6 ms·

Is anyone using tailscale on an organizational level? I'm curious to hear about some of the use cases, and whether some companies and organizations are attempt

by ratg13 4y ago

Is anyone using tailscale on an organizational level? I'm curious to hear about some of the use cases, and whether some companies and organizations are attempting to adopt this instead of traditional VPN.

RL_Quine 4y ago
I would have loved this at a company a couple of years ago which was massively all in on Google Auth for literally everything. If you're fine with that being your concrete level of authentication for everything; internal tools, external tools, etc, then tailscale sort of just slots right in, and SSH makes it even more so. I would be very hesitant to build around this personally, hijacking Google accounts is already something pretty high value to a companies adversary, and using Tailscale and SSH like this turns it from a compromise of accounts indirectly through password resets into access to unlimited production machines, internal services, etc. It feels almost layer violating to have a soft social login through Google, that gets persisted in every Chrome browser and logged into on every employees phones also directly control SSH, but maybe that's just me.
- zikduruqe 4y ago
  Then host your own Auth server - https://github.com/juanfont/headscale https://github.com/juanfont/headscale
soSadm4n 4y ago
One of my clients, an industrial/commercial property realtor (to contextualize the environment; we’re not talking military secrets here), uses it. Day to day I interact with it like any other VPN client except I auth via the Google workspace account they gave me. It’s Tailscale, or hosted OpenVPN and cross your fingers they’re not snooping, or DIY Wireguard or OpenVPN and all the usual ups and downs of DIY. Software based infra is out of the unknown unknowns era these days and years of rising usability expectations means Oracle level nightmares to deal with do not gain enough momentum to survive anymore. Tailscale is plenty easy to deal with. The only consideration is do you believe your traffic is really secure? Otherwise “it just works” like anything else these days. That said, my project for them is deprecating the infra accessed via Tailscale (24/7 EC2 running web dashboards). The already Dockerized dashboards will run locally now and use an API to retrieve the data. Real people directly in your infra is probably best avoided.
- freeplay 4y ago
  > It’s Tailscale, or hosted OpenVPN and cross your fingers they’re not snooping... The "cross your fingers they're not snooping" applies to Tailscale as well.
  - soSadm4n 4y ago
    That’s what I meant.
- lupire 4y ago
  > or DIY Wireguard or OpenVPN What is I that YD?
- dx034 4y ago
  > Real people directly in your infra is probably best avoided. But I've yet to see a company where no one ever needs to ssh into a server. Using these ACLs to give a contractor access (and even visibility) to only the servers they're supposed to see is probably a big advantage over OpenVPN, where a contractor automatically becomes part of the inner network and can theoretically see all machines?
mdeeks 4y ago
We just adopted it to consolidate multiple different OpenVPN installations. Why? * The Tailscale clients are dead simple and good quality (but not perfect). OpenVPN clients for mac and iOS are pretty bad. Onboarding OpenVPN users was a large document that generated a lot of questions and support issues. Tailscale onboarding is about two minutes for most users and we had nearly no support requests rolling it out widely to our company. * Tying OpenVPN to Okta is a truly terrible experience. Users would login with their Okta creds and a push would silently go to their devices. If they didn't know to check their phone it would just fail to login. Alternatively you can paste your TOTP code after your password. Yes, really. * We don't have to manage or debug anything related to LDAP. * Maintenance on our side is extremely minimal. Just install subnet routers (<10 lines of bash) and put our ACLs in source control. * We no longer have to tell users to logout and login to another VPN to get to certain resources. We just grant them access and suddenly they can reach what they need. ACLs are amazing and super easy to script, audit, and test. * Split DNS that actually works on all operating systems. For private domain A, query this resolver (over the wireguard link), for private domain B, query this other resolver. * I rolled it out as a PoC to all of our major VPCs in a day. The bad? It's still a young product and is missing features and has some warts. * Notifications on macOS that you need to relogin are just plain broken (they know and are working on it). * We're currently battling issues with network resets due to what looks like a client bug when you have lots of users. * No access to audit logs yet * You can't restrict people from using exit nodes * No good way to canary changes to your user population. Any mistake in the UI instantly breaks everyone.
- jaywalk 4y ago
  > Users would login with their Okta creds and a push would silently go to their devices. If they didn't know to check their phone it would just fail to login. How would users not know to check their phone? They had to specifically set up this MFA method.
  - mdeeks 4y ago
    Because they didn't specifically set it up. That is just how Okta MFA over LDAP works: https://help.okta.com/en-us/Content/Topics/Directory/LDAP-interface-MFA.htm https://help.okta.com/en-us/Content/Topics/Directory/LDAP-in... Also people just forget. Some people may only need the VPN once per month and in that time they forget about this weird login flow. They just assume they typed their password wrong or that they lost permissions to the VPN or something.

