Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale SSH is now Generally Available

tailscale.com

Post reply on HN
Print view View original

61–70 of 98 posts

Re: Tailscale SSH is now Generally Available

#61

Post by Terretta »

danmur wrote: post #26
ikiris wrote: post #2

Just gonna note this is still a thing https://ssotax.org/

I don't get what's wrong with charging more for SSO? They're in the business of making money, and if you need SSO and you need their service you're more likely to have money. It's nothing to do with the feature itself.

EVERYONE needs SSO.

1. SaaS providers need it so they don't store your creds. If they don't store them, they can't leak them.

2. You need it because 1.

3. Nobody needs SSO any more :-) Actually you only need OpenID Connect which shows up as "Sign in with" or "Continue with", which -- if coupled with a domain name validation on your canonical user ID -- amounts to most of the same value as the complicated SSO / SAML dance without per customer config. It is less work for a SaaS provider to support sign in with than to make an entire auth chain.

My current recommendation to new SaaS offerings is OIDC plus magic links as a fallback. (Many SaaS go a very long way with just magic links, those plus a domain name in email address check can also tie employees to a company, regardless of the company's IdP.)

All that said, SCIM and group-to-role sync, etc., should be EXTRA. You need extra moving parts, and enterprises with information barrier or other compliance or regulatory obligations are thrilled to pay for this.

Re: Tailscale SSH is now Generally Available

#62

Post by zaphar »

fransje26 wrote: post #57
_ikke_ wrote: post #34

Earlier quoted context omitted.

They have a blogpost about it: https://tailscale.com/blog/free-plan > TL;DR: Tailscale’s free plan is free because we keep our scaling costs low relative to typical SaaS companies. We care about privacy, so unlike some other freemium models, you and your data are not the product. Rather, increased word-of-mouth from free plans sells the more valuable corporate plans. I know, it sounds too good to be true. Let’s see s…

Thank you for the link. So it's a weighed choice between "if something seems like it's too good to be true, it often is", and "the explanations they give make good sense, and it's a way of doing business that some ethical company could choose to take". We probably won't know in the short-to-medium term, so we'll have to take their word for it.. But I must admit, their products look pretty impressive. I'll have to hav…

For what it's worth the scaling costs for their service are quite low. Tailscale connections are almost entirely peer to peer after an initial NAT busting operation. They can afford to do a loss leader like this and the product is actually so good that I've recommended it to a number of places. It's literally the first VPN that I think is worth paying for. I wouldn't have known that if the free tier didn't exist. Using is believing in their case. It's not uncommon to be literally angry at how easy it is to set up/manage/deploy given how much of a trash fire most vpn software is.

Re: Tailscale SSH is now Generally Available

#63

Post by zaphar »

cynix wrote: post #60
dijit wrote: post #44

Earlier quoted context omitted.

Tailscale ssh is handling authentication for you so that you do not need to pass around authorized_keys to all hosts. :) It means you can configure/activate/deactivate peoples access centrally too.

> you do not need to pass around authorized_keys to all hosts. But now I need to trust these random host keys, instead of a key signed by my SSH CA...

How do you "untrust" a single person's key under this scheme? You would have to visit all of the machines and remove them from the authorized keys file.

Re: Tailscale SSH is now Generally Available

#64

Post by fransje26 »

zaphar wrote: post #62
fransje26 wrote: post #57

Earlier quoted context omitted.

Thank you for the link. So it's a weighed choice between "if something seems like it's too good to be true, it often is", and "the explanations they give make good sense, and it's a way of doing business that some ethical company could choose to take". We probably won't know in the short-to-medium term, so we'll have to take their word for it.. But I must admit, their products look pretty impressive. I'll have to hav…

For what it's worth the scaling costs for their service are quite low. Tailscale connections are almost entirely peer to peer after an initial NAT busting operation. They can afford to do a loss leader like this and the product is actually so good that I've recommended it to a number of places. It's literally the first VPN that I think is worth paying for. I wouldn't have known that if the free tier didn't exist. Usi…

> Tailscale connections are almost entirely peer to peer after an initial NAT busting operation.

Ah, interesting, thanks. That would indeed make it a lot less costly. I would need to dive into it to get a better understanding how their service works.

Would you happen to have some good resources you found useful?

Re: Tailscale SSH is now Generally Available

#65

Post by mthoms »

kulor wrote: post #39

Bravo to Alex in the embedded video for clearly explaining the benefits in an interesting way without being overly salesy. I get a genuine sense of enthusiasm from him.

All of his Tailscale videos are fantastic. He had me up and running with TS very quickly and networking stuff is way out of my wheelhouse.

Highly recommended.

Re: Tailscale SSH is now Generally Available

#66

Post by heywoodlh »

mikeocool wrote: post #53

I love Tailscale, it’s by far the best VPN I’ve used, and the easiest wireguard implementation to get up and running I’ve used. I can certainly see the value of this feature for some orgs, but it seems little scary to me. With this setup, if an attacker is able to compromise Tailscale and add a key to your tailnet, that person will immediately have access to your network AND shell access to all of your boxes, rather…

I feel the same way. I wish they offered a second factor for SSH auth — when I last looked, they didn’t.

I also send myself notifications any time a failed or successful SSH login attempt occurs by tailing the ssh service with journalctl. When I last tried Tailscale SSH, it didn’t log anything to journalctl and so my self-notification via journalctl method did not work.

Re: Tailscale SSH is now Generally Available

#67

Post by nixgeek »

fransje26 wrote: post #64
zaphar wrote: post #62

Earlier quoted context omitted.

For what it's worth the scaling costs for their service are quite low. Tailscale connections are almost entirely peer to peer after an initial NAT busting operation. They can afford to do a loss leader like this and the product is actually so good that I've recommended it to a number of places. It's literally the first VPN that I think is worth paying for. I wouldn't have known that if the free tier didn't exist. Usi…

> Tailscale connections are almost entirely peer to peer after an initial NAT busting operation. Ah, interesting, thanks. That would indeed make it a lot less costly. I would need to dive into it to get a better understanding how their service works. Would you happen to have some good resources you found useful?

They have tons of great documentation — https://tailscale.com/blog/how-tailscale-works

Re: Tailscale SSH is now Generally Available

#68

Post by nixgeek »

zaphar wrote: post #63
cynix wrote: post #60

Earlier quoted context omitted.

> you do not need to pass around authorized_keys to all hosts. But now I need to trust these random host keys, instead of a key signed by my SSH CA...

How do you "untrust" a single person's key under this scheme? You would have to visit all of the machines and remove them from the authorized keys file.

Not really, with an SSH CA you’re trusting the CA and not installing individual keys into authorized_keys files.

Anything signed by the SSH CA will work for logins.

To deal with the “untrust” issue it’s normal for operations with an SSH CA to rely on (very) short-lived certificates, meaning often issued and valid for Smallstep wrote a summary here which is pretty good —

https://smallstep.com/blog/use-ssh-certificates/

Re: Tailscale SSH is now Generally Available

#70

Post by Nelkins »

Not directly related to this, but I'm trying to migrate to Tailscale now from OpenVPN, and it doesn't seem like there's a way to use one "account" (for example, Google auth) for multiple tailnets. Our use case is to have the user be able to select whether they want to connect to staging or prod.

Are people just doing this with time-based ACLs within the same tailnet? Curious if there's something more obvious.

Post reply on HN