6 ms·

Did Tailscale introduce any security measures to their Coordination Server? Last I checked the coordination server is basically controlled by them and they coul

by mikevm 5y ago

Did Tailscale introduce any security measures to their Coordination Server? Last I checked the coordination server is basically controlled by them and they could easily just insert any of their own pubkeys and infiltrate your network. Even supporting WireGuard's Share Secret feature would be a start. As long as that's not addressed, not a chance in hell I'm going to deploy this.

deleted 5y ago
[deleted]
iFreilicht 5y ago
You can host your own coordination server, right?
- mikevm 5y ago
  Last I checked you cannot.
  - Nekit1234007 5y ago
    https://github.com/juanfont/headscale https://github.com/juanfont/headscale
    - mikevm 5y ago
      This is a 3rd party implementation. The official coordination server is not open source.
      - Nekit1234007 5y ago
        But you can host your own coord server, right?
        tyingq 5y ago
        It does look like it's missing some functionality that could be key (DNS, ACLs, namespaces). But, pretty neat that it exists, given "The purpose of writing this was to learn how Tailscale works".
        juanfont 5y ago
        We do have support for separate namespaces/tailnets, and we will be adding ACLs soon... PRs welcome :)
kawsper 5y ago
I have been looking for a more user-friendly setup for our company, we're currently using OpenVPN with Viscosity as a client. Tailscale was on the list for services to check, but if what you say is true, then I will look elsewhere.
- cpach 5y ago
  It’s also possible to use Wireguard without Tailscale.
  - mikevm 5y ago
    Or https://www.zerotier.com/ https://www.zerotier.com/
- arthurcolle 5y ago
  I highly recommend you check out ZeroTier. I've found WireGuard setup to be non-trivial and extremely error-prone, but with ZeroTier there's a web UI that you can add new services and machines from, all as one logical "network" I believe that the free tier is capable of running clusters of up to 50 machines. Really nice to use + truly trivial to set up.
  - deskamess 5y ago
    Do they integrate with IdP like Okta or do they have MFA? I am looking to qualify RDP access to various systems in the network w/IdP + MFA.
- mananaysiempre 5y ago
  For a FOSS solution (now that ZeroTier no longer is one), there’s Nebula, but you’ll have to operate your own central node. That’s nothing compared to maintaining the hell that is IPsec or even OpenVPN, though. Even bare Wireguard is a joy to set up, to my endless surprise, if you’re fine administering things as a traditional small-scale LAN, manual routing and all.
  - 5y ago
ukj 5y ago
Ahhh, the illusion of control. The fine line between prudence and paranoia. Do you also manufacture your own silicon in fear of being owned by your hardware vendors? Write all your own software? In fear of being owned by zero days in open source?
- antonvs 5y ago
  Those aren't really comparable situations to an externally hosted "coordination server" which explicitly allows a third party to control access to your internal networks. Security breaches happen every day, with serious consequences. These are real threats, and there are ways to mitigate against them. A target like that coordination server is particularly risky because, as we saw with the massive Solarwinds attack, attackers will look for and expend effort to compromise the most attractive targets, and that's a particularly juicy one. Dismissing such threats with false equivalences is a pretty good way to find yourself on the wrong side of a security breach.
  - ukj 5y ago
    They are exactly the same situation. When you run other people's code you are explicitly giving them control over your stuff. Ken Thompson pointed this out back in 1984. ( https://dl.acm.org/doi/pdf/10.1145/1283920.1283940 https://dl.acm.org/doi/pdf/10.1145/1283920.1283940 ) Either you trust the entity whose code you are consuming or you don't. Do you trust WireGuard to not get owned via a supply chain attack? Like Solar Winds. Do you trust any open source project you currently use to be free from bugdoors? Like University of Minnesota recently demonstrated by submitting intentionally-vulnerable patches to the Linux kernel.
    - jerf 5y ago
      There a significant difference. When I run code, it is isolated from the people who wrote it. Someone providing a github library I compile into my code has no ability to later unilaterally come in and modify it. There is a gate where I have to ask them in, and I do tend to read the diffs first. There are only isolated windows of temporal vulnerability where I have to trust them, with mechanisms for dealing with that coherently. An always-on service is an ongoing, continuous trust relationship with continuous temporal vulnerability Consequently, while I can reasonably safely apply a lower bar of trust to libraries and code, someone asking to be continuously trusted must be held to a distinctly higher standard. It is can be valid to trust that as well, but you're operating from a crippled starting point for your security engineering if you don't see those as separate categories of issues to address.

