Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale SSH

tailscale.com

Post reply on HN
Print view View original

231–240 of 311 posts

Re: Tailscale SSH

#231

Post by jdadj »

jgeralnik wrote: post #147
jdadj wrote: post #62

Earlier quoted context omitted.

This is neat. I've used Cloudflare's Zero-Trust SSH, but I've been frustrated that it interacts poorly with sftp and scp because of the client-side changes that they make to ~/.ssh/config Does tailscale have the same issue?

For what it's worth I encountered the same issue and came up with a solution: https://github.com/cloudflare/cloudflared/issues/574 Cloudflare have ignored the github issue (which includes a solution) but at least 3 other people seem to have found my solution helpful.

Thanks! Make that 4.

Re: Tailscale SSH

#232

Post by ignoramous »

bradfitz wrote: post #197
structural wrote: post #181

Earlier quoted context omitted.

I've been using Tailscale for years but will likely not use this feature, even though I would like to. The fundamental problem with the approach really is that connections are different over the tailnet and over the local network. Here is a specific use case that is painful: 1. There exists a cluster of machines, each with large amounts of locally attached storage. They are all on the same local network and connected…

I agree that'd be fun. We have something similar in the works for other protocols, but maybe SSH isn't a huge stretch to extend it to!

Does the current setup with magicsock mean that tailssh behaves similar to MoSH (in dealing with resuming a session, specifically)?

Re: Tailscale SSH

#233

Post by viraptor »

tptacek wrote: post #205
dekhn wrote: post #191

Earlier quoted context omitted.

Ohhh, this explains why my corporation placed a total firewall block on the Tailscale website. This is a postmortem-worthy incident on Tailscale's part.

If you're not already using Tailscale, with your security or IT teams controlling it, it would be malpractice to allow it on a controlled network. No competent security team allows people to introduce their own VPNs.

Blocking the tailscale website has nothing to do with blocking the VPN. I know you're passionate about them, but I think you got baited here...

Re: Tailscale SSH

#234

Post by cynix »

cstejerean wrote: post #158
NoraCodes wrote: post #137

I know this opinion comes up every time Tailscale is mentioned, but requiring SSO _and_ only supporting companies like Google and Microsoft on the free tier means a lot of people can't use it without being exposed to a ton of risk in the form of automated moderation/deletion decisions. I want to be excited about this stuff, but it just won't fit into my risk profile until that changes. Hell, I'd be happy to pay $5/mo…

I can see some risk with say Google as the surface area is much larger (maybe they don’t like some play store activity or some ads activity or YouTube activity, etc). But I use my GitHub account and I’m really not worried about automated moderation locking me out of my account.

If only they allowed switching from Google to GitHub...

Re: Tailscale SSH

#235

Post by tptacek »

viraptor wrote: post #233
tptacek wrote: post #205

Earlier quoted context omitted.

If you're not already using Tailscale, with your security or IT teams controlling it, it would be malpractice to allow it on a controlled network. No competent security team allows people to introduce their own VPNs.

Blocking the tailscale website has nothing to do with blocking the VPN. I know you're passionate about them, but I think you got baited here...

Who’s talking about blocking a website?

Re: Tailscale SSH

#236

Post by sp332 »

tptacek wrote: post #235
viraptor wrote: post #233

Earlier quoted context omitted.

Blocking the tailscale website has nothing to do with blocking the VPN. I know you're passionate about them, but I think you got baited here...

Who’s talking about blocking a website?

dekhn, three comment levels above yours.

Re: Tailscale SSH

#237

Post by parkerduckworth »

delano wrote: post #182
bradfitz wrote: post #165

Earlier quoted context omitted.

There are two things have have to be enabled to turn it on: (1) a target server needs to run "tailscale up --ssh" to enable the SSH server (2) your Tailscale ACLs have to permit it. Our default, if you've never set your ACLs (as is usually the case for personal users), is that you're allowed to SSH to your own untagged devices only. For an org that's already using ACLs, you won't have any SSH rules defined and thus n…

That's one part of it. I can't speak for mike_d specifically, but there is a concern with having (potentially significant) modifications made to the codebase that aren't surfaced in the release notes. I imagine closed-source projects do this on a regular basis whether customers know (or care) or not. The expectations for opensource projects are different though, particularly when it comes to system-level or near syst…

I’d think that the literal ability to audit the source code would satiate one's desire to know about the changes being made in their environment.

Re: Tailscale SSH

#238

Post by dbmnt »

CaptainJustin wrote: post #56
bradfitz wrote: post #51

I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…

> This lets people gradually use Tailscale SSH over time without messing with their system one. That is something I have really appreciated about Tailscale. It seems to consistently not mess with the existing environment. Considering it does networking witchcraft and it works on a variety of architectures and OSs this is quite an accomplishment. I suspect Tailscale's customers have found the same.

Not really. It messes with DNS big time. Try enabling the "MagicDNS" or "Exit Nodes" features, and watch as /etc/resolv.conf is edited with each change. I can easily reproduce scenarios where it's left empty and there's no working DNS resolution.

This is one of the major things I _don't_ like about Tailscale. I wish they'd just stick to enabling Wireguard and making the authentication easier (i.e., where they started). I'm not a fan of most of the features they've added since. I don't want service discovery, magic DNS, SSH key management and/or the kitchen sink bolted on.

Re: Tailscale SSH

#239

Post by tptacek »

sp332 wrote: post #236
tptacek wrote: post #235

Earlier quoted context omitted.

Who’s talking about blocking a website?

dekhn, three comment levels above yours.

You're right. I guess my brain wouldn't let me process something as dumb as a corporate security control based on blocking a website to keep people from installing a binary.

Anyways, I'm just here to say, corporate security teams are definitely not OK with you doing a rogue Tailscale install, and that's as it should be.

Re: Tailscale SSH

#240

Post by ignoramous »

bradfitz wrote: post #85
dstaley wrote: post #75

Earlier quoted context omitted.

Could you share some details about the embedded SSH server? I'm curious if this would work to add SSH capabilities to devices that run Tailscale but don't include a built-in SSH server. Previously I've used dropbear, so it'd be really nice to be able to drop that requirement!

If you're already running recent-ish Tailscale on them, they're already running an SSH server that's just disabled. Run "tailscale up --ssh" to turn it on. The code's at https://github.com/tailscale/tailscale/tree/main/ssh/tailssh for all the details. Which details in particular are you curious about?

> Which details in particular are you curious about?

In the linked Q&A video with Maisem, you spoke about buying books on Linux to make SSH work. Which books, if you don't mind me asking?

Post reply on HN