Hacker News

points by andix 2 days ago | 0 comments

Somehow I don't think it's a good idea to let Tailscale handle service authentication at all. It's supposed to be an additional security layer around existing infrastructure and services.

Letting Tailscale handle VPN and SSH at the same time is basically once again a single point of failure. Similar to exposing SSH directly to the internet.

[–] angry_octet 21 hours ago

SSH key management at scale is a pain. You have to use certificate based SSH at least. In contrast, tailscale allows you to manage remote login at the same layer as connectivity, with better logging and alerting.

[–] andix 17 hours ago

Sure, it is a difficult problem. But letting Tailscale handle both VPN and Auth at the same time might be a problem too.

[–] computerfriend 1 day ago

This was a decision I made in my old job, seems to be proved correct.

[–] JJJollyjim 2 days ago

I agree that this is how you should use it, but it is not "supposed" to be that in the sense that Tailscale strongly encourages you to use it in lieu of auth...