Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale SSH is now Generally Available

tailscale.com

Post reply on HN
Print view View original

71–80 of 98 posts

Re: Tailscale SSH is now Generally Available

#71

Post by jiveturkey »

4ad wrote: post #45
nine_k wrote: post #43

Why does Tailscale need special handling for SSH? Tailscale gives you authorized connectivity between hosts, and DNS; won't it be sufficient to run plain sshd? (If wireguard-key-level auth were sufficient, even rlogin or netcat would be enough, because the transport is encrypted already.)

Tailscale doesn't need special handling for SSH. You can run your plain old sshd just fine. Tailscale comes with an additional SSH server, which runs in parallel with your other SSH server. It does use Wireguard keys directly, so effectively you don't need to manage keys. Additionally, this SSH server is implemented in userspace, so it won't (can't) interfere with anything else on your system (like your other sshd).

there is no kernel ssh. all ssh’s operate completely in userspace.

Re: Tailscale SSH is now Generally Available

#73

Post by bananapub »

mikeocool wrote: post #53

I love Tailscale, it’s by far the best VPN I’ve used, and the easiest wireguard implementation to get up and running I’ve used. I can certainly see the value of this feature for some orgs, but it seems little scary to me. With this setup, if an attacker is able to compromise Tailscale and add a key to your tailnet, that person will immediately have access to your network AND shell access to all of your boxes, rather…

> if an attacker is able to compromise Tailscale and add a key to your tailnet

that's why tailscale has https://tailscale.com/kb/1226/tailnet-lock

> that person will immediately have access to your network AND shell access to all of your boxes

it would be extremely weird and negligent to deploy Tailscale at a company and not have any ACLs.

Re: Tailscale SSH is now Generally Available

#74

Post by bananapub »

fl7305 wrote: post #27

How secure is Tailscale in general, and their new SSH offering? I assume the crypto is unbreakable for outside parties that just sniff the traffic along the way. But what if Tailscale gets hacked? Are my keys available there for someone else to connect into my network? How hard would it be for the hacker to add their own machine to my network?

Tailscale is key distribution for Wireguard + ACLs + some proxying/auth things.

if tailscale got completely owned then obviously an attacker can fuck with the keys, which is why they have this feature: https://tailscale.com/kb/1226/tailnet-lock

Re: Tailscale SSH is now Generally Available

#75

Post by aborsy »

bananapub wrote: post #74
fl7305 wrote: post #27

How secure is Tailscale in general, and their new SSH offering? I assume the crypto is unbreakable for outside parties that just sniff the traffic along the way. But what if Tailscale gets hacked? Are my keys available there for someone else to connect into my network? How hard would it be for the hacker to add their own machine to my network?

Tailscale is key distribution for Wireguard + ACLs + some proxying/auth things. if tailscale got completely owned then obviously an attacker can fuck with the keys, which is why they have this feature: https://tailscale.com/kb/1226/tailnet-lock

How secure is Tailscale with taillock? What are the risks, still?

Re: Tailscale SSH is now Generally Available

#76

Post by fsociety »

bananapub wrote: post #73
mikeocool wrote: post #53

I love Tailscale, it’s by far the best VPN I’ve used, and the easiest wireguard implementation to get up and running I’ve used. I can certainly see the value of this feature for some orgs, but it seems little scary to me. With this setup, if an attacker is able to compromise Tailscale and add a key to your tailnet, that person will immediately have access to your network AND shell access to all of your boxes, rather…

> if an attacker is able to compromise Tailscale and add a key to your tailnet that's why tailscale has https://tailscale.com/kb/1226/tailnet-lock > that person will immediately have access to your network AND shell access to all of your boxes it would be extremely weird and negligent to deploy Tailscale at a company and not have any ACLs.

Don’t need to add a key, if you have access to the network interface on a laptop or server you are effectively that entity. ACLs are just one level of defense, and iirc you can force re-auth on SSH connections but it certainly becomes a single point of compromise.

