271–280 of 311 posts
Never login as root… even over secured links!
I've always heard that and adhered to that, but what's the advantage of me logging in with a user account to then use sudo for every command? It's not like I could break less than being logged in as root.
Tracking actions, fine grained policy controls, sharing a root password amongst multiple people, and then there is the risk of accidentally running a cmd as root when you thought you were in your home shell!
Both the fine-grained ACL support and now this SSH thing don't make sense with shared subnets.
However, their pricing ties number of servers to number of users. In our case, we have potentially 3 admins who would administer about 50 machines, plus some ephemeral ones.
Assuming that each admin has two Macs and an iPhone just on their client side, I don't see how this can ever work within the limits in their pricing plans (except if I'd use subnet sharing, but that would cause me to miss out on many additional features that only make sense if Tailscale is running on each machine).
Is there no way to buy additional devices?
And my other gripe is with their API: The fine grained ACL support is perfect to, say, issue temporary access to some machines for some users and the API does allow that.
But why the hell are API keys only valid for 60 days? I don't want to build a solution on top of a piece of infrastructure that requires me to manually log into a site every 60 days.
I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…
Earlier quoted context omitted.
> is that Teleport gives you transcript-level audit logs of your SSH sessions That is extremely valuable. Just in case 'transcript-level audit' didn't sink in, it's a session recording – not only you can see the all keystrokes typed but you can see all the outputs, the whole state. Someone doing a TOP command for an hour? You can watch the same thing later. Think asciinema ( https://asciinema.org/ ).
FWIW, Tailscale SSH can also record sessions in asciinema cast format: https://github.com/tailscale/tailscale/blob/v1.26.1/ssh/tail... We haven't yet fully "productized" it yet because it only records on-device for now. We want to make it stream recordings to another device (that you run) first before considering it done.
Earlier quoted context omitted.
Try to look at it without your inside knowledge of how it works. Think about a customer discovering this with no documentation. Until you decide to ship a completely on-prem Tailscale server, ACLs mean nothing. They can be modified by the same rogue employee that added an SSH server that bypasses local firewalls to our environment without telling anyone.
If you're unwilling to trust Tailscale and their processes, you can't run Tailscale right now. That's obvious. It's part of the premise. The idea that ACLs "mean nothing" is risibly reductive; the ACLs protect our team members from each other and mistakes they might make with their environments. (We don't use Tailscale SSH, and are unlikely ever to; we have a separate source of authentication truth for SSH, and a sep…
My hope was that with a little public prodding they would do better in the future. It is a product I want to like, maybe not for what you or I do, but lots of folks out there are slinging cat pictures where it will be a net benefit.
I started using tailscale a few days ago, and I absolutely love it. However, one thing is still nagging me: technically, they can add devices to my network without telling me, right? Or is there something I'm missing?
Are you asking whether the owners and operators of the Tailscale control plane can theoretically add devices to your network without your authorisation? If so then yes, definitely. Perhaps a terrible analogy, but to me the question reads like "can the bank just spend my savings?" How might you expect a fresh node to join your existing Tailnet without Tailscale having a means to add a node?
Why would you expect anything else? That’s like saying Wireguard or SSH servers should just accept any client. The purpose of mesh VPN controllers is to automate redundant key management, not to subvert the original security model.
I don't understand Tailscale's pricing structure: On one end, the features they are adding make the most sense if every machine that should be accessible is running tailscale. Both the fine-grained ACL support and now this SSH thing don't make sense with shared subnets. However, their pricing ties number of servers to number of users. In our case, we have potentially 3 admins who would administer about 50 machines, p…
2. you can disable key expiry for devices where it makes sense, see https://tailscale.com/kb/1028/key-expiry/#disabling-key-expi...
But you still can't have multiple tailnets. The strategy of "have hobbyists try out the software themselves, like it, then implement it at their work" seems incompatible with this fact.
E.g. I have the Tailscale macos application configured for the work network and then I run another tailscale daemon to connect to other home stuff:
$ alias tailscaled
tailscaled='sudo tailscaled --socket /Users/mkm/tmp/tailscale-mkm.socket'
$ alias tailscaleI installed the tailscale binaries from sources with "go install tailscale.com/cmd/tailscale{,d}@main"
What happens if I use Tailscale SSH and Google (or whatever IDP) decides to ban my account? Is there a break-glass or something that would let me either change IDPs or re-enable openssh-based access without losing my servers?
For now I think I'll be leaving the tailscale SSH functionality and keeping my own setup. I also have a static IP at home which is allowed access to my remote dedicated box. If they enabled some other identity provider that I could either self-host, or use their own with an email + password then I could close off that extra hole but for now it feels too risky for me.
On a corporate side I don't mind so much, SSO is so standard and I'd feel perfectly comfortable using Okta or Google SSO because there seem to be far fewer stories of an entire GSuite being banned with no recourse.
Tailscale is great and has solved a bunch of problems for me, but the idea of having a seperate IDP that have so many horror stories around them freaks me out enough to slightly lower my security to account for it. Thankfully there are fewer stories like that about GitHub so I'm using them for now.