4 ms·
Alice will not be logged in into the server. Tailscale allows Alice to merely connect to the IP/port, but whatever service is listening on that port still beha
by e1g 5y ago
Alice will not be logged in into the server.
Tailscale allows Alice to merely connect to the IP/port, but whatever service is listening on that port still behaves as usual. So if you have an HTTP service that requires Basic auth, that's still required. If it's a MySQL server, still need an account there to login. If it's SSH, you still need a key/password - or whatever your SSH authentication mode is.
Think of Tailscale like a "jet bridge" securely connecting a bunch of buildings - you can use it to walk up to the front door safely (and Tailscale ACL controls traffic inside the tunnels), but to get inside you still need a key for that door (or whatever your auth method is).
- jgilias 5y agoRight, that's what I thought. This implies that you'd either need to recreate the access rules somewhere else for the application layer and use something like Teleport or some PAM server on top of Tailscale, or use some proverbial 'admin/pass123', if the Tailscale access guarantees feel strong enough. Thanks!
- pbrumm 5y agoThe tailscale client can be queried to convert from tailscale ip to email. This could be used to track who is using the VPN service and to sign them into the protected web app. Grafana allows header auth params for example