One of the benefits of working at Tailscale is that I get a sneak preview of the new features which are going to be rolled out.
I decided to set up Tailscale SSH on my two cloud servers. For any kind of system administration tasks, I require a cup of tea, so here was my process:
- Put the kettle on to boil, just a half-litre of water as I’m only making one cup of tea, and that’s the minimum amount for my kettle.
- While that’s boiling, I edited my Tailscale ACLs – If you’ve never edited the default ACLs, an entry will be added automatically that allows users to access their own machines if those machines are using Tailscale SSH.
"ssh": [
{
"action": "accept", //just let them in without reauthenticating
"src": ["autogroup:members"], //anyone on my tailnet
"dst": ["tag:servers"], //any device tagged server
"users": ["autogroup:nonroot"], //login as any user other than root
},
],
- Kettle hasn’t boiled yet, so I logged in to the two servers and ran `tailscale up –ssh` along with existing flags they had set.
- Kettle is ready – I poured it and set a timer for 4 minutes, which is the ideal time for a cup of Bewlies to steep. Bewlies being (I’m told) the side of the Irish Tea Conflict that our family stays on. The family has strong opinions on Barry’s vs Bewlies.
- Logged into DigitalOcean console and set a firewall rule on my droplet to block port 22.
- Logged into Vultr console, and set a firewall rule to block port 22 and assigned it to my instance.
- Ran ssh user@server1 from another machine on my tailnet, it worked. Tried user@server2, that worked as well.
- Waited another minute for my tea to finish steeping. I take it with no milk and no sugar. Just tea.
So I have a secure ssh connection to my production and development servers in less time than it took to make a cup of tea.
I can also change the action line in the ACL to “action”: “check” to force me to reauth through my identity provider when I want to establish the first ssh connection of the day. I don’t have to distribute or rotate private keys, I don’t have to worry about brute force attacks, since port 22 is not open to the internet.
Like the broader Tailscale experience, it just works.
