8 ms·
Tailscale SSH is now Generally Available
- f_gergo 3y agoIiuc, atm tailscale ssh X11 forwarding doesn't work.
- tylergetsay 3y agoyou also can't forward ports which kind of makes sense from their security model, but is annoying when wanting to use one host as a bastion
- ikiris 3y agoJust gonna note this is still a thing https://ssotax.org/ https://ssotax.org/
- deleted 3y ago[deleted]
- supermatt 3y agoAnd it also seems like its wrong (or outdated?), Given they offer "SSO with any IdP" on ALL plans, including the free (personal) one: https://tailscale.com/pricing https://tailscale.com/pricing
- mkl 3y agoIt says updated 2024-03-13 from source https://tailscale.com/pricing https://tailscale.com/pricing, but "SSO with any IdP" is in the Starter plan before that [edit: no, I'm wrong, it used to say "standard" not "any"]: https://web.archive.org/web/20240309045009/https://tailscale.com/pricing https://web.archive.org/web/20240309045009/https://tailscale... Are they talking about something different?
- orthoxerox 3y agoSSO Tax is usually about using your private SSO, not Google or GitHub. If they say "any IdP", then the data on ssotax must be out of date.
- ikiris 3y agoOh nice, I retract my complaint then if they've moved to actually supporting good security out of the box without an extra fee.
- catzkorn 3y agoHi! Tailscalar here. I posted to the OP, but just to flag this is correct. We removed our 'sso tax' a couple weeks ago from our pricing plans, and I released a blog today about it being removed entirely. Extremely happy it's gone!
- RockRobotRock 3y agoIs that really fair? SSO is free, but SCIM isn't.
- danmur 3y agoI don't get what's wrong with charging more for SSO? They're in the business of making money, and if you need SSO and you need their service you're more likely to have money. It's nothing to do with the feature itself.
- earnesti 3y agoI don't think there is anything wrong about it, but I think it is a good thing to be informed about it, especially for those involved with smaller businesses.
- danmur 3y agoI don't disagree, but I doubt anyone's going to use this website called the 'wall of shame' to get pricing info rather than look at the pricing page.
- michaelt 3y agoThe problem is we in the software industry are so used to getting handed everything for free that a lot of software developers don't even know how to get their employer to buy something. Every engineer in every other field of engineering knows exactly how to order things, and has access to a properly organised budget for doing so. You need electronic components? Custom-machined parts? Raw material like metal sheets? Nuts and bolts? Aluminium extrusion? Of course you pay for it - and the organisation's purchasing procedure is something you learn in your first week. We in the software industry, on the other hand, get free operating systems, free compilers, free IDEs, free databases, free libraries, free documentation and training, free support - pretty much free everything. So you can get surprisingly far in the industry without ever learning the difference between a quote and a proforma invoice - or how to explain to the boss why we should give JetBrains $50k per year in terms she'll understand and approve of. As such, when the people gifting us and our employers free stuff add a paid tier with features we want, but they charge money for it, it's an almighty inconvenience.
- ikiris 3y agoNo, this is nowhere close to it.
- robertlagrant 3y agoWhat feature should pay salaries, if any?
- paxys 3y agoNot sure what you are implying but Tailscale lets you sign in with Google, Microsoft, Apple, Github or a custom OIDC server on every plan.
- deleted 3y ago[deleted]
- catzkorn 3y agoHi! Tailscalar here. This is very topical for me! Over the past 3 weeks I've been working with internal stakeholders to remove our SSO tax - the sso tax is a pet hate of mine. A couple of weeks ago we removed it from our pricing plan after my proposal was approved, and today I released a blog on our website to announce it more widely: https://tailscale.com/blog/sso-tax-cut https://tailscale.com/blog/sso-tax-cut I knew of https://sso.tax https://sso.tax (which we are not listed on but I did include in my blog), but didn't know there was another website too!
- PhLR 3y agoSounds like Tailscale is now a candidate for the "Friends of SSO" list https://ssotax.org/friends-of-sso.html https://ssotax.org/friends-of-sso.html Respect for pushing that through the org!
- anonymous_union 3y ago[flagged]
- klausa 3y agoIt means it's out of "beta", or other kinds of limited release and can be used by anyone.
