Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale SSH

tailscale.com

Post reply on HN
Print view View original

241–250 of 311 posts

Re: Tailscale SSH

#241

Post by escape_goat »

parkerduckworth wrote: post #237
delano wrote: post #182

Earlier quoted context omitted.

That's one part of it. I can't speak for mike_d specifically, but there is a concern with having (potentially significant) modifications made to the codebase that aren't surfaced in the release notes. I imagine closed-source projects do this on a regular basis whether customers know (or care) or not. The expectations for opensource projects are different though, particularly when it comes to system-level or near syst…

I’d think that the literal ability to audit the source code would satiate one's desire to know about the changes being made in their environment.

Of course it doesn't. Only the actual auditing of the code could do that. Nobody in the world wants to audit code they are relying on every update to make sure that the developers have not added potential new security concerns that they would otherwise not be aware of.

Re: Tailscale SSH

#242

Post by lswank »

tptacek wrote: post #239
sp332 wrote: post #236

Earlier quoted context omitted.

dekhn, three comment levels above yours.

You're right. I guess my brain wouldn't let me process something as dumb as a corporate security control based on blocking a website to keep people from installing a binary. Anyways, I'm just here to say, corporate security teams are definitely not OK with you doing a rogue Tailscale install, and that's as it should be.

I work for a Fortune 100 company and this is precisely what our corporate overlords do with non-approved VPN software. There are device management tools on every machine in the corporation to detect and block the software, but that isn't turned on. Just blocking the website. ¯\_(ツ)_/¯

Re: Tailscale SSH

#243

Post by cperciva »

tptacek wrote: post #239
sp332 wrote: post #236

Earlier quoted context omitted.

dekhn, three comment levels above yours.

You're right. I guess my brain wouldn't let me process something as dumb as a corporate security control based on blocking a website to keep people from installing a binary. Anyways, I'm just here to say, corporate security teams are definitely not OK with you doing a rogue Tailscale install, and that's as it should be.

Anyways, I'm just here to say, corporate security teams are definitely not OK with you doing a rogue Tailscale install, and that's as it should be.

You might be shocked at how often I get "can you deploy a tarsnap server on port 443? My company's security team won't let me connect to your server on port 9279" requested.

I mean, it's trivial to bounce the TCP connection... but I'm not going to help subvert security policies.

Re: Tailscale SSH

#244

Post by tornato7 »

dbmnt wrote: post #238
CaptainJustin wrote: post #56

Earlier quoted context omitted.

> This lets people gradually use Tailscale SSH over time without messing with their system one. That is something I have really appreciated about Tailscale. It seems to consistently not mess with the existing environment. Considering it does networking witchcraft and it works on a variety of architectures and OSs this is quite an accomplishment. I suspect Tailscale's customers have found the same.

Not really. It messes with DNS big time. Try enabling the "MagicDNS" or "Exit Nodes" features, and watch as /etc/resolv.conf is edited with each change. I can easily reproduce scenarios where it's left empty and there's no working DNS resolution. This is one of the major things I _don't_ like about Tailscale. I wish they'd just stick to enabling Wireguard and making the authentication easier (i.e., where they started…

Consistently I’m unable to use Tailscale on a GCP instance and also use GCP services cleanly, because it messes with the DNS route to the metadata server. Otherwise, it’s a great product.

Re: Tailscale SSH

#245

Post by viraptor »

alex_dev wrote: post #184

I've been having trouble adopting Tailscale. As so many others say, relying on another identity provider is unfortunate - I, too, worry what happens when Google decides to lock me out because some algorithm decided my account is fishy. The biggest blocker has been the issues with the Android client. I'm either hitting https://github.com/tailscale/tailscale/issues/915 or https://github.com/tailscale/tailscale/issues/4…

Are you after the LE part specifically? If not, I'm quite happy with mdns and the seems to be a unicast version available too:

https://www.zerotier.com/2021/05/06/zeronsd-unicast-dns-reso...

For public domains, I've got a quick script which mirrors what appears in avahi to route53, so that's one way to deal with certs.

Re: Tailscale SSH

#246

Post by bradfitz »

dbmnt wrote: post #238
CaptainJustin wrote: post #56

Earlier quoted context omitted.

