2 ms·

Identifying a (prospective) user by their network origin? This must be that "zero trust" I've been hearing about, yes?

• lmm 4y ago
  Meh, it's a VPN and they're apparently enforcing good authentication at that level. I still favour treating the network as public and doing real TLS (because your services want to do that anyway), but single sign on is definitely what you want, and if it were Kerberos or something in place of Tailscale then the PAM side of things would be more or less the same (other than not having to reinvent the wheel, because PAM for Kerberos has already been implemented).
  • themoonisachees 4y ago
    The overall idea isn't that bad because tailscale basically already authes you on the network level, and in the kinds of infras this is for, this means you are already behind like 5 VPNs. I agree that automatically authing without user input is a bit much (eg worms) but tailscale has support for recieving and handling a "are you sure you want to conect to x" confirmation on the authentication source, it's just a matter of actually using it.