I can certainly see the value of this feature for some orgs, but it seems little scary to me. With this setup, if an attacker is able to compromise Tailscale and add a key to your tailnet, that person will immediately have access to your network AND shell access to all of your boxes, rather than just network access if you use Tailscale with vanilla ssh.
I also send myself notifications any time a failed or successful SSH login attempt occurs by tailing the ssh service with journalctl. When I last tried Tailscale SSH, it didn’t log anything to journalctl and so my self-notification via journalctl method did not work.
I use journalctl to follow the log. My NixOS module for it is here: https://github.com/heywoodlh/nixos-configs/blob/master/nixos...
If that isn’t clear, let me know and I can send my Ansible example :)
EDIT: To be more precise I set up the monitoring service as a systemd service
that's why tailscale has https://tailscale.com/kb/1226/tailnet-lock
> that person will immediately have access to your network AND shell access to all of your boxes
it would be extremely weird and negligent to deploy Tailscale at a company and not have any ACLs.
ACLs still come down to "just trust tailscale is working as advertised." And while I generally do (I'm a happy user), if that last few years have shown anything, for the vast majority of companies/products, it's not if you get compromised, it's when. Given that I'd prefer to have multiple distinct layers between the internet and my boxes.
Though definitely see the value in terms of being able to easily tie SSH access to ACLs and your SSO provider -- as with all things security it's a trade off between ease of use and locking everything down.