3 ms·

I love Tailscale, it’s by far the best VPN I’ve used, and the easiest wireguard implementation to get up and running I’ve used. I can certainly see the value o

I love Tailscale, it’s by far the best VPN I’ve used, and the easiest wireguard implementation to get up and running I’ve used. I can certainly see the value of this feature for some orgs, but it seems little scary to me. With this setup, if an attacker is able to compromise Tailscale and add a key to your tailnet, that person will immediately have access to your network AND shell access to all of your boxes, rather than just network access if you use Tailscale with vanilla ssh.

heywoodlh 2y ago
I feel the same way. I wish they offered a second factor for SSH auth — when I last looked, they didn’t. I also send myself notifications any time a failed or successful SSH login attempt occurs by tailing the ssh service with journalctl. When I last tried Tailscale SSH, it didn’t log anything to journalctl and so my self-notification via journalctl method did not work.
- luckman212 2y ago
  do you do this with cron, fail2ban, or some other mechanism?
  - heywoodlh 2y ago
    Sorry for the delay, just barely saw this! I use journalctl to follow the log. My NixOS module for it is here: https://github.com/heywoodlh/nixos-configs/blob/master/nixos/roles/security/sshd-monitor.nix https://github.com/heywoodlh/nixos-configs/blob/master/nixos... If that isn’t clear, let me know and I can send my Ansible example :) EDIT: To be more precise I set up the monitoring service as a systemd service
bananapub 2y ago
> if an attacker is able to compromise Tailscale and add a key to your tailnet that's why tailscale has https://tailscale.com/kb/1226/tailnet-lock https://tailscale.com/kb/1226/tailnet-lock > that person will immediately have access to your network AND shell access to all of your boxes it would be extremely weird and negligent to deploy Tailscale at a company and not have any ACLs.
- fsociety 2y ago
  Don’t need to add a key, if you have access to the network interface on a laptop or server you are effectively that entity. ACLs are just one level of defense, and iirc you can force re-auth on SSH connections but it certainly becomes a single point of compromise.
- mikeocool 2y ago
  Tailscale lock looks interesting -- I had not seen that before. ACLs still come down to "just trust tailscale is working as advertised." And while I generally do (I'm a happy user), if that last few years have shown anything, for the vast majority of companies/products, it's not if you get compromised, it's when. Given that I'd prefer to have multiple distinct layers between the internet and my boxes. Though definitely see the value in terms of being able to easily tie SSH access to ACLs and your SSO provider -- as with all things security it's a trade off between ease of use and locking everything down.

heywoodlh 2y ago

I feel the same way. I wish they offered a second factor for SSH auth — when I last looked, they didn’t. I also send myself notifications any time a failed or successful SSH login attempt occurs by tailing the ssh service with journalctl. When I last tried Tailscale SSH, it didn’t log anything to journalctl and so my self-notification via journalctl method did not work.

luckman212 2y ago
do you do this with cron, fail2ban, or some other mechanism?
- heywoodlh 2y ago
  Sorry for the delay, just barely saw this! I use journalctl to follow the log. My NixOS module for it is here: https://github.com/heywoodlh/nixos-configs/blob/master/nixos/roles/security/sshd-monitor.nix https://github.com/heywoodlh/nixos-configs/blob/master/nixos... If that isn’t clear, let me know and I can send my Ansible example :) EDIT: To be more precise I set up the monitoring service as a systemd service

bananapub 2y ago

> if an attacker is able to compromise Tailscale and add a key to your tailnet that's why tailscale has https://tailscale.com/kb/1226/tailnet-lock https://tailscale.com/kb/1226/tailnet-lock > that person will immediately have access to your network AND shell access to all of your boxes it would be extremely weird and negligent to deploy Tailscale at a company and not have any ACLs.

fsociety 2y ago
Don’t need to add a key, if you have access to the network interface on a laptop or server you are effectively that entity. ACLs are just one level of defense, and iirc you can force re-auth on SSH connections but it certainly becomes a single point of compromise.
mikeocool 2y ago
Tailscale lock looks interesting -- I had not seen that before. ACLs still come down to "just trust tailscale is working as advertised." And while I generally do (I'm a happy user), if that last few years have shown anything, for the vast majority of companies/products, it's not if you get compromised, it's when. Given that I'd prefer to have multiple distinct layers between the internet and my boxes. Though definitely see the value in terms of being able to easily tie SSH access to ACLs and your SSO provider -- as with all things security it's a trade off between ease of use and locking everything down.