251–260 of 311 posts
What would be the advantages of this compared to say Teleport ? Teleport is working fine for us, but I wonder if the network based approach (+ wireguard) of Tailscale would be better in terms of network redundancy ?
Well, how long did it take you to set up Teleport?
The main « issue » was working with some key concepts of Teleport (logins, roles, connectors).
Earlier quoted context omitted.
> I know it says it's linux-only right now, but is that client side or server only? Can my Windows users TailSSH into linux boxes? Linux-only on the server right. macOS support is kinda there (in git) but not entirely done and not included in the GUI builds. Windows server support is tracked in https://github.com/tailscale/tailscale/issues/4697 . You can use any SSH client from any OS. > Would be cool if somehow it c…
If you only pay for unique humans, why does the pricing page list device count caps (and, on Business plans, the pricing for exceeding those caps)?
Earlier quoted context omitted.
How was the decision made to roll this functionality out before announcing it to customers (we found it during a previous security audit)? While it might seem logical in your mind to bolt on extra features and add value, your customers evaluate risk based on functionality of the software they are approving. Customer buys a VPN solution, magically gets remote access that bypasses firewalls. Can we trust Tailscale to n…
There are two things have have to be enabled to turn it on: (1) a target server needs to run "tailscale up --ssh" to enable the SSH server (2) your Tailscale ACLs have to permit it. Our default, if you've never set your ACLs (as is usually the case for personal users), is that you're allowed to SSH to your own untagged devices only. For an org that's already using ACLs, you won't have any SSH rules defined and thus n…
Until you decide to ship a completely on-prem Tailscale server, ACLs mean nothing. They can be modified by the same rogue employee that added an SSH server that bypasses local firewalls to our environment without telling anyone.
Earlier quoted context omitted.
> I know it says it's linux-only right now, but is that client side or server only? Can my Windows users TailSSH into linux boxes? Linux-only on the server right. macOS support is kinda there (in git) but not entirely done and not included in the GUI builds. Windows server support is tracked in https://github.com/tailscale/tailscale/issues/4697 . You can use any SSH client from any OS. > Would be cool if somehow it c…
> You can use any SSH client from any OS. I've tried this earlier and was unsusccessful sshing from my iPad, using Termius and Blink apps. Not sure if there are specific client requirements on the iPad?
Can you file a bug with details of what you saw? Either https://github.com/tailscale/tailscale/issues/new or email support@ ... whichever you're more comfortable with.
Earlier quoted context omitted.
Hey bradfitz, guy who previously had 32150 here. :-) This looks insanely cool, a couple questions: I know it says it's linux-only right now, but is that client side or server only? Can my Windows users TailSSH into linux boxes? Would be cool if somehow it could wedge into sudo auth so you could login as a a user and sudo without password if allowed by ACLs, especally if I could add "check" to the ssh. agent pam modul…
Just to add to the above, pricing was a little obsecure for me too though I commited to Tailscale and then worked it out after the fact. Minor suggestion, for future and new users, is it possible to get a calculator where you could input the number of users you expect, the number of servers you want to include, expected unique ACL's and provide you an ETA of what your license cost would be?
So @bradfitz when are you releasing https://tailscale.com/connect/ for real? :) Context for the uninitiated - as a crazy idea on the podcast Security Cryptography Whatever (hosted by tptacek and others less well known on HN) Avery and Brad of tailscale imagined an ssh client in the browser with QR code authentication to SSO to allow you to connect to your tailscale network (over tailscale SSH) from untrusted computer…
That makes it sound like we put a binary in our git repo :) It was its own Go package main that people could run.
It was never a secret. We just didn't advertise it a ton! :)
Earlier quoted context omitted.
In case anyone is looking for the URL: https://github.com/juanfont/headscale 5k stars on Github, and lots of activity. Seems very interesting!
While not official, Tailscale themselves are not opposed to this project. They don't much contribute to it directly, but they have gone out of their way on a few occasions to avoid breaking it or to make it easier for headscale to implement some things (like the new encryption scheme for communicating with the control server). I imagine they don't see it as much of a business model threat, since it has no commercial…
Earlier quoted context omitted.
There are two things have have to be enabled to turn it on: (1) a target server needs to run "tailscale up --ssh" to enable the SSH server (2) your Tailscale ACLs have to permit it. Our default, if you've never set your ACLs (as is usually the case for personal users), is that you're allowed to SSH to your own untagged devices only. For an org that's already using ACLs, you won't have any SSH rules defined and thus n…
Try to look at it without your inside knowledge of how it works. Think about a customer discovering this with no documentation. Until you decide to ship a completely on-prem Tailscale server, ACLs mean nothing. They can be modified by the same rogue employee that added an SSH server that bypasses local firewalls to our environment without telling anyone.
(We don't use Tailscale SSH, and are unlikely ever to; we have a separate source of authentication truth for SSH, and a separate certificate-based access control system.)
Earlier quoted context omitted.
Session recording's actually already in the network engine for SSH, we just haven't plumbed the whole "push recordings somewhere and surface them" yet. Soon :)
It's an extremely valuable feature, in that it can knock out a bunch of different SOC2 DRL line items with a single screenshot.
So @bradfitz when are you releasing https://tailscale.com/connect/ for real? :) Context for the uninitiated - as a crazy idea on the podcast Security Cryptography Whatever (hosted by tptacek and others less well known on HN) Avery and Brad of tailscale imagined an ssh client in the browser with QR code authentication to SSO to allow you to connect to your tailscale network (over tailscale SSH) from untrusted computer…
> when tailscale ssh was a secret binary in the tailscale github repo That makes it sound like we put a binary in our git repo :) It was its own Go package main that people could run. It was never a secret. We just didn't advertise it a ton! :)