Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale SSH

tailscale.com

Post reply on HN
Print view View original

201–210 of 311 posts

Re: Tailscale SSH

#201

Post by grinich »

mdeeks wrote: post #92
infogulch wrote: post #89

I'm very interested in Tailscale for both personal and business use-cases, but I'm rather put off by the stark centralization of offered identity providers: Microsoft, Github (Microsoft), Google, okta (?). What are the chances that Tailscale would offer authentication using decentralized/self-hosted identity providers like Ory ( https://www.ory.sh/ )?

They offer custom SSO providers using SAML or OIDC https://tailscale.com/kb/1119/sso-saml-oidc/ Unfortunately they are locked behind Enterprise pricing because of the extra help and debugging needed to get them working. Maybe at some point this will be offered standard though.

Small plug for my startup (hope that's ok!) - if anyone else is looking for an easy way to set up SSO, you should check out the WorkOS Admin Portal feature[0].

It's essentially an onboarding wizard that works for any identity provider. This makes the SAML/OIDC configuration self-serve, which in turn allows you to easily provide SSO to anyone who wants it. The UI can also be branded with your logo/colors and run on your own custom domain.

[0] https://workos.com/admin-portal

Re: Tailscale SSH

#202

Post by tptacek »

dekhn wrote: post #193
tptacek wrote: post #142

Earlier quoted context omitted.

You have to explicitly enable Tailscale SSH, both on the host and in the ACLs that allow users to use the feature. Tailscale's ACLs are much, much better than iptable rules (for instance: they have built-in unit testing). (I'm not impartial about Tailscale.)

> Tailscale's ACLs are much, much better than iptable rules (for instance: they > have built-in unit testing). Humility helps a lot on the internet- the important thing about iptables is that it runs on millions, possibly billions of machines. Production systems that don't have unit tests but run at scale aren't worse than systems which are newly introduced but have fairly unknown implications.

I'm sorry, I really don't know what you're trying to say here. I'm evaluating a set of engineering tradeoffs and reaching a conclusion about them; I'm not trying to psychoanalyze them.

Re: Tailscale SSH

#203

Post by ngcc_hk »

There is a reason why in a corp you need to install certain kind of ai network sniffer to get this underlying network traffic to surface. Be worked on network security and it is just hard to work in a network which you cannot see I think. The bypass is a success and it is not even free (price wise it seems). Crazy.

Re: Tailscale SSH

#204

Post by glitchcrab »

sandstrom wrote: post #73
sandstrom wrote: post #70

Good! Boundary ( https://www.boundaryproject.io/ ) by Hashicorp needs some healthy competition. Teleport is also a tool in this space, for those looking for alternatives.

And for anyone looking at Tailscale, I should also mention ZeroTier ( https://www.zerotier.com/ ). In my opinion they have better tech, but they are pretty bad at packaging it, and bad at making it work for actual use-cases. Tailscale seems to be much more clever around building out stuff (like this one, SSH) that actually goes all the way for a particular use-case. ZeroTier feels more like a building block, where yo…

I had no end of problems with zerotier, connections would randomly drop between machines even when they were on the same LAN. No such problems with tailscale

Re: Tailscale SSH

#205

Post by tptacek »

dekhn wrote: post #191
mike_d wrote: post #163

Earlier quoted context omitted.

How was the decision made to roll this functionality out before announcing it to customers (we found it during a previous security audit)? While it might seem logical in your mind to bolt on extra features and add value, your customers evaluate risk based on functionality of the software they are approving. Customer buys a VPN solution, magically gets remote access that bypasses firewalls. Can we trust Tailscale to n…

Ohhh, this explains why my corporation placed a total firewall block on the Tailscale website. This is a postmortem-worthy incident on Tailscale's part.

If you're not already using Tailscale, with your security or IT teams controlling it, it would be malpractice to allow it on a controlled network. No competent security team allows people to introduce their own VPNs.

Re: Tailscale SSH

#206

Post by tptacek »

e12e wrote: post #196
tptacek wrote: post #155

Earlier quoted context omitted.

How could it possibly work otherwise? Tailscale owns the WireGuard connection, so it gets raw packets from WireGuard before the kernel .

It could work like a full userspace network stack, getting the packets on the wire before (instead of) the kernel (network stack)?

How? (I can think of ways, and they're all horrible).

Re: Tailscale SSH

#207

Post by tptacek »

woleium wrote: post #190
bradfitz wrote: post #51

I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…

What are the failure modes? Openssh is a well understood risk, this seems... unquantifiable?

Tailscale is a userland process built in a memory-safe language, which leaves you only the SSH protocol cryptography-type vulnerabilities, which are themselves mooted by Tailscale (see downthread for a discussion about why they didn't simply expose rsh instead of ssh).

This is safer than OpenSSH.

(OpenSSH, as a piece of software, is extraordinarily safe, and has one of the best records of any memory-unsafe codebases. But OpenSSH as configurable infrastructure is much less safe; people screw it up all the time.)

Re: Tailscale SSH

#208

Post by weikju »

bradfitz wrote: post #195
linsomniac wrote: post #189

Earlier quoted context omitted.

Hey bradfitz, guy who previously had 32150 here. :-) This looks insanely cool, a couple questions: I know it says it's linux-only right now, but is that client side or server only? Can my Windows users TailSSH into linux boxes? Would be cool if somehow it could wedge into sudo auth so you could login as a a user and sudo without password if allowed by ACLs, especally if I could add "check" to the ssh. agent pam modul…

> I know it says it's linux-only right now, but is that client side or server only? Can my Windows users TailSSH into linux boxes? Linux-only on the server right. macOS support is kinda there (in git) but not entirely done and not included in the GUI builds. Windows server support is tracked in https://github.com/tailscale/tailscale/issues/4697 . You can use any SSH client from any OS. > Would be cool if somehow it c…

> You can use any SSH client from any OS.

I've tried this earlier and was unsusccessful sshing from my iPad, using Termius and Blink apps. Not sure if there are specific client requirements on the iPad?

Re: Tailscale SSH

#209

Post by tptacek »

ngcc_hk wrote: post #203

There is a reason why in a corp you need to install certain kind of ai network sniffer to get this underlying network traffic to surface. Be worked on network security and it is just hard to work in a network which you cannot see I think. The bypass is a success and it is not even free (price wise it seems). Crazy.

Tailscale is the network infrastructure for this feature. This is like being concerned that Cisco can see your ICMP headers in iOS.

Re: Tailscale SSH

#210

Post by tptacek »

ngcc_hk wrote: post #199
CaptainJustin wrote: post #56

Earlier quoted context omitted.

> This lets people gradually use Tailscale SSH over time without messing with their system one. That is something I have really appreciated about Tailscale. It seems to consistently not mess with the existing environment. Considering it does networking witchcraft and it works on a variety of architectures and OSs this is quite an accomplishment. I suspect Tailscale's customers have found the same.

That is not a feature it is a bug and a big hole. The firewall is the system. Just like apple bypass its own firewall and just send packet back home. Or the chinese way. Of course as said by one of the author the key is to control port 22 or rule for ssh. That is not a totally lost. Still, one that is ok … you are breaking the system by promoting a way to bypass it. Or just 1 rule. It is so hard to remember.

No, it's not. Network access control is the whole point of Tailscale; it is the network filtering layer. It serves literally the same function that a Checkpoint Firewall-1 installation would have in 1997, and that's why people buy it. This is basic stuff from the Tailscale website; it doesn't even qualify as analysis. You really ought to understand how these things work before you describe things as "big holes".
Post reply on HN