Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale SSH

tailscale.com

Post reply on HN
Print view View original

81–90 of 311 posts

Re: Tailscale SSH

#81

Post by tptacek »

dave_universetf wrote: post #79
tptacek wrote: post #68

Earlier quoted context omitted.

The big thing you get with Teleport that you don't yet get with Tailscale --- apart from entirely owning the source of truth for SSH authentication on your own infra, which is a very minor issue for almost everyone but is a major issue for some people --- is that Teleport gives you transcript-level audit logs of your SSH sessions. Teleport also has that web-based SSH console (it's one of the better web-based consoles…

Session recording's actually already in the network engine for SSH, we just haven't plumbed the whole "push recordings somewhere and surface them" yet. Soon :)

It's an extremely valuable feature, in that it can knock out a bunch of different SOC2 DRL line items with a single screenshot.

Re: Tailscale SSH

#82

Post by megous »

e12e wrote: post #66
edf13 wrote: post #8

Never login as root… even over secured links!

Indeed, "root" is not a person - only persons should have authorization (to log in, to elevate via su/sudo). Ed: although in this case the binding between a system user and a person happens at the tailscale level.

"bob" UNIX account is not a person either.

If you ssh in, no matter to what account, your key ID is logged and that's what matters.

Anything can happen afterwards, unless you have a really tight grip on your system, since local privilege escallations are not that hard or uncommon.

Re: Tailscale SSH

#83

Post by bradfitz »

lolsoftware wrote: post #69
bradfitz wrote: post #51

I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…

This looks great, and I'd love to replace AWS SSM (at least for the purposes of instance access) with this! One question I have is have is around device limits. With SSM, I can easily run an agent on every instance. Tailscale has pretty tight device limits on the Team and Business plans. I have no idea what the custom pricing looks like, but I'm guessing it would exceed my budget. What's the intended way to use this…

You could do a Tailscale SSH bastion thing, yeah. But before you build a funky setup to avoid pricing concerns, at least reach out to the sales folk to see what it is. We're usually pretty flexible on exact quotas and realize that different orgs have different user/device shapes.

Re: Tailscale SSH

#85

Post by bradfitz »

dstaley wrote: post #75
bradfitz wrote: post #51

I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…

Could you share some details about the embedded SSH server? I'm curious if this would work to add SSH capabilities to devices that run Tailscale but don't include a built-in SSH server. Previously I've used dropbear, so it'd be really nice to be able to drop that requirement!

If you're already running recent-ish Tailscale on them, they're already running an SSH server that's just disabled. Run "tailscale up --ssh" to turn it on.

The code's at https://github.com/tailscale/tailscale/tree/main/ssh/tailssh for all the details. Which details in particular are you curious about?

Re: Tailscale SSH

#86

Post by xgbi »

throwaway894345 wrote: post #25
dsr_ wrote: post #18

Earlier quoted context omitted.

Yes and no. You shouldn't have rsh on your system at all -- there's a case for telnet to test connections (though netcat is better), but there's no case for rsh. ssh used to allow setting cipher=none, but that's not available anymore. Think of it this way: you're paying the small overhead of double encryption, but you're gaining not fatfingering your way to a password compromise.

I'm not following. How does double encryption help to avoid a password compromise if everything is authed with tailscale in the first place?

Somebody listening on local connections can sniff your password.

Re: Tailscale SSH

#87

Post by bradfitz »

infocollector wrote: post #72
bradfitz wrote: post #51

I'm one of the authors of this. Happy to answer any questions. One of the fun technical details is that, when enabled on a machine (tailscale up --ssh), the userspace tailscaled process takes over all TCP port 22 packets after the WireGuard decryption and doesn't even feed them into the kernel over TUN. We use gVisor's netstack to handle the TCP connections in-process. So it doesn't matter whether you have other proc…

Hi Brad: Thanks for helping out with this feature! I've been one of the early users of tailscale. My network is around 50 machines. I've recently started having issues with ssh on some of my machines, especially from mac m1 -> some ubuntu boxes. Could this be related to this new feature? Any suggestions/pointers on how to debug these issues?

Tailscale SSH doesn't mess with your port 22 packets if it's off so almost certainly unrelated. Have you reached out to support or filed a bug?

Re: Tailscale SSH

#88

Post by pphysch »

lloeki wrote: post #30
pphysch wrote: post #11

> (SSH certificates are better, but have you tried running your own enterprise CA?) For a small business, what is so hard about keeping a file (CA private key) secure and changing it when required?

> For a small business, what is so hard about keeping a file (CA private key) secure and changing it when required? For a small business? Well, keeping a file secure and changing it when required ^^' I mean, it's not out of this world hard to generate your private CA but there are a thousand footguns, the experience isn't exactly friendly, and it's Yet Another Thing To Do And Keep Track Off, i.e even if there's someo…

Can you be more specific on some of those main footguns?

I need to rotate the CA for some rare reason. Boom, I do it. All the old SSH certs are invalidated, but users can get a new one through the usual automated flow.

Re: Tailscale SSH

#89

Post by infogulch »

I'm very interested in Tailscale for both personal and business use-cases, but I'm rather put off by the stark centralization of offered identity providers: Microsoft, Github (Microsoft), Google, okta (?). What are the chances that Tailscale would offer authentication using decentralized/self-hosted identity providers like Ory ( https://www.ory.sh/ )?

Re: Tailscale SSH

#90

Post by outworlder »

tptacek wrote: post #68
danousna wrote: post #13

What would be the advantages of this compared to say Teleport ? Teleport is working fine for us, but I wonder if the network based approach (+ wireguard) of Tailscale would be better in terms of network redundancy ?

The big thing you get with Teleport that you don't yet get with Tailscale --- apart from entirely owning the source of truth for SSH authentication on your own infra, which is a very minor issue for almost everyone but is a major issue for some people --- is that Teleport gives you transcript-level audit logs of your SSH sessions. Teleport also has that web-based SSH console (it's one of the better web-based consoles…

> is that Teleport gives you transcript-level audit logs of your SSH sessions

That is extremely valuable. Just in case 'transcript-level audit' didn't sink in, it's a session recording – not only you can see the all keystrokes typed but you can see all the outputs, the whole state. Someone doing a TOP command for an hour? You can watch the same thing later.

Think asciinema (https://asciinema.org/).

Post reply on HN