4 ms·

I’m a heavy Tailscale user, so I do trust them quite a bit, but I never used the Tailscale SSH feature. I feel like OpenSSH’s security record is pretty unbeata

I’m a heavy Tailscale user, so I do trust them quite a bit, but I never used the Tailscale SSH feature. I feel like OpenSSH’s security record is pretty unbeatable, not sure why I’d swap over for such a security-sensitive tool.

jdiff 3mo ago
I've used it before to access my tailnet machines through a browser on a machine I can't download software on.
- Shorel 3mo ago
  I just don't use stranger's machines to access my personal stuff. Possibly compromised stranger's machines. I don't see the benefit about that, as I have more laptops than I need.
  - jdiff 3mo ago
    That's cool. Others are not like you and may have use/need of things that you have no use/need for is what I'm trying to communicate here.
isatty 3mo ago
Convenience for the most part but in general, I agree. I like having it as an option.
bakies 3mo ago
Yeah pretty much just use tailscale as a vpn.. do one thing as they say.
dgacmu 3mo ago
I used it for a bunch of remote monitor boxes to have a way of centrally managing ssh access to things that were often on- and off-line. It was simple and convenient and access was easily revocable.
OJFord 3mo ago
The SSH vulnerability here only applies if the attacker is already on the network. It violates your Tailscale ACLs, but it's not arbitrary external root ssh access. Arguably that's a more secure starting point than vanilla ssh to publicly accessible machine.
- semi-extrinsic 3mo ago
  OTOH, if you run vanilla ssh on a publicly accessible machine where only port 22 is open, sshd only allows publickey-based authentication and the only accepted key types are FIDO2/U2F hardware-backed keys, it's probably more secure again (less attack surface).
  - angry_octet 3mo ago
    Unless you're using short lived SSH CA certificates, SSH key access has only modest security. You would need to buttress it with TOTP 2FA or enforce Yubikey generation/storage of keys, neither of which are at all default. Even then, it's obvious you are running SSH, and they can fingerprint the OS, and external logging shows which machines are connecting, and hence have said SSH keys. If they have SSH open they become targets; if they come from CGNAT, carriers can leak location via CGNAT behaviour. In contrast tailscale makes this much harder.
- fodkodrasz 3mo ago
  With a plain VPN like WireGuard when they get access to your network, they don't have plain ssh, not to mention root ssh access to hosts. This is a serious issue.
theshrike79 3mo ago
The advantage of tailscale ssh is that the machine doesn't need to have the ssh port open publicly.

jdiff 3mo ago

I've used it before to access my tailnet machines through a browser on a machine I can't download software on.

Shorel 3mo ago
I just don't use stranger's machines to access my personal stuff. Possibly compromised stranger's machines. I don't see the benefit about that, as I have more laptops than I need.
- jdiff 3mo ago
  That's cool. Others are not like you and may have use/need of things that you have no use/need for is what I'm trying to communicate here.

isatty 3mo ago

Convenience for the most part but in general, I agree. I like having it as an option.

bakies 3mo ago

Yeah pretty much just use tailscale as a vpn.. do one thing as they say.

dgacmu 3mo ago

I used it for a bunch of remote monitor boxes to have a way of centrally managing ssh access to things that were often on- and off-line. It was simple and convenient and access was easily revocable.

OJFord 3mo ago

The SSH vulnerability here only applies if the attacker is already on the network. It violates your Tailscale ACLs, but it's not arbitrary external root ssh access. Arguably that's a more secure starting point than vanilla ssh to publicly accessible machine.

semi-extrinsic 3mo ago
OTOH, if you run vanilla ssh on a publicly accessible machine where only port 22 is open, sshd only allows publickey-based authentication and the only accepted key types are FIDO2/U2F hardware-backed keys, it's probably more secure again (less attack surface).
- angry_octet 3mo ago
  Unless you're using short lived SSH CA certificates, SSH key access has only modest security. You would need to buttress it with TOTP 2FA or enforce Yubikey generation/storage of keys, neither of which are at all default. Even then, it's obvious you are running SSH, and they can fingerprint the OS, and external logging shows which machines are connecting, and hence have said SSH keys. If they have SSH open they become targets; if they come from CGNAT, carriers can leak location via CGNAT behaviour. In contrast tailscale makes this much harder.
fodkodrasz 3mo ago
With a plain VPN like WireGuard when they get access to your network, they don't have plain ssh, not to mention root ssh access to hosts. This is a serious issue.

theshrike79 3mo ago

The advantage of tailscale ssh is that the machine doesn't need to have the ssh port open publicly.