by mikevm 5y ago

deleted 5y ago

[deleted]

iFreilicht 5y ago

You can host your own coordination server, right?

mikevm 5y ago
Last I checked you cannot.
- Nekit1234007 5y ago
  https://github.com/juanfont/headscale https://github.com/juanfont/headscale
  - mikevm 5y ago
    This is a 3rd party implementation. The official coordination server is not open source.
    - Nekit1234007 5y ago
      But you can host your own coord server, right?
      - tyingq 5y ago
        It does look like it's missing some functionality that could be key (DNS, ACLs, namespaces). But, pretty neat that it exists, given "The purpose of writing this was to learn how Tailscale works".
        juanfont 5y ago
        We do have support for separate namespaces/tailnets, and we will be adding ACLs soon... PRs welcome :)

kawsper 5y ago

I have been looking for a more user-friendly setup for our company, we're currently using OpenVPN with Viscosity as a client. Tailscale was on the list for services to check, but if what you say is true, then I will look elsewhere.

cpach 5y ago
It’s also possible to use Wireguard without Tailscale.
- mikevm 5y ago
  Or https://www.zerotier.com/ https://www.zerotier.com/
arthurcolle 5y ago
I highly recommend you check out ZeroTier. I've found WireGuard setup to be non-trivial and extremely error-prone, but with ZeroTier there's a web UI that you can add new services and machines from, all as one logical "network" I believe that the free tier is capable of running clusters of up to 50 machines. Really nice to use + truly trivial to set up.
- deskamess 5y ago
  Do they integrate with IdP like Okta or do they have MFA? I am looking to qualify RDP access to various systems in the network w/IdP + MFA.
mananaysiempre 5y ago
For a FOSS solution (now that ZeroTier no longer is one), there’s Nebula, but you’ll have to operate your own central node. That’s nothing compared to maintaining the hell that is IPsec or even OpenVPN, though. Even bare Wireguard is a joy to set up, to my endless surprise, if you’re fine administering things as a traditional small-scale LAN, manual routing and all.
- 5y ago

ukj 5y ago

Ahhh, the illusion of control. The fine line between prudence and paranoia. Do you also manufacture your own silicon in fear of being owned by your hardware vendors? Write all your own software? In fear of being owned by zero days in open source?

antonvs 5y ago
Those aren't really comparable situations to an externally hosted "coordination server" which explicitly allows a third party to control access to your internal networks. Security breaches happen every day, with serious consequences. These are real threats, and there are ways to mitigate against them. A target like that coordination server is particularly risky because, as we saw with the massive Solarwinds attack, attackers will look for and expend effort to compromise the most attractive targets, and that's a particularly juicy one. Dismissing such threats with false equivalences is a pretty good way to find yourself on the wrong side of a security breach.
- ukj 5y ago
  They are exactly the same situation. When you run other people's code you are explicitly giving them control over your stuff. Ken Thompson pointed this out back in 1984. ( https://dl.acm.org/doi/pdf/10.1145/1283920.1283940 https://dl.acm.org/doi/pdf/10.1145/1283920.1283940 ) Either you trust the entity whose code you are consuming or you don't. Do you trust WireGuard to not get owned via a supply chain attack? Like Solar Winds. Do you trust any open source project you currently use to be free from bugdoors? Like University of Minnesota recently demonstrated by submitting intentionally-vulnerable patches to the Linux kernel.
  - jerf 5y ago
    There a significant difference. When I run code, it is isolated from the people who wrote it. Someone providing a github library I compile into my code has no ability to later unilaterally come in and modify it. There is a gate where I have to ask them in, and I do tend to read the diffs first. There are only isolated windows of temporal vulnerability where I have to trust them, with mechanisms for dealing with that coherently. An always-on service is an ongoing, continuous trust relationship with continuous temporal vulnerability Consequently, while I can reasonably safely apply a lower bar of trust to libraries and code, someone asking to be continuously trusted must be held to a distinctly higher standard. It is can be valid to trust that as well, but you're operating from a crippled starting point for your security engineering if you don't see those as separate categories of issues to address.