Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale SSH

tailscale.com

Post reply on HN
Print view View original

261–270 of 311 posts

Re: Tailscale SSH

#261

Post by jgeralnik »

soraminazuki wrote: post #214
jgeralnik wrote: post #152

Earlier quoted context omitted.

Double encryption doesn't actually help in that case though - if tailscale (maliciously) added nodes to your network the ssh session being encrypted wouldn't change the fact that they can run commands on your machines. And if they wanted to actively MITM you they could do so (by redirecting your wireguard connection to a server owned by them) even with encryption (presuming they can fake the host key, which they coul…

Double encryption should help as long as the Tailscale client installed on your own machines is safe. Without double encryption for SSH, Tailscale and your SSO provider can theoretically run commands on your machines without involving malicious client software. But that's not possible if you encrypt your SSH connection with your own keys. Also for Linux, the Tailscale client is fully open source and I obtain the bina…

But that's the thing - even with double encryption tailscale and your SSO can run commands on your machines

1) Run tailscale --ssh on your server 2) A malicious SSO or tailscale add a new machine to your network and update your ACL such that the new machine can connect to your server 3) ssh from the new machine to run code on your server

The fact that the connection between the malicious machine and your server is double encrypted doesn't affect the attack here at all

Re: Tailscale SSH

#262

Post by dx034 »

bradfitz wrote: post #197
structural wrote: post #181

Earlier quoted context omitted.

I've been using Tailscale for years but will likely not use this feature, even though I would like to. The fundamental problem with the approach really is that connections are different over the tailnet and over the local network. Here is a specific use case that is painful: 1. There exists a cluster of machines, each with large amounts of locally attached storage. They are all on the same local network and connected…

I agree that'd be fun. We have something similar in the works for other protocols, but maybe SSH isn't a huge stretch to extend it to!

Oh that sounds exciting, would it also solve the current performance issues when moving large amounts of data? It's currently the only reason I still have to use public IPs for some applications.

Re: Tailscale SSH

#263

Post by Corrado »

linsomniac wrote: post #189
bradfitz wrote: post #51

I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…

Hey bradfitz, guy who previously had 32150 here. :-) This looks insanely cool, a couple questions: I know it says it's linux-only right now, but is that client side or server only? Can my Windows users TailSSH into linux boxes? Would be cool if somehow it could wedge into sudo auth so you could login as a a user and sudo without password if allowed by ACLs, especally if I could add "check" to the ssh. agent pam modul…

Regarding pricing, in my experience the Tailscale crew have been very forgiving when it comes to user/device limits. I'm sure if you have 10 users and 100,000 devices you would get some attention, but keep it reasonable and you should be OK.

Re: Tailscale SSH

#264

Post by dx034 »

enneff wrote: post #164
titanomachy wrote: post #150

Earlier quoted context omitted.

Do you use the same Google/Github/Microsoft/whatever account for both work and personal stuff?

A lot of people do just use one account for everything. Many smaller companies don’t bother giving people corporate accounts.

That sounds extremely risky. Apart from the fact that it makes it much harder to restrict access for leaving employees, mixing personal and work identities sounds like a recipe for disaster. What happens if a personal account gets banned? How do you enforce security rules?

I guess companies where there's not even any identity management, securing your network via tailscale is not your primary concern.

Re: Tailscale SSH

#265

Post by samb1729 »

aspyct wrote: post #106

I started using tailscale a few days ago, and I absolutely love it. However, one thing is still nagging me: technically, they can add devices to my network without telling me, right? Or is there something I'm missing?

Are you asking whether the owners and operators of the Tailscale control plane can theoretically add devices to your network without your authorisation? If so then yes, definitely.

Perhaps a terrible analogy, but to me the question reads like "can the bank just spend my savings?"

How might you expect a fresh node to join your existing Tailnet without Tailscale having a means to add a node?

Re: Tailscale SSH

#266

Post by dx034 »

I love that feature but I'd be a bit scared to just switch off all other ssh, in case the tailscale service ever crashes. I know, machines can just be set up again, but if the problem reproduces there's no way to debug it.

So what's the recommendation here to stay safe but still have a failover? Keep ssh enabled for only one user (with sudo rights) and a key that's stored at some secure location?

Re: Tailscale SSH

#267

Post by dx034 »

samb1729 wrote: post #265
aspyct wrote: post #106

I started using tailscale a few days ago, and I absolutely love it. However, one thing is still nagging me: technically, they can add devices to my network without telling me, right? Or is there something I'm missing?

Are you asking whether the owners and operators of the Tailscale control plane can theoretically add devices to your network without your authorisation? If so then yes, definitely. Perhaps a terrible analogy, but to me the question reads like "can the bank just spend my savings?" How might you expect a fresh node to join your existing Tailnet without Tailscale having a means to add a node?

Most code is open source, I guess they could include a feature (not enabled by default) that sends a warning whenever it sees a previously unseen device on the network. Would be noisy and useless for most, but prevent tailscale from adding a new device secretly.

But then again, I'm not sure there are many people who'd worry about that.

Re: Tailscale SSH

#268

Post by dx034 »

mdeeks wrote: post #17
ratg13 wrote: post #2

Is anyone using tailscale on an organizational level? I'm curious to hear about some of the use cases, and whether some companies and organizations are attempting to adopt this instead of traditional VPN.

We just adopted it to consolidate multiple different OpenVPN installations. Why? * The Tailscale clients are dead simple and good quality (but not perfect). OpenVPN clients for mac and iOS are pretty bad. Onboarding OpenVPN users was a large document that generated a lot of questions and support issues. Tailscale onboarding is about two minutes for most users and we had nearly no support requests rolling it out widel…

The last point is a good one, I'm not sure how that makes tailscale usable for big orgs. Imagine a company with 10k+ people using it, I guess you'd need to build a lot of own tooling to avoid breaking the whole corporate network because of a mistake in setting an ACL.

Re: Tailscale SSH

#269

Post by dx034 »

soSadm4n wrote: post #9
ratg13 wrote: post #2

Is anyone using tailscale on an organizational level? I'm curious to hear about some of the use cases, and whether some companies and organizations are attempting to adopt this instead of traditional VPN.

One of my clients, an industrial/commercial property realtor (to contextualize the environment; we’re not talking military secrets here), uses it. Day to day I interact with it like any other VPN client except I auth via the Google workspace account they gave me. It’s Tailscale, or hosted OpenVPN and cross your fingers they’re not snooping, or DIY Wireguard or OpenVPN and all the usual ups and downs of DIY. Software…

> Real people directly in your infra is probably best avoided.

But I've yet to see a company where no one ever needs to ssh into a server. Using these ACLs to give a contractor access (and even visibility) to only the servers they're supposed to see is probably a big advantage over OpenVPN, where a contractor automatically becomes part of the inner network and can theoretically see all machines?

Re: Tailscale SSH

#270

Post by dx034 »

edf13 wrote: post #8

Never login as root… even over secured links!

I've always heard that and adhered to that, but what's the advantage of me logging in with a user account to then use sudo for every command? It's not like I could break less than being logged in as root.
Post reply on HN