Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale SSH is now Generally Available

tailscale.com

Post reply on HN
Print view View original

81–90 of 98 posts

Re: Tailscale SSH is now Generally Available

#81

Post by 4ad »

jiveturkey wrote: post #71
4ad wrote: post #45

Earlier quoted context omitted.

Tailscale doesn't need special handling for SSH. You can run your plain old sshd just fine. Tailscale comes with an additional SSH server, which runs in parallel with your other SSH server. It does use Wireguard keys directly, so effectively you don't need to manage keys. Additionally, this SSH server is implemented in userspace, so it won't (can't) interfere with anything else on your system (like your other sshd).

there is no kernel ssh. all ssh’s operate completely in userspace.

Oops, I meant the TCP/IP stack. Tailscale SSH uses a userspace network stack.

Re: Tailscale SSH is now Generally Available

#82

Post by fransje26 »

nixgeek wrote: post #67
fransje26 wrote: post #64

Earlier quoted context omitted.

> Tailscale connections are almost entirely peer to peer after an initial NAT busting operation. Ah, interesting, thanks. That would indeed make it a lot less costly. I would need to dive into it to get a better understanding how their service works. Would you happen to have some good resources you found useful?

They have tons of great documentation — https://tailscale.com/blog/how-tailscale-works

Well, this addresses the sniffing concern. From the link:

    Note that the private key never, ever leaves its node. This is important because the private key is the only thing that could potentially be used to impersonate that node when negotiating a WireGuard session. As a result, only that node can encrypt packets addressed from itself, or decrypt packets addressed to itself. It’s important to keep that in mind: Tailscale node connections are end-to-end encrypted (a concept called “zero trust networking”).
Thanks!

Re: Tailscale SSH is now Generally Available

#83

Post by ikiris »

michaelt wrote: post #40
danmur wrote: post #26

Earlier quoted context omitted.

I don't get what's wrong with charging more for SSO? They're in the business of making money, and if you need SSO and you need their service you're more likely to have money. It's nothing to do with the feature itself.

The problem is we in the software industry are so used to getting handed everything for free that a lot of software developers don't even know how to get their employer to buy something. Every engineer in every other field of engineering knows exactly how to order things, and has access to a properly organised budget for doing so. You need electronic components? Custom-machined parts? Raw material like metal sheets?…

No, this is nowhere close to it.

Re: Tailscale SSH is now Generally Available

#84

Post by ikiris »

mkl wrote: post #19
supermatt wrote: post #14

Earlier quoted context omitted.

And it also seems like its wrong (or outdated?), Given they offer "SSO with any IdP" on ALL plans, including the free (personal) one: https://tailscale.com/pricing

It says updated 2024-03-13 from source https://tailscale.com/pricing , but "SSO with any IdP" is in the Starter plan before that [edit: no, I'm wrong, it used to say "standard" not "any"]: https://web.archive.org/web/20240309045009/https://tailscale... Are they talking about something different?

Oh nice, I retract my complaint then if they've moved to actually supporting good security out of the box without an extra fee.

Re: Tailscale SSH is now Generally Available

#85

Post by wrboyce »

Nelkins wrote: post #70

Not directly related to this, but I'm trying to migrate to Tailscale now from OpenVPN, and it doesn't seem like there's a way to use one "account" (for example, Google auth) for multiple tailnets. Our use case is to have the user be able to select whether they want to connect to staging or prod. Are people just doing this with time-based ACLs within the same tailnet? Curious if there's something more obvious.

I think you could achieve this if you used GitHub for auth, create tailnets on two GitHub Orgs and it’ll ask you which one you want to login to with the net being org-name.github.

Re: Tailscale SSH is now Generally Available

#86

Post by threecheese »

wenyuanyu wrote: post #10

How does it compare with cloudflare's tunnels? [0] I have been using Cloudflare's cloudflared tunnels. It was great for tunneling ssh traffic behind firewalls. And it starts free. [0] https://developers.cloudflare.com/cloudflare-one/connections...

My understanding is that only Tailscale is end-to-end-encrypted, though both ensure that all traffic is encrypted on the wire. I don’t claim this as fact because, unlike the Cloudflare docs, Tailscale’s claim (yell) that there is no way for them to decrypt.

I’d be pleased to be proven wrong (and jgrahamc is def ITT) as I use a bunch of CF services already and it would be great to have one less PaaS in my life.

Re: Tailscale SSH is now Generally Available

#87

Post by OkayPhysicist »

danmur wrote: post #26
ikiris wrote: post #2

Just gonna note this is still a thing https://ssotax.org/

I don't get what's wrong with charging more for SSO? They're in the business of making money, and if you need SSO and you need their service you're more likely to have money. It's nothing to do with the feature itself.

The argument for it is that SSO should be treated as a basic security feature. It'd be like if you had to cough up enterprise pricing for the company to keep your passwords hashed instead of in plain text.

Re: Tailscale SSH is now Generally Available

#88

Post by aborsy »

threecheese wrote: post #86
wenyuanyu wrote: post #10

How does it compare with cloudflare's tunnels? [0] I have been using Cloudflare's cloudflared tunnels. It was great for tunneling ssh traffic behind firewalls. And it starts free. [0] https://developers.cloudflare.com/cloudflare-one/connections...

My understanding is that only Tailscale is end-to-end-encrypted, though both ensure that all traffic is encrypted on the wire. I don’t claim this as fact because, unlike the Cloudflare docs, Tailscale’s claim (yell) that there is no way for them to decrypt. I’d be pleased to be proven wrong (and jgrahamc is def ITT) as I use a bunch of CF services already and it would be great to have one less PaaS in my life.

You are right. Tunnel and TLS both end on Cloudflare. It’s not end to end. In fact CF scans the traffic supposedly for malware.

Re: Tailscale SSH is now Generally Available

#90

Post by danmur »

OkayPhysicist wrote: post #87
danmur wrote: post #26

Earlier quoted context omitted.

I don't get what's wrong with charging more for SSO? They're in the business of making money, and if you need SSO and you need their service you're more likely to have money. It's nothing to do with the feature itself.

The argument for it is that SSO should be treated as a basic security feature. It'd be like if you had to cough up enterprise pricing for the company to keep your passwords hashed instead of in plain text.

You don't have to use the service though! Can't afford it, don't use it. The price to get x service with the features you want is y no matter how you slice it by feature.
Post reply on HN