall is the system. Just like apple bypass its own firewall and just send packet back home. Or the chinese way.

Of course as said by one of the author the key is to control port 22 or rule for ssh. That is not a totally lost. Still, one that is ok … you are breaking the system by promoting a way to bypass it. Or just 1 rule. It is so hard to remember.

Re: Tailscale SSH

#200

Post by jlouis »

dekhn wrote: post #191
mike_d wrote: post #163

Earlier quoted context omitted.

How was the decision made to roll this functionality out before announcing it to customers (we found it during a previous security audit)? While it might seem logical in your mind to bolt on extra features and add value, your customers evaluate risk based on functionality of the software they are approving. Customer buys a VPN solution, magically gets remote access that bypasses firewalls. Can we trust Tailscale to n…

Ohhh, this explains why my corporation placed a total firewall block on the Tailscale website. This is a postmortem-worthy incident on Tailscale's part.

It's likely just because it's a VPN not under control of the corporation. Corporations have this magical wand which they swing to make it hard for people to do their work :)
Post reply on HN