Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale SSH is now Generally Available

tailscale.com

Post reply on HN
Print view View original

91–98 of 98 posts

Re: Tailscale SSH is now Generally Available

#91

Post by throwaway48476 »

danmur wrote: post #90
OkayPhysicist wrote: post #87

Earlier quoted context omitted.

The argument for it is that SSO should be treated as a basic security feature. It'd be like if you had to cough up enterprise pricing for the company to keep your passwords hashed instead of in plain text.

You don't have to use the service though! Can't afford it, don't use it. The price to get x service with the features you want is y no matter how you slice it by feature.

The problem is the cost of data breaches is shared. "You" might always pay for security but the number of data breaches that happen indicate that not very one does yet they affect you all the same.

Re: Tailscale SSH is now Generally Available

#93

Post by catzkorn »

ikiris wrote: post #2

Just gonna note this is still a thing https://ssotax.org/

Hi! Tailscalar here. This is very topical for me! Over the past 3 weeks I've been working with internal stakeholders to remove our SSO tax - the sso tax is a pet hate of mine. A couple of weeks ago we removed it from our pricing plan after my proposal was approved, and today I released a blog on our website to announce it more widely: https://tailscale.com/blog/sso-tax-cut

I knew of https://sso.tax (which we are not listed on but I did include in my blog), but didn't know there was another website too!

Re: Tailscale SSH is now Generally Available

#94

Post by catzkorn »

supermatt wrote: post #14
ikiris wrote: post #2

Just gonna note this is still a thing https://ssotax.org/

And it also seems like its wrong (or outdated?), Given they offer "SSO with any IdP" on ALL plans, including the free (personal) one: https://tailscale.com/pricing

Hi! Tailscalar here. I posted to the OP, but just to flag this is correct. We removed our 'sso tax' a couple weeks ago from our pricing plans, and I released a blog today about it being removed entirely. Extremely happy it's gone!

Re: Tailscale SSH is now Generally Available

#95

Post by irusensei »

fl7305 wrote: post #78
irusensei wrote: post #30

Earlier quoted context omitted.

Tailscale uses the WireGuard protocol. About the question about Tailscale being hacked or injecting hosts in your network. With the default configuration yes. There is Tailscale lock https://tailscale.com/kb/1226/tailnet-lock In which you need to sign the devices participating in your network. The signing keys are in your device.

Thanks! How much more cumbersome does the lock make it to use Tailscale?

Not much. You first add the host and then you need to either click the link that will open the Tailscale app to sign the host or you run a command.

If you use Mullvad VPN you need to sign the Mullvad exit nodes.

Just make sure to have more than one signing device in case something happens to your main computer.

Re: Tailscale SSH is now Generally Available

#96

Post by PhLR »

catzkorn wrote: post #93
ikiris wrote: post #2

Just gonna note this is still a thing https://ssotax.org/

Hi! Tailscalar here. This is very topical for me! Over the past 3 weeks I've been working with internal stakeholders to remove our SSO tax - the sso tax is a pet hate of mine. A couple of weeks ago we removed it from our pricing plan after my proposal was approved, and today I released a blog on our website to announce it more widely: https://tailscale.com/blog/sso-tax-cut I knew of https://sso.tax (which we are not…

Sounds like Tailscale is now a candidate for the "Friends of SSO" list https://ssotax.org/friends-of-sso.html

Respect for pushing that through the org!

Re: Tailscale SSH is now Generally Available

#97

Post by luckman212 »

heywoodlh wrote: post #66
mikeocool wrote: post #53

I love Tailscale, it’s by far the best VPN I’ve used, and the easiest wireguard implementation to get up and running I’ve used. I can certainly see the value of this feature for some orgs, but it seems little scary to me. With this setup, if an attacker is able to compromise Tailscale and add a key to your tailnet, that person will immediately have access to your network AND shell access to all of your boxes, rather…

I feel the same way. I wish they offered a second factor for SSH auth — when I last looked, they didn’t. I also send myself notifications any time a failed or successful SSH login attempt occurs by tailing the ssh service with journalctl. When I last tried Tailscale SSH, it didn’t log anything to journalctl and so my self-notification via journalctl method did not work.

do you do this with cron, fail2ban, or some other mechanism?

Re: Tailscale SSH is now Generally Available

#98

Post by heywoodlh »

luckman212 wrote: post #97
heywoodlh wrote: post #66

Earlier quoted context omitted.

I feel the same way. I wish they offered a second factor for SSH auth — when I last looked, they didn’t. I also send myself notifications any time a failed or successful SSH login attempt occurs by tailing the ssh service with journalctl. When I last tried Tailscale SSH, it didn’t log anything to journalctl and so my self-notification via journalctl method did not work.

do you do this with cron, fail2ban, or some other mechanism?

Sorry for the delay, just barely saw this!

I use journalctl to follow the log. My NixOS module for it is here: https://github.com/heywoodlh/nixos-configs/blob/master/nixos...

If that isn’t clear, let me know and I can send my Ansible example :)

EDIT: To be more precise I set up the monitoring service as a systemd service

Post reply on HN