Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale Authentication for Nginx

tailscale.com

Post reply on HN
Print view View original

31–40 of 45 posts

Re: Tailscale Authentication for Nginx

#31

Post by benmmurphy »

iancarroll wrote: post #26
benmmurphy wrote: post #20

Earlier quoted context omitted.

I think if you are checking the host header on the server there is no problem. But I think if you are not checking the host header then there are some cute DNS rebinding attacks that will let an evil website perform arbitrary actions on behalf of a user if they are tricked into navigating onto the evil website. i've seen this same attack on sites hosted locally where authentication is assumed because only the localho…

It’s good to protect against DNS rebinding, and the host header or TLS will protect against this, but rebinding isn’t the main source of CSRF issues. You can still blindly perform CSRF attacks via XHR or . The disadvantage to Tailscale’s implicit authentication is that it can’t take advantage of modern features like SameSite cookies, which can be a strong defense against CSRF. You would need to implement CSRF tokens…

Blind CSRF should be protected at the application level by CSRF tokens. I don’t think I can come up with a situation where using tail scale auth + CSRF tokens puts you in a worse situation than just using CSRF tokens. Obviously, if you don’t use CSRF tokens you have a problem but you have a problem even if you don’t use this tailscale auth.

Re: Tailscale Authentication for Nginx

#32

Post by vineyardmike »

This is awesome! I was looking to set up auth on a tailnet-exposed Nginx server and now I know how I'll handle it :) Saves me a ton of efforts!

Now all I want from them is a way to bind an auth key to a specific IP address (for containers when they restart they keep the same DNS record). I only mention this because I know the devs read HN and I'm hoping they'll see this :)

Re: Tailscale Authentication for Nginx

#33

Post by francislavoie »

qbasic_forever wrote: post #21
mholt wrote: post #5

Had a call with Tailscale (unofficially); this will be coming for Caddy soon.

Awesome! Generic subrequest auth would be a super handy feature native to caddy.

Yep! We have it working here: https://github.com/caddyserver/caddy/pull/4739

It's a generic setup where you can do _anything_ you want via firing off an HTTP request as a clone of the original, and re-handling the request after getting back the response.

Big shoutout to the Authelia team for helping out with testing and confirming that it works. Will be merged very soon (today?) and some follow-up work is coming to make the config for it even shorter (some sugar for the common forward_auth usecase).

Re: Tailscale Authentication for Nginx

#35

Post by xena »

vineyardmike wrote: post #32

This is awesome! I was looking to set up auth on a tailnet-exposed Nginx server and now I know how I'll handle it :) Saves me a ton of efforts! Now all I want from them is a way to bind an auth key to a specific IP address (for containers when they restart they keep the same DNS record). I only mention this because I know the devs read HN and I'm hoping they'll see this :)

Can you email me at xe at tailscale dot com? I'd be happy to learn more about your setup and make suggestions for you, might even turn that into one of these posts!

Re: Tailscale Authentication for Nginx

#36

Post by qbasic_forever »

francislavoie wrote: post #33
qbasic_forever wrote: post #21

Earlier quoted context omitted.

Awesome! Generic subrequest auth would be a super handy feature native to caddy.

Yep! We have it working here: https://github.com/caddyserver/caddy/pull/4739 It's a generic setup where you can do _anything_ you want via firing off an HTTP request as a clone of the original, and re-handling the request after getting back the response. Big shoutout to the Authelia team for helping out with testing and confirming that it works. Will be merged very soon (today?) and some follow-up work is coming to m…

Wow slick, that looks great!

Re: Tailscale Authentication for Nginx

#37

Post by atonse »

xena wrote: post #30
atonse wrote: post #28

This is such a damn elegant solution for an Auth Proxy, using Wireguard and all the existing, solid abstractions. You guys are just on fire. I may have missed this in the post, but is there any plans to make a general purpose one rather than Grafana, etc? like tailscaled --proxy --to or (and I saw mholt's post) just rely on something like Caddy for that?

I'm not sure yet. A lot of this is still experimental to feel out the problem space. Doing this as sidecars/extra things you run on the side lets us learn more about how people want to use this until we make this an actual product. If you have feedback/suggestions though, I am welcome to hear it and forward it along to the team.

Just thinking "out loud" here – this isn't standards compliant or anything.

I'd love to be able to control some of these kinds of things right in the Admin UI.

Like being able to say "create new proxy, use this relay that gets me into this network, look at this acl to decide who gets in"

I could see this as really useful for the long tail of "admin" type services. Like admin UIs for Sidekiq (Ruby bg jobs) or Oban (Elixir bg job), our HashiCorp Nomad or Consul admin screens, etc without having to mess around with extra tokens.

Re: Tailscale Authentication for Nginx

#38

Post by mholt »

xena wrote: post #11
mholt wrote: post #5

Had a call with Tailscale (unofficially); this will be coming for Caddy soon.

I'm excited to see it happen!

Me too. Thanks for being so helpful! Using Tailscale has been a pleasure, and you've got a great team over there, so integrating with TS has also been a dream.
Post reply on HN