Re: Tailscale SSH is now Generally Available

#77

Post by mikeocool »

bananapub wrote: post #73
mikeocool wrote: post #53

I love Tailscale, it’s by far the best VPN I’ve used, and the easiest wireguard implementation to get up and running I’ve used. I can certainly see the value of this feature for some orgs, but it seems little scary to me. With this setup, if an attacker is able to compromise Tailscale and add a key to your tailnet, that person will immediately have access to your network AND shell access to all of your boxes, rather…

> if an attacker is able to compromise Tailscale and add a key to your tailnet that's why tailscale has https://tailscale.com/kb/1226/tailnet-lock > that person will immediately have access to your network AND shell access to all of your boxes it would be extremely weird and negligent to deploy Tailscale at a company and not have any ACLs.

Tailscale lock looks interesting -- I had not seen that before.

ACLs still come down to "just trust tailscale is working as advertised." And while I generally do (I'm a happy user), if that last few years have shown anything, for the vast majority of companies/products, it's not if you get compromised, it's when. Given that I'd prefer to have multiple distinct layers between the internet and my boxes.

Though definitely see the value in terms of being able to easily tie SSH access to ACLs and your SSO provider -- as with all things security it's a trade off between ease of use and locking everything down.

Re: Tailscale SSH is now Generally Available

#78

Post by fl7305 »

irusensei wrote: post #30
fl7305 wrote: post #27

How secure is Tailscale in general, and their new SSH offering? I assume the crypto is unbreakable for outside parties that just sniff the traffic along the way. But what if Tailscale gets hacked? Are my keys available there for someone else to connect into my network? How hard would it be for the hacker to add their own machine to my network?

Tailscale uses the WireGuard protocol. About the question about Tailscale being hacked or injecting hosts in your network. With the default configuration yes. There is Tailscale lock https://tailscale.com/kb/1226/tailnet-lock In which you need to sign the devices participating in your network. The signing keys are in your device.

Thanks! How much more cumbersome does the lock make it to use Tailscale?

Re: Tailscale SSH is now Generally Available

#79

Post by michaelt »

nixgeek wrote: post #68
zaphar wrote: post #63

Earlier quoted context omitted.

How do you "untrust" a single person's key under this scheme? You would have to visit all of the machines and remove them from the authorized keys file.

Not really, with an SSH CA you’re trusting the CA and not installing individual keys into authorized_keys files. Anything signed by the SSH CA will work for logins. To deal with the “untrust” issue it’s normal for operations with an SSH CA to rely on (very) short-lived certificates, meaning often issued and valid for Smallstep wrote a summary here which is pretty good — https://smallstep.com/blog/use-ssh-certificates…

> To deal with the “untrust” issue it’s normal for operations with an SSH CA to rely on (very) short-lived certificates, meaning often issued and valid for

So you want a way to get rid of long-lived SSH certificates, instead authenticating users with your corporate single-sign-on system then issuing them a temporary credential?

And presumably you've got some audit logs, so you know who connected to what, when and why. Perhaps a familiar command line tool, that makes temporary credential rotation easy for users? Perhaps some paperwork to hand to your SOC2 compliance auditors?

I mean, this is sounding a lot like tailscale ssh, teleport, and suchlike...

Re: Tailscale SSH is now Generally Available

#80

Post by didip »

nixgeek wrote: post #68
zaphar wrote: post #63

Earlier quoted context omitted.

How do you "untrust" a single person's key under this scheme? You would have to visit all of the machines and remove them from the authorized keys file.

Not really, with an SSH CA you’re trusting the CA and not installing individual keys into authorized_keys files. Anything signed by the SSH CA will work for logins. To deal with the “untrust” issue it’s normal for operations with an SSH CA to rely on (very) short-lived certificates, meaning often issued and valid for Smallstep wrote a summary here which is pretty good — https://smallstep.com/blog/use-ssh-certificates…

But even this still requires automation, something that 97% of population don't want to do.
Post reply on HN