by ratg13 4y ago

RL_Quine 4y ago

I would have loved this at a company a couple of years ago which was massively all in on Google Auth for literally everything. If you're fine with that being your concrete level of authentication for everything; internal tools, external tools, etc, then tailscale sort of just slots right in, and SSH makes it even more so. I would be very hesitant to build around this personally, hijacking Google accounts is already something pretty high value to a companies adversary, and using Tailscale and SSH like this turns it from a compromise of accounts indirectly through password resets into access to unlimited production machines, internal services, etc. It feels almost layer violating to have a soft social login through Google, that gets persisted in every Chrome browser and logged into on every employees phones also directly control SSH, but maybe that's just me.

zikduruqe 4y ago
Then host your own Auth server - https://github.com/juanfont/headscale https://github.com/juanfont/headscale

soSadm4n 4y ago

One of my clients, an industrial/commercial property realtor (to contextualize the environment; we’re not talking military secrets here), uses it. Day to day I interact with it like any other VPN client except I auth via the Google workspace account they gave me. It’s Tailscale, or hosted OpenVPN and cross your fingers they’re not snooping, or DIY Wireguard or OpenVPN and all the usual ups and downs of DIY. Software based infra is out of the unknown unknowns era these days and years of rising usability expectations means Oracle level nightmares to deal with do not gain enough momentum to survive anymore. Tailscale is plenty easy to deal with. The only consideration is do you believe your traffic is really secure? Otherwise “it just works” like anything else these days. That said, my project for them is deprecating the infra accessed via Tailscale (24/7 EC2 running web dashboards). The already Dockerized dashboards will run locally now and use an API to retrieve the data. Real people directly in your infra is probably best avoided.

freeplay 4y ago
> It’s Tailscale, or hosted OpenVPN and cross your fingers they’re not snooping... The "cross your fingers they're not snooping" applies to Tailscale as well.
- soSadm4n 4y ago
  That’s what I meant.
lupire 4y ago
> or DIY Wireguard or OpenVPN What is I that YD?
dx034 4y ago
> Real people directly in your infra is probably best avoided. But I've yet to see a company where no one ever needs to ssh into a server. Using these ACLs to give a contractor access (and even visibility) to only the servers they're supposed to see is probably a big advantage over OpenVPN, where a contractor automatically becomes part of the inner network and can theoretically see all machines?

mdeeks 4y ago

We just adopted it to consolidate multiple different OpenVPN installations. Why? * The Tailscale clients are dead simple and good quality (but not perfect). OpenVPN clients for mac and iOS are pretty bad. Onboarding OpenVPN users was a large document that generated a lot of questions and support issues. Tailscale onboarding is about two minutes for most users and we had nearly no support requests rolling it out widely to our company. * Tying OpenVPN to Okta is a truly terrible experience. Users would login with their Okta creds and a push would silently go to their devices. If they didn't know to check their phone it would just fail to login. Alternatively you can paste your TOTP code after your password. Yes, really. * We don't have to manage or debug anything related to LDAP. * Maintenance on our side is extremely minimal. Just install subnet routers (<10 lines of bash) and put our ACLs in source control. * We no longer have to tell users to logout and login to another VPN to get to certain resources. We just grant them access and suddenly they can reach what they need. ACLs are amazing and super easy to script, audit, and test. * Split DNS that actually works on all operating systems. For private domain A, query this resolver (over the wireguard link), for private domain B, query this other resolver. * I rolled it out as a PoC to all of our major VPCs in a day. The bad? It's still a young product and is missing features and has some warts. * Notifications on macOS that you need to relogin are just plain broken (they know and are working on it). * We're currently battling issues with network resets due to what looks like a client bug when you have lots of users. * No access to audit logs yet * You can't restrict people from using exit nodes * No good way to canary changes to your user population. Any mistake in the UI instantly breaks everyone.

jaywalk 4y ago
> Users would login with their Okta creds and a push would silently go to their devices. If they didn't know to check their phone it would just fail to login. How would users not know to check their phone? They had to specifically set up this MFA method.
- mdeeks 4y ago
  Because they didn't specifically set it up. That is just how Okta MFA over LDAP works: https://help.okta.com/en-us/Content/Topics/Directory/LDAP-interface-MFA.htm https://help.okta.com/en-us/Content/Topics/Directory/LDAP-in... Also people just forget. Some people may only need the VPN once per month and in that time they forget about this weird login flow. They just assume they typed their password wrong or that they lost permissions to the VPN or something.