- leastangle 3y agoWe use Tailscale quite heavily and the SSH feature. Along with many other features, it is great. However, the article doesn't mention pricing, which for me personally seems quite high at $18/month/user. [1] [1] https://tailscale.com/pricing https://tailscale.com/pricing
- Chilinot 3y agoI dont know about the pricing. Over the last couple of months i have been investigating different alternatives for better access control to our internal resources. And Tailscale seems to be on the cheaper end compared to other offerings.
- rs_rs_rs_rs_rs 3y agoDamn, in beta it was available to all plans. Maybe in the future they'll make it available for Starter and Personal plan too.
- marcocampos 3y agoAccording to the post it’s available on Personal too.
- dilyevsky 3y agoWhich other vendors did you get quotes from? Genuinely curios. Ime they are very competitive on price compared to some others. One of my former gigs used a competitor (also a startup) that was 2x the price and offered way less flexible setup but our “architect” rushed it bc of the way he was. Other more established competitors were even more expensive
- wenyuanyu 3y agoHow does it compare with cloudflare's tunnels? [0] I have been using Cloudflare's cloudflared tunnels. It was great for tunneling ssh traffic behind firewalls. And it starts free. [0] https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ https://developers.cloudflare.com/cloudflare-one/connections...
- stavros 3y agoIt's very different, CF tunnel is a reverse proxy to your service, Tailscale SSH manages authentication to machines inside your VPN. I can't see any resemblance, personally.
- wenyuanyu 3y agoFirst of all, for CF, it manages the authentication part of ssh with SSO support (personally I used github) Secondly, it has clients (on iOS it is called Cloudflare One) which can act as a VPN service as well. You can access any IP addresses (if you setup the vpc correctly [0]) directly accessible to cloudflared daemons. [0] https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks/ https://developers.cloudflare.com/cloudflare-one/connections...
- redrove 3y agoClouflare Tunnels are generally used for http(s) traffic more so than SSH, this is just Tailscale's SSH offering. The equivalent http(s) side of things from Tailscale would be Tailscale Funnel [0], although it's incomplete since you can't BYO domain to TS Funnel. In essence, CF Tunnel = Tailscale Funnel w/ BYOD + Tailscale SSH [0] https://tailscale.com/kb/1223/funnel https://tailscale.com/kb/1223/funnel
- jgrahamc 3y agoCloudflare Tunnel can absolutely be used for more than HTTP(S): https://blog.cloudflare.com/ssh-raspberry-pi-400-cloudflare-tunnel-auditable-terminal https://blog.cloudflare.com/ssh-raspberry-pi-400-cloudflare-...
- fl7305 3y agoHow secure is Tailscale in general, and their new SSH offering? I assume the crypto is unbreakable for outside parties that just sniff the traffic along the way. But what if Tailscale gets hacked? Are my keys available there for someone else to connect into my network? How hard would it be for the hacker to add their own machine to my network?
- irusensei 3y agoTailscale uses the WireGuard protocol. About the question about Tailscale being hacked or injecting hosts in your network. With the default configuration yes. There is Tailscale lock https://tailscale.com/kb/1226/tailnet-lock https://tailscale.com/kb/1226/tailnet-lock In which you need to sign the devices participating in your network. The signing keys are in your device.
- fl7305 3y agoThanks! How much more cumbersome does the lock make it to use Tailscale?
- irusensei 3y agoNot much. You first add the host and then you need to either click the link that will open the Tailscale app to sign the host or you run a command. If you use Mullvad VPN you need to sign the Mullvad exit nodes. Just make sure to have more than one signing device in case something happens to your main computer.
- bananapub 3y agoTailscale is key distribution for Wireguard + ACLs + some proxying/auth things. if tailscale got completely owned then obviously an attacker can fuck with the keys, which is why they have this feature: https://tailscale.com/kb/1226/tailnet-lock https://tailscale.com/kb/1226/tailnet-lock
- aborsy 3y ago
- kulor 3y agoBravo to Alex in the embedded video for clearly explaining the benefits in an interesting way without being overly salesy. I get a genuine sense of enthusiasm from him.
- mthoms 3y agoAll of his Tailscale videos are fantastic. He had me up and running with TS very quickly and networking stuff is way out of my wheelhouse. Highly recommended.
