Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale SSH is now Generally Available

tailscale.com

Post reply on HN
Print view View original

51–60 of 98 posts

Re: Tailscale SSH is now Generally Available

#51

Post by wenyuanyu »

stavros wrote: post #22
wenyuanyu wrote: post #10

How does it compare with cloudflare's tunnels? [0] I have been using Cloudflare's cloudflared tunnels. It was great for tunneling ssh traffic behind firewalls. And it starts free. [0] https://developers.cloudflare.com/cloudflare-one/connections...

It's very different, CF tunnel is a reverse proxy to your service, Tailscale SSH manages authentication to machines inside your VPN. I can't see any resemblance, personally.

First of all, for CF, it manages the authentication part of ssh with SSO support (personally I used github)

Secondly, it has clients (on iOS it is called Cloudflare One) which can act as a VPN service as well. You can access any IP addresses (if you setup the vpc correctly [0]) directly accessible to cloudflared daemons.

[0] https://developers.cloudflare.com/cloudflare-one/connections...

Re: Tailscale SSH is now Generally Available

#53

Post by mikeocool »

I love Tailscale, it’s by far the best VPN I’ve used, and the easiest wireguard implementation to get up and running I’ve used.

I can certainly see the value of this feature for some orgs, but it seems little scary to me. With this setup, if an attacker is able to compromise Tailscale and add a key to your tailnet, that person will immediately have access to your network AND shell access to all of your boxes, rather than just network access if you use Tailscale with vanilla ssh.

Re: Tailscale SSH is now Generally Available

#54

Post by nine_k »

zikduruqe wrote: post #48
nine_k wrote: post #43

Why does Tailscale need special handling for SSH? Tailscale gives you authorized connectivity between hosts, and DNS; won't it be sufficient to run plain sshd? (If wireguard-key-level auth were sufficient, even rlogin or netcat would be enough, because the transport is encrypted already.)

It is about using SSO and tagging to auth the users. So for example you could have instances tagged with {users} that cannot ssh to certain boxes, but other users tagged with {admin} that can. All these users can be part of your tailnet.

Now this explanation makes the most sense.

- Wireguard keys for authentication and encryption.

- Tags for authorization to run a remote shell.

Re: Tailscale SSH is now Generally Available

#55

Post by cess11 »

_ikke_ wrote: post #34
fransje26 wrote: post #31

Earlier quoted context omitted.

What is their incentive to offer such a service for free? Following the adage "if it's for free, you are the product", what is going on behind the scenes? Are they providing their services as a giant honey-pot to sniff on traffic?

They have a blogpost about it: https://tailscale.com/blog/free-plan > TL;DR: Tailscale’s free plan is free because we keep our scaling costs low relative to typical SaaS companies. We care about privacy, so unlike some other freemium models, you and your data are not the product. Rather, increased word-of-mouth from free plans sells the more valuable corporate plans. I know, it sounds too good to be true. Let’s see s…

That actually sounds rather nice, I might try them out because of this.

Re: Tailscale SSH is now Generally Available

#56

Post by davidgl »

nine_k wrote: post #43

Why does Tailscale need special handling for SSH? Tailscale gives you authorized connectivity between hosts, and DNS; won't it be sufficient to run plain sshd? (If wireguard-key-level auth were sufficient, even rlogin or netcat would be enough, because the transport is encrypted already.)

From the tool itself:

SSH to a Tailscale machine

USAGE tailscale ssh [user@] [args...]

The 'tailscale ssh' command is an optional wrapper around the system 'ssh' command that's useful in some cases. Tailscale SSH does not require its use; most users running the Tailscale SSH server will prefer to just use the normal 'ssh' command or their normal SSH client.

The 'tailscale ssh' wrapper adds a few things:

* It resolves the destination server name in its arguments using MagicDNS, even if --accept-dns=false.

* It works in userspace-networking mode, by supplying a ProxyCommand to the system 'ssh' command that connects via a pipe through tailscaled.

* It automatically checks the destination server's SSH host key against the node's SSH host key as advertised via the Tailscale coordination server.

Re: Tailscale SSH is now Generally Available

#57

Post by fransje26 »

_ikke_ wrote: post #34
fransje26 wrote: post #31

Earlier quoted context omitted.

What is their incentive to offer such a service for free? Following the adage "if it's for free, you are the product", what is going on behind the scenes? Are they providing their services as a giant honey-pot to sniff on traffic?

They have a blogpost about it: https://tailscale.com/blog/free-plan > TL;DR: Tailscale’s free plan is free because we keep our scaling costs low relative to typical SaaS companies. We care about privacy, so unlike some other freemium models, you and your data are not the product. Rather, increased word-of-mouth from free plans sells the more valuable corporate plans. I know, it sounds too good to be true. Let’s see s…

Thank you for the link.

So it's a weighed choice between "if something seems like it's too good to be true, it often is", and "the explanations they give make good sense, and it's a way of doing business that some ethical company could choose to take".

We probably won't know in the short-to-medium term, so we'll have to take their word for it..

But I must admit, their products look pretty impressive. I'll have to have a closer look at them.

Re: Tailscale SSH is now Generally Available

#59

Post by halJordan »

danmur wrote: post #26
ikiris wrote: post #2

Just gonna note this is still a thing https://ssotax.org/

I don't get what's wrong with charging more for SSO? They're in the business of making money, and if you need SSO and you need their service you're more likely to have money. It's nothing to do with the feature itself.

If you dont remember sso was sold as a panacea, and there was a lot of lip service to it. Whether you believe it is or is not matters less than what the industry promised.

So selling this fundamental, foundational security service as a top tier premium value add is disingenuous, and either deceitful or greedy.

And frankly if you're overly cynical about it; it's a lot like streaming in the sense of why am i forced to pay 10 vendors for the same library? There's a data ownership issue, why am i forced to let them own my user data on their cloud unless i pay for the privilege of owning my own data?

Re: Tailscale SSH is now Generally Available

#60

Post by cynix »

dijit wrote: post #44
nine_k wrote: post #43

Why does Tailscale need special handling for SSH? Tailscale gives you authorized connectivity between hosts, and DNS; won't it be sufficient to run plain sshd? (If wireguard-key-level auth were sufficient, even rlogin or netcat would be enough, because the transport is encrypted already.)

Tailscale ssh is handling authentication for you so that you do not need to pass around authorized_keys to all hosts. :) It means you can configure/activate/deactivate peoples access centrally too.

> you do not need to pass around authorized_keys to all hosts.

But now I need to trust these random host keys, instead of a key signed by my SSH CA...

Post reply on HN