Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale SSH

tailscale.com

Post reply on HN
Print view View original

281–290 of 311 posts

Re: Tailscale SSH

#281

Post by pilif »

ithkuil wrote: post #278
pilif wrote: post #272

I don't understand Tailscale's pricing structure: On one end, the features they are adding make the most sense if every machine that should be accessible is running tailscale. Both the fine-grained ACL support and now this SSH thing don't make sense with shared subnets. However, their pricing ties number of servers to number of users. In our case, we have potentially 3 admins who would administer about 50 machines, p…

1. api keys != auth keys 2. you can disable key expiry for devices where it makes sense, see https://tailscale.com/kb/1028/key-expiry/#disabling-key-expi...

1. I know. I'm talking about API keys though - they do expire after 90 days. See https://tailscale.com/kb/1101/api/

2. For API keys, expiration cannot be disabled.

Re: Tailscale SSH

#282

Post by thefilmore »

bradfitz wrote: post #246
dbmnt wrote: post #238

Earlier quoted context omitted.

Not really. It messes with DNS big time. Try enabling the "MagicDNS" or "Exit Nodes" features, and watch as /etc/resolv.conf is edited with each change. I can easily reproduce scenarios where it's left empty and there's no working DNS resolution. This is one of the major things I _don't_ like about Tailscale. I wish they'd just stick to enabling Wireguard and making the authentication easier (i.e., where they started…

It only messes with /etc/resolv.conf if you did `--accept-dns` and don't have systemd-resolved, which nowadays is much more common. Linux DNS is a clusterfun: https://tailscale.com/blog/sisyphean-dns-client-linux/ But, yeah, without systemd-resolved Linux DNS is a fight for the death between uncooperating processes. NetworkManager is okay but there are a dozen buggy variants in the wild we have to work around. Linux…

What about using NSS[1]? You could add a Tailscale provider to the `hosts` entry.

[1]: https://en.wikipedia.org/wiki/Name_Service_Switch

Re: Tailscale SSH

#283

Post by weikju »

bradfitz wrote: post #254
weikju wrote: post #208

Earlier quoted context omitted.

> You can use any SSH client from any OS. I've tried this earlier and was unsusccessful sshing from my iPad, using Termius and Blink apps. Not sure if there are specific client requirements on the iPad?

We successfully tested a number of iOS SSH clients. They should all work. Can you file a bug with details of what you saw? Either https://github.com/tailscale/tailscale/issues/new or email support@ ... whichever you're more comfortable with.

sure thing, will do!

Re: Tailscale SSH

#284

Post by rastignack »

bradfitz wrote: post #51

I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…

Were golang’s ssh and crypto packages independently audited ?

Re: Tailscale SSH

#285

Post by nmiculinic »

This is pretty awesome! At my workplace we're using tailscale, and it's been mostly good experience. There were some hickups (like tokens expiring without sending any notification email), though all in all much better then alternatives.

Re: Tailscale SSH

#286

Post by weikju »

bradfitz wrote: post #254
weikju wrote: post #208

Earlier quoted context omitted.

> You can use any SSH client from any OS. I've tried this earlier and was unsusccessful sshing from my iPad, using Termius and Blink apps. Not sure if there are specific client requirements on the iPad?

We successfully tested a number of iOS SSH clients. They should all work. Can you file a bug with details of what you saw? Either https://github.com/tailscale/tailscale/issues/new or email support@ ... whichever you're more comfortable with.

ah I think I figured it out!

I had a notification asking me to verify, but because of Focus, that notification didn't show up anywhere that I could see...... So in theory, this should work, will try again.

Re: Tailscale SSH

#287

Post by jamiegreen »

Forgive my ignorance, but what is the benefit for an individual to run this? I currently just use 1.1.1.1 by Cloudflare on my two main devices....not realloy sure I understand what the advantage of this is?

Re: Tailscale SSH

#288

Post by NoraCodes »

skybrian wrote: post #157
NoraCodes wrote: post #137

I know this opinion comes up every time Tailscale is mentioned, but requiring SSO _and_ only supporting companies like Google and Microsoft on the free tier means a lot of people can't use it without being exposed to a ton of risk in the form of automated moderation/deletion decisions. I want to be excited about this stuff, but it just won't fit into my risk profile until that changes. Hell, I'd be happy to pay $5/mo…

This is a workaround, but could you minimize that risk by signing up for both Microsoft and Google? It should help for any policy / moderation / "computer says no" decisions that are vendor-specific. (On the other hand, for security risks, it means that a security hole in either one would be a problem.)

That is not how Tailscale SSO works.

Re: Tailscale SSH

#289

Post by weikju »

weikju wrote: post #286
bradfitz wrote: post #254

Earlier quoted context omitted.

We successfully tested a number of iOS SSH clients. They should all work. Can you file a bug with details of what you saw? Either https://github.com/tailscale/tailscale/issues/new or email support@ ... whichever you're more comfortable with.

ah I think I figured it out! I had a notification asking me to verify, but because of Focus, that notification didn't show up anywhere that I could see...... So in theory, this should work, will try again.

Works fine now

Re: Tailscale SSH

#290

Post by structural »

kissgyorgy wrote: post #228
structural wrote: post #181

Earlier quoted context omitted.

I've been using Tailscale for years but will likely not use this feature, even though I would like to. The fundamental problem with the approach really is that connections are different over the tailnet and over the local network. Here is a specific use case that is painful: 1. There exists a cluster of machines, each with large amounts of locally attached storage. They are all on the same local network and connected…

If those machines are in the same rack, why you don't put them on the same subnet and use a different interface when moving files around instead of Tailnet?

That's exactly what we do, which is why adding Tailscale SSH to our current workflow isn't helpful, since we would still have to manage SSH keys for access via the local subnet.
Post reply on HN