Hacker News Reader

Comment by doublepg23 | Hacker News Reader

I’m a heavy Tailscale user, so I do trust them quite a bit, but I never used the Tailscale SSH feature. I feel like OpenSSH’s security record is pretty unbeatable, not sure why I’d swap over for such a security-sensitive tool.

View on HN

The SSH vulnerability here only applies if the attacker is already on the network. It violates your Tailscale ACLs, but it's not arbitrary external root ssh access. Arguably that's a more secure starting point than vanilla ssh to publicly accessible machine.

OTOH, if you run vanilla ssh on a publicly accessible machine where only port 22 is open, sshd only allows publickey-based authentication and the only accepted key types are FIDO2/U2F hardware-backed keys, it's probably more secure again (less attack surface).

Unless you're using short lived SSH CA certificates, SSH key access has only modest security. You would need to buttress it with TOTP 2FA or enforce Yubikey generation/storage of keys, neither of which are at all default.

Even then, it's obvious you are running SSH, and they can fingerprint the OS, and external logging shows which machines are connecting, and hence have said SSH keys. If they have SSH open they become targets; if they come from CGNAT, carriers can leak location via CGNAT behaviour.

In contrast tailscale makes this much harder.

With a plain VPN like WireGuard when they get access to your network, they don't have plain ssh, not to mention root ssh access to hosts. This is a serious issue.

Yeah pretty much just use tailscale as a vpn.. do one thing as they say.

I've used it before to access my tailnet machines through a browser on a machine I can't download software on.

I just don't use stranger's machines to access my personal stuff. Possibly compromised stranger's machines. I don't see the benefit about that, as I have more laptops than I need.

That's cool. Others are not like you and may have use/need of things that you have no use/need for is what I'm trying to communicate here.

I used it for a bunch of remote monitor boxes to have a way of centrally managing ssh access to things that were often on- and off-line. It was simple and convenient and access was easily revocable.

The advantage of tailscale ssh is that the machine doesn't need to have the ssh port open publicly.

Convenience for the most part but in general, I agree. I like having it as an option.

Reply on news.ycombinator.com