3 ms·
Tailscale SSH's check mode (https://tailscale.com/kb/1193/tailscale-ssh/#configure-tailscale-ssh-with-check-mode https://tailscale.com/kb/1193/tailscale-ssh/#co
by mihaip 4y ago
Tailscale SSH's check mode (https://tailscale.com/kb/1193/tailscale-ssh/#configure-tailscale-ssh-with-check-mode https://tailscale.com/kb/1193/tailscale-ssh/#configure-tails...) is meant to address the issue of "rogue process starts an SSH connection". For truly sensitive applications, you can set the check period to be "1s" to always require it.
- amluto 4y agoHmm. If the problem is that Tailscale SSH doesn’t strongly associate the person authenticating with the connection being authenticated, asking the person to reauthenticate seems like a pretty weak solution.
- Jarwain 4y agoUnless I'm misunderstanding something, the check solution creates that strong association. Logging in gives you a link you have to go to and auth, authing let's your session connect. Disconnect, and you have to do this again. No check mode reuses the auth of the tailscale client, check mode authenticates the ssh connection itself
- amluto 4y agoAnd then that tailscale client is authorized to log in over ssh for however long the check lasts, and anyone else who can initiate a TCP session over the link can also get in.