News for hackers. Stuff that matters.

A comment on Tailscale SSH. Parent comment

Re:Tailscale SSH by soraminazuki on Wednesday June 22, 2022 @09:16PM (#31844037)
Double encryption should help as long as the Tailscale client installed on your own machines is safe. Without double encryption for SSH, Tailscale and your SSO provider can theoretically run commands on your machines without involving malicious client software. But that's not possible if you encrypt your SSH connection with your own keys.

Also for Linux, the Tailscale client is fully open source and I obtain the binary from the distro. I find that a bit reassuring.

[ Parent | on HN ]
Re:Tailscale SSH by jgeralnik on Thursday June 23, 2022 @01:40AM (#31845534)
But that's the thing - even with double encryption tailscale and your SSO can run commands on your machines

1) Run tailscale --ssh on your server 2) A malicious SSO or tailscale add a new machine to your network and update your ACL such that the new machine can connect to your server 3) ssh from the new machine to run code on your server

The fact that the connection between the malicious machine and your server is double encrypted doesn't affect the attack here at all

[ Parent | on HN ]
Re:Tailscale SSH by soraminazuki on Thursday June 23, 2022 @10:05AM (#31849296)
By double encryption, I mean using an SSH server other than "tailscale --ssh". No one except yourself can have SSH access if you disable Tailscale's builtin SSH server, use OpenSSH, and generate your own keys for authentication.
[ Parent | on HN ]
Re:Tailscale SSH by jgeralnik on Friday June 24, 2022 @01:23AM (#31858080)
Ah, I don't think that's exactly what this thread was about. Ignoring how authorization works, the question was whether there is an advantage to encrypting your commands again (via say ssh) vs. just sending them in plaintext under wireguard (via say rsh)
[ Parent | on HN ]