points by InsidiousWombat 1 day ago | 0 comments
sounds like just adding complexity over traditional method of OpenSSH + key distribution (either via configuration management or ldap)
and now, bugs
[–] selfmodruntime 1 day ago
[–] ferngodfather 1 day ago
You just need to implement an SSH CA. You can roll your own. Vault has an enterprise one. StepCA is suitable for smaller orgs.
All the benefit of the core SSH protocol as it's just key signing. It's honestly underrated.
[–] selfmodruntime 23 hours ago
How does having an SSH CA help you roll out detailed access to hosts/ports/services with fine grained permissions via access control lists derived from your identity provider? How do you make sure you're giving out least privileges with a compliant onboarding/offboarding and audit process? That is where the real meat is.
If you've solved all these problems yourself at your org: congrats, you re-implemented Tailscale with a bespoke solution that takes orders of magnitudes more $ to maintain and audit regularly than just buying an industry trusted solution.
Tailscale is, all things concerned, really cheap. It costs less at my large org than a single engineer. Doing it ourselves would take a team. Maybe two. Once again, HM primarily comments from a naive engineer's perspective, not from a leadership view.
[–] waynesonfire 1 day ago
yep, this was obvious from day one.
I work at a finance org with hundreds of engineers and thousands of technical users. You cannot be compliant with finance compliance frameworks using OpenSSH without audits and traceability and some source of identity management. That is exactly what Tailscale (or an alternative product) provides.
> and now, bugs
If you do it yourself, you now own that software entirely. Your comment lacks understanding of the complexity of real world scenarios.