- lucw 3y agoDoes anyone have experience with their VSCode extension, does it work just as well as the official SSH remote extension?
- nine_k 3y agoWhy does Tailscale need special handling for SSH? Tailscale gives you authorized connectivity between hosts, and DNS; won't it be sufficient to run plain sshd? (If wireguard-key-level auth were sufficient, even rlogin or netcat would be enough, because the transport is encrypted already.)
- deleted 3y ago[deleted]
- dijit 3y agoTailscale ssh is handling authentication for you so that you do not need to pass around authorized_keys to all hosts. :) It means you can configure/activate/deactivate peoples access centrally too.
- cynix 3y ago> you do not need to pass around authorized_keys to all hosts. But now I need to trust these random host keys, instead of a key signed by my SSH CA...
- zaphar 3y agoHow do you "untrust" a single person's key under this scheme? You would have to visit all of the machines and remove them from the authorized keys file.
- nixgeek 3y agoNot really, with an SSH CA you’re trusting the CA and not installing individual keys into authorized_keys files. Anything signed by the SSH CA will work for logins. To deal with the “untrust” issue it’s normal for operations with an SSH CA to rely on (very) short-lived certificates, meaning often issued and valid for < 24 hours (it’s configurable, I’ve seen this be as short as 30 minutes). Smallstep wrote a summary here which is pretty good — https://smallstep.com/blog/use-ssh-certificates/ https://smallstep.com/blog/use-ssh-certificates/
- frankjr 3y agoI'm sure it's very well done but is it a good idea to give a third party a full access to your infrastructure?
- dddw 3y agoI guess you don't give them your private keys
- mikeocool 3y agoI love Tailscale, it’s by far the best VPN I’ve used, and the easiest wireguard implementation to get up and running I’ve used. I can certainly see the value of this feature for some orgs, but it seems little scary to me. With this setup, if an attacker is able to compromise Tailscale and add a key to your tailnet, that person will immediately have access to your network AND shell access to all of your boxes, rather than just network access if you use Tailscale with vanilla ssh.
- heywoodlh 3y agoI feel the same way. I wish they offered a second factor for SSH auth — when I last looked, they didn’t. I also send myself notifications any time a failed or successful SSH login attempt occurs by tailing the ssh service with journalctl. When I last tried Tailscale SSH, it didn’t log anything to journalctl and so my self-notification via journalctl method did not work.
- luckman212 3y agodo you do this with cron, fail2ban, or some other mechanism?
- heywoodlh 2y agoSorry for the delay, just barely saw this! I use journalctl to follow the log. My NixOS module for it is here: https://github.com/heywoodlh/nixos-configs/blob/master/nixos/roles/security/sshd-monitor.nix https://github.com/heywoodlh/nixos-configs/blob/master/nixos... If that isn’t clear, let me know and I can send my Ansible example :) EDIT: To be more precise I set up the monitoring service as a systemd service
- bananapub 3y ago> if an attacker is able to compromise Tailscale and add a key to your tailnet that's why tailscale has https://tailscale.com/kb/1226/tailnet-lock https://tailscale.com/kb/1226/tailnet-lock > that person will immediately have access to your network AND shell access to all of your boxes it would be extremely weird and negligent to deploy Tailscale at a company and not have any ACLs.
- lsofzz 3y agobeep! Official GUI client missing for Linux.
- Nelkins 3y agoNot directly related to this, but I'm trying to migrate to Tailscale now from OpenVPN, and it doesn't seem like there's a way to use one "account" (for example, Google auth) for multiple tailnets. Our use case is to have the user be able to select whether they want to connect to staging or prod. Are people just doing this with time-based ACLs within the same tailnet? Curious if there's something more obvious.
- wrboyce 3y agoI think you could achieve this if you used GitHub for auth, create tailnets on two GitHub Orgs and it’ll ask you which one you want to login to with the net being org-name.github.
- jiveturkey 3y agoi guess commentors don’t have experience with both products but this fills in a gap for folks that might choose teleport instead
- nuker 3y agoFrom launch page: > This traffic is rerouted to an SSH service inside the Tailscale daemon instead of to your standard SSH server. Was their sshd code audited? This is a lot of trust to use different sshd imho.