3 ms·

I rolled out Tailscale for our network and loving it. "What happens next" is very well outlined in this article on their blog [1], and it's worth reading. In m

by e1g 5y ago

I rolled out Tailscale for our network and loving it. "What happens next" is very well outlined in this article on their blog [1], and it's worth reading. In my specific case, we were mainly on AWS and used Security Groups to control network access. "Allow SSH from these IPs, allow server connections between these EC2". This setup was fine for a small team, but the complexity grew exponentially. Alice just joined the company and started working from home with a dynamic IP - this messes up our allow-list based on static IPs. Then we started using Google Cloud, and guarding traffic between two VMs across two clouds is quite complex. Then we wanted to do automated deployments, so something from the outside needed to connect securely to our prod env. Using Tailscale eliminated an entire category of complexity around identifying & securing inbound network connections, even if we ignore the NAT traversal magic. It's now a standard part of our stack, and I'm feeling a lot more in control of our network comms with minimal overheads - which is critical as we can focus on shipping instead of orchestrating. [1] https://tailscale.com/blog/2021-05-life-of-a-packet/ https://tailscale.com/blog/2021-05-life-of-a-packet/ edit: P.S. I picked Tailscale over the rest (Zero Tier / Nebula) because of a) the incredible strength of the team and b) funding + focus on the business. They have world-class talent and significant resources dedicated to this problem, so I believe they will make better progress over the next three years than the "best-effort" alternatives.

jgilias 5y ago
Ok, this may be a very silly question. But here goes. In the above example, when Alice types `ssh alice.p.hacker@server102` and presses enter, is she now logged in? E.g., does tailscale takes care of having a user on the machine and assigning the known public key through some SAML/LDAP/PAM/sssd-ish magic? Or does Alice gets 'access denied', then calls the sysadmins who still need to make a user for her on `server102`? The second option would be understandable, but a bit of a bummer, as in that case the fancy RBAC rules have to be essentially recreated somewhere else for the application layer.
- e1g 5y ago
  Alice will not be logged in into the server. Tailscale allows Alice to merely connect to the IP/port, but whatever service is listening on that port still behaves as usual. So if you have an HTTP service that requires Basic auth, that's still required. If it's a MySQL server, still need an account there to login. If it's SSH, you still need a key/password - or whatever your SSH authentication mode is. Think of Tailscale like a "jet bridge" securely connecting a bunch of buildings - you can use it to walk up to the front door safely (and Tailscale ACL controls traffic inside the tunnels), but to get inside you still need a key for that door (or whatever your auth method is).
  - jgilias 5y ago
    Right, that's what I thought. This implies that you'd either need to recreate the access rules somewhere else for the application layer and use something like Teleport or some PAM server on top of Tailscale, or use some proverbial 'admin/pass123', if the Tailscale access guarantees feel strong enough. Thanks!
    - pbrumm 5y ago
      The tailscale client can be queried to convert from tailscale ip to email. This could be used to track who is using the VPN service and to sign them into the protected web app. Grafana allows header auth params for example

by e1g 5y ago

jgilias 5y ago

Ok, this may be a very silly question. But here goes. In the above example, when Alice types `ssh alice.p.hacker@server102` and presses enter, is she now logged in? E.g., does tailscale takes care of having a user on the machine and assigning the known public key through some SAML/LDAP/PAM/sssd-ish magic? Or does Alice gets 'access denied', then calls the sysadmins who still need to make a user for her on `server102`? The second option would be understandable, but a bit of a bummer, as in that case the fancy RBAC rules have to be essentially recreated somewhere else for the application layer.

e1g 5y ago
Alice will not be logged in into the server. Tailscale allows Alice to merely connect to the IP/port, but whatever service is listening on that port still behaves as usual. So if you have an HTTP service that requires Basic auth, that's still required. If it's a MySQL server, still need an account there to login. If it's SSH, you still need a key/password - or whatever your SSH authentication mode is. Think of Tailscale like a "jet bridge" securely connecting a bunch of buildings - you can use it to walk up to the front door safely (and Tailscale ACL controls traffic inside the tunnels), but to get inside you still need a key for that door (or whatever your auth method is).
- jgilias 5y ago
  Right, that's what I thought. This implies that you'd either need to recreate the access rules somewhere else for the application layer and use something like Teleport or some PAM server on top of Tailscale, or use some proverbial 'admin/pass123', if the Tailscale access guarantees feel strong enough. Thanks!
  - pbrumm 5y ago
    The tailscale client can be queried to convert from tailscale ip to email. This could be used to track who is using the VPN service and to sign them into the protected web app. Grafana allows header auth params for example