> This lets people gradually use Tailscale SSH over time without messing with their system one. That is something I have really appreciated about Tailscale. It seems to consistently not mess with the existing environment. Considering it does networking witchcraft and it works on a variety of architectures and OSs this is quite an accomplishment. I suspect Tailscale's customers have found the same.

Not really. It messes with DNS big time. Try enabling the "MagicDNS" or "Exit Nodes" features, and watch as /etc/resolv.conf is edited with each change. I can easily reproduce scenarios where it's left empty and there's no working DNS resolution. This is one of the major things I _don't_ like about Tailscale. I wish they'd just stick to enabling Wireguard and making the authentication easier (i.e., where they started…

It only messes with /etc/resolv.conf if you did `--accept-dns` and don't have systemd-resolved, which nowadays is much more common.

Linux DNS is a clusterfun: https://tailscale.com/blog/sisyphean-dns-client-linux/

But, yeah, without systemd-resolved Linux DNS is a fight for the death between uncooperating processes. NetworkManager is okay but there are a dozen buggy variants in the wild we have to work around.

Linux is by far the worst platform for DNS config.

I totally recommend systemd-resolved. It's the only thing that does DNS well on Linux.

Re: Tailscale SSH

#247

Post by bradfitz »

tornato7 wrote: post #244
dbmnt wrote: post #238

Earlier quoted context omitted.

Not really. It messes with DNS big time. Try enabling the "MagicDNS" or "Exit Nodes" features, and watch as /etc/resolv.conf is edited with each change. I can easily reproduce scenarios where it's left empty and there's no working DNS resolution. This is one of the major things I _don't_ like about Tailscale. I wish they'd just stick to enabling Wireguard and making the authentication easier (i.e., where they started…

Consistently I’m unable to use Tailscale on a GCP instance and also use GCP services cleanly, because it messes with the DNS route to the metadata server. Otherwise, it’s a great product.

Thanks for the feedback. I've filed https://github.com/tailscale/tailscale/issues/4911 to fix that.

Re: Tailscale SSH

#248

Post by bradfitz »

ignoramous wrote: post #232
bradfitz wrote: post #197

Earlier quoted context omitted.

I agree that'd be fun. We have something similar in the works for other protocols, but maybe SSH isn't a huge stretch to extend it to!

Does the current setup with magicsock mean that tailssh behaves similar to MoSH (in dealing with resuming a session, specifically)?

Yes.

But so does regular SSH over Tailscale, so Tailscale SSH isn't special in that regard.

Re: Tailscale SSH

#249

Post by viraptor »

fladrif wrote: post #186
ryanisnan wrote: post #59

Earlier quoted context omitted.

I'm curious, what's really clunky about SSM? Other than ensuring the pre-requisites are met, and knowing the instance-id, SSM works pretty flawlessly. You can easily write a wrapper that looks up the instance-id from the hostname, if you prefer to use it that way.

Haha I'm not sure if you were being serious, but the workflow you just outlined is the clunky part of SSM. The pre-requisites are getting all the IAM roles and permissions setup (no mean feat), installing the agent, configuring it with keys generated by another user, and getting the connection information back from the aws console. This promises to be a lot easier to setup and authenticate, install tailscale, login.

It really seems to depend on the point of view. If you're already using AWS seriously, your hosts will have the default agent anyway, IAM is already managed in a reasonable way (iamy, tf or similar), etc. so the setup is not that hard. I'm not sure what you mean by information from the AWS console - it's usable in the terminal.

Re: Tailscale SSH

#250

Post by bradfitz »

ignoramous wrote: post #240
bradfitz wrote: post #85

Earlier quoted context omitted.

If you're already running recent-ish Tailscale on them, they're already running an SSH server that's just disabled. Run "tailscale up --ssh" to turn it on. The code's at https://github.com/tailscale/tailscale/tree/main/ssh/tailssh for all the details. Which details in particular are you curious about?

> Which details in particular are you curious about? In the linked Q&A video with Maisem, you spoke about buying books on Linux to make SSH work. Which books, if you don't mind me asking?

The Linux Programming Interface: https://man7.org/tlpi/

Advanced Programming in the UNIX Environment, 3rd Edition: https://www.amazon.com/gp/product/0321637739

Post reply on HN