Comment by modeless
10 hours ago
They may not recommend disabling Tailscale SSH but I do. It interferes with sshd features and adds to your attack surface. Distribute your SSH keys the old-fashioned way and disable Tailscale SSH.
10 hours ago
They may not recommend disabling Tailscale SSH but I do. It interferes with sshd features and adds to your attack surface. Distribute your SSH keys the old-fashioned way and disable Tailscale SSH.
I make my sshd only listen on the Tailscale IP. Then I don’t even bother setting up SSH keys. I use password authentication, except on mobile where my password is too difficult to type with an onscreen keyboard.
As I understand it, that use case isn't impacted by these vulnerabilities since it's not using Tailscale SSH, just OpenSSH over Tailscale.