Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale SSH

tailscale.com

Post reply on HN
Print view View original

221–230 of 311 posts

Re: Tailscale SSH

#221

Post by tptacek »

ikiris wrote: post #217
tptacek wrote: post #210

Earlier quoted context omitted.

No, it's not. Network access control is the whole point of Tailscale; it is the network filtering layer. It serves literally the same function that a Checkpoint Firewall-1 installation would have in 1997, and that's why people buy it. This is basic stuff from the Tailscale website; it doesn't even qualify as analysis. You really ought to understand how these things work before you describe things as "big holes".

Because that's what we all want. Yet another place to look for ACL rules...

If you're deploying Tailscale? Yeah, that's about right.

Re: Tailscale SSH

#222

Post by googleide »

Slightly OT, How do you do "re-authenticate before connecting" (https://tailscale.com/kb/1193/tailscale-ssh/) when using Google identity, we are using Google Oauth2 and latest identity SDK but can't see how to force a user to re-authenticate if logged in, do you just make a random unique claim?

Related: https://stackoverflow.com/questions/32433378/google-login-ap...

Re: Tailscale SSH

#223

Post by dvzk »

api wrote: post #170
coconut08 wrote: post #146

Earlier quoted context omitted.

wait so if i authenticate tailscale using google and enable tailscale ssh's google can just log into any of my tailscale ssh servers?

I have not tried Tailscale SSH or looked at it deeply, but as a general rule the answer is yes if the system is using delegated SSO alone to authenticate. (What I don't know is whether TS SSH supports any secondary methods like a password or SSH auth forwarding.) You are delegating authentication, so your delegated authenticator can authenticate anything they want. I feel like a large number of people adopting SSO/IA…

I've never used or examined Tailscale either, but I assumed that:

- Tailnet traffic needs to be associated with an approved device key

- Tailnet device addition needs to be signed by the offline key of another approved device

If a compromised control plane and/or SSO provider can add and approve devices on their own then the security architecture of Tailscale would be fundamentally broken. I wouldn't even call it end-to-end encrypted.

Re: Tailscale SSH

#224

Post by JonathonW »

bradfitz wrote: post #195
linsomniac wrote: post #189

Earlier quoted context omitted.

Hey bradfitz, guy who previously had 32150 here. :-) This looks insanely cool, a couple questions: I know it says it's linux-only right now, but is that client side or server only? Can my Windows users TailSSH into linux boxes? Would be cool if somehow it could wedge into sudo auth so you could login as a a user and sudo without password if allowed by ACLs, especally if I could add "check" to the ssh. agent pam modul…

> I know it says it's linux-only right now, but is that client side or server only? Can my Windows users TailSSH into linux boxes? Linux-only on the server right. macOS support is kinda there (in git) but not entirely done and not included in the GUI builds. Windows server support is tracked in https://github.com/tailscale/tailscale/issues/4697 . You can use any SSH client from any OS. > Would be cool if somehow it c…

If you only pay for unique humans, why does the pricing page list device count caps (and, on Business plans, the pricing for exceeding those caps)?

Re: Tailscale SSH

#225

Post by AtlasBarfed »

tptacek wrote: post #68
danousna wrote: post #13

What would be the advantages of this compared to say Teleport ? Teleport is working fine for us, but I wonder if the network based approach (+ wireguard) of Tailscale would be better in terms of network redundancy ?

The big thing you get with Teleport that you don't yet get with Tailscale --- apart from entirely owning the source of truth for SSH authentication on your own infra, which is a very minor issue for almost everyone but is a major issue for some people --- is that Teleport gives you transcript-level audit logs of your SSH sessions. Teleport also has that web-based SSH console (it's one of the better web-based consoles…

Do you own the teleport code or is it closed source?

Re: Tailscale SSH

#226

Post by linsomniac »

bradfitz wrote: post #195
linsomniac wrote: post #189

Earlier quoted context omitted.

Hey bradfitz, guy who previously had 32150 here. :-) This looks insanely cool, a couple questions: I know it says it's linux-only right now, but is that client side or server only? Can my Windows users TailSSH into linux boxes? Would be cool if somehow it could wedge into sudo auth so you could login as a a user and sudo without password if allowed by ACLs, especally if I could add "check" to the ssh. agent pam modul…

> I know it says it's linux-only right now, but is that client side or server only? Can my Windows users TailSSH into linux boxes? Linux-only on the server right. macOS support is kinda there (in git) but not entirely done and not included in the GUI builds. Windows server support is tracked in https://github.com/tailscale/tailscale/issues/4697 . You can use any SSH client from any OS. > Would be cool if somehow it c…

Very promising the start of the pam. Good news about the SSH client, I figured that was the case but wanted to ake sure. That would be a huge benefit for my developers who are all on Windows.

Thanks for the info about pricing, I set up the 1 user free account and started that to get some hands on experience, and I'll copy you on pricing if I can't get it figured out. Thanks!

Re: Tailscale SSH

#227

Post by tptacek »

AtlasBarfed wrote: post #225
tptacek wrote: post #68

Earlier quoted context omitted.

The big thing you get with Teleport that you don't yet get with Tailscale --- apart from entirely owning the source of truth for SSH authentication on your own infra, which is a very minor issue for almost everyone but is a major issue for some people --- is that Teleport gives you transcript-level audit logs of your SSH sessions. Teleport also has that web-based SSH console (it's one of the better web-based consoles…

Do you own the teleport code or is it closed source?

I don't know what "own it" means, but it's open source.

Re: Tailscale SSH

#228

Post by kissgyorgy »

structural wrote: post #181
bradfitz wrote: post #51

I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…

I've been using Tailscale for years but will likely not use this feature, even though I would like to. The fundamental problem with the approach really is that connections are different over the tailnet and over the local network. Here is a specific use case that is painful: 1. There exists a cluster of machines, each with large amounts of locally attached storage. They are all on the same local network and connected…

If those machines are in the same rack, why you don't put them on the same subnet and use a different interface when moving files around instead of Tailnet?

Re: Tailscale SSH

#229

Post by manfre »

lolsoftware wrote: post #69
bradfitz wrote: post #51

I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…

This looks great, and I'd love to replace AWS SSM (at least for the purposes of instance access) with this! One question I have is have is around device limits. With SSM, I can easily run an agent on every instance. Tailscale has pretty tight device limits on the Team and Business plans. I have no idea what the custom pricing looks like, but I'm guessing it would exceed my budget. What's the intended way to use this…

You'll want to set up a bastion host as a subnet router. https://tailscale.com/kb/1021/install-aws/

Re: Tailscale SSH

#230

Post by samb1729 »

ikiris wrote: post #217
tptacek wrote: post #210

Earlier quoted context omitted.

No, it's not. Network access control is the whole point of Tailscale; it is the network filtering layer. It serves literally the same function that a Checkpoint Firewall-1 installation would have in 1997, and that's why people buy it. This is basic stuff from the Tailscale website; it doesn't even qualify as analysis. You really ought to understand how these things work before you describe things as "big holes".

Because that's what we all want. Yet another place to look for ACL rules...

Considering how simple it is to use Tailscale ACL rules with node auto-tagging, yes I absolutely want it.
Post reply on HN