Tailscale SSH - Hackdot

Re:Tailscale SSH by tptacek on Wednesday June 22, 2022 @08:57PM (#31843887)

If you're not already using Tailscale, with your security or IT teams controlling it, it would be malpractice to allow it on a controlled network. No competent security team allows people to introduce their own VPNs.

[ Parent | on HN ]

Re:Tailscale SSH by dekhn on Thursday June 23, 2022 @10:46AM (#31849839)

The way it works in enterprise that is principal engineers like me are generally given some freedom to explore new technologies responsibly. In my mind, that includes visiting the Tailscale website (which started being blocked by our IT yesterday) to gather information about whether this would be a good alternative technology for our research teams.

Now what I have to do is file a bunch of tickets and take a bunch of meetings to get a block removed from the overall site. Really, what I was trying to do is provide nformation to the Tailscale developers that enterprise already considers their website/product scary enough to do a whole block, and if they want to expand into enterprise, they may want to understand the reasons for that.

[ Parent | on HN ]

Re:Tailscale SSH by growse on Thursday June 23, 2022 @03:27PM (#31854076)

> Now what I have to do is file a bunch of tickets and take a bunch of meetings to get a block removed from the overall site. Really, what I was trying to do is provide nformation to the Tailscale developers that enterprise already considers their website/product scary enough to do a whole block, and if they want to expand into enterprise, they may want to understand the reasons for that.

Not all large enterprises are this disfunctional. I'm sure Tailscale are doing just fine.

[ Parent | on HN ]

Re:Tailscale SSH by viraptor on Wednesday June 22, 2022 @10:31PM (#31844536)

Blocking the tailscale website has nothing to do with blocking the VPN. I know you're passionate about them, but I think you got baited here...

[ Parent | on HN ]

Re:Tailscale SSH by tptacek on Wednesday June 22, 2022 @10:33PM (#31844553)

Who’s talking about blocking a website?

[ Parent | on HN ]

Re:Tailscale SSH by sp332 on Wednesday June 22, 2022 @10:46PM (#31844632)

dekhn, three comment levels above yours.

[ Parent | on HN ]

Re:Tailscale SSH by tptacek on Wednesday June 22, 2022 @11:18PM (#31844819)

You're right. I guess my brain wouldn't let me process something as dumb as a corporate security control based on blocking a website to keep people from installing a binary.

Anyways, I'm just here to say, corporate security teams are definitely not OK with you doing a rogue Tailscale install, and that's as it should be.

[ Parent | on HN ]

Re:Tailscale SSH by cperciva on Wednesday June 22, 2022 @11:46PM (#31844975)

Anyways, I'm just here to say, corporate security teams are definitely not OK with you doing a rogue Tailscale install, and that's as it should be.

You might be shocked at how often I get "can you deploy a tarsnap server on port 443? My company's security team won't let me connect to your server on port 9279" requested.

I mean, it's trivial to bounce the TCP connection... but I'm not going to help subvert security policies.

[ Parent | on HN ]

Re:Tailscale SSH by lswank on Wednesday June 22, 2022 @11:38PM (#31844935)

I work for a Fortune 100 company and this is precisely what our corporate overlords do with non-approved VPN software. There are device management tools on every machine in the corporation to detect and block the software, but that isn't turned on. Just blocking the website. ¯\_(ツ)_/¯

[ Parent | on HN ]

Re:Tailscale SSH by atonse on Wednesday June 22, 2022 @09:14PM (#31844017)

Speaking of which, how would they detect it?

[ Parent | on HN ]

Re:Tailscale SSH by AviationAtom on Wednesday June 22, 2022 @09:26PM (#31844098)

Any good network security monitoring system should allow it to be fingerprinted in some manner, and if deep packet inspection is in use then it should be blocked outright.

[ Parent | on HN ]