<story><title>Tailscale SSH is now Generally Available</title><url>https://tailscale.com/blog/tailscale-ssh-ga</url></story><parent_chain></parent_chain><comment><author>mikeocool</author><text>I love Tailscale, it’s by far the best VPN I’ve used, and the easiest wireguard implementation to get up and running I’ve used.&lt;p&gt;I can certainly see the value of this feature for some orgs, but it seems little scary to me. With this setup, if an attacker is able to compromise Tailscale and add a key to your tailnet, that person will immediately have access to your network AND shell access to all of your boxes, rather than just network access if you use Tailscale with vanilla ssh.</text></comment>
<story><title>Tailscale SSH is now Generally Available</title><url>https://tailscale.com/blog/tailscale-ssh-ga</url></story><parent_chain></parent_chain><comment><author>nine_k</author><text>Why does Tailscale need special handling for SSH?&lt;p&gt;Tailscale gives you authorized  connectivity between hosts, and DNS; won&amp;#x27;t it be sufficient to run plain sshd?&lt;p&gt;(If wireguard-key-level auth were sufficient, even rlogin or netcat would be enough, because the transport is encrypted already.)</text></comment>