Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

Comments

• ScreenReader Member

  3:16AM

  this is the most unorganic "vpn" software i've seen so far, the astroturfing on self-hosted community both on reddit or orange reddit are something else. I have no idea why would anyone use this thing to manage their ssh access (adding attack vector) instead of disabling it, use your sshd that you already put your keys on and you can access them using your private tailscale IP anyway.

  it's only called a "flaw" because it got caught.
• op23 Member

  3:22AM

  @ScreenReader said:
  this is the most unorganic "vpn" software i've seen so far, the astroturfing on self-hosted community both on reddit or orange reddit are something else. I have no idea why would anyone use this thing to manage their ssh access (adding attack vector) instead of disabling it, use your sshd that you already put your keys on and you can access them using your private tailscale IP anyway.

  it's only called a "flaw" because it got caught.

  It’s user friendly, and so easy that in a little bit of setup I was able to run my iPhone app with a gRPC backend on same tunnel with least headache.

  Hope they patch this soon, the OP could have also mentioned that the attack requires access to at least another device using Tailscale and it requires port forwarding which is not default afaik.
• OttoWood Member

  3:55AM edited 4:03AM

  @ScreenReader said:
  orange reddit

  What is orange Reddit?

  use your sshd

  I 100% agree.

  @op23 said:
  the OP could have also mentioned that the attack requires access to at least another device using Tailscale

  The title of this thread specifically mentions it needs a compromised device.

  and it requires port forwarding which is not default afaik.

  I don't use Tailscale at all, so can't confirm this. The source code checks whether AllowLocalPortForwarding and AllowRemotePortForwarding are set to true when activating the SSH function. The source code doesn't indicate default behaviour; BUT runtime dumps from bug reports suggest it might be on by default (take this info with a grain of salt). As the article mentions, if you use headscale then it's always on.
• op23 Member

  4:02AM

  @OttoWood said:

  @ScreenReader said:
  orange reddit

  What is orange Reddit?

  use your sshd

  I 100% agree.

  @op23 said:
  the OP could have also mentioned that the attack requires access to at least another device using Tailscale

  The title of this thread specifically mentions it needs a compromised device.

  and it requires port forwarding which is not default afaik.

  I don't use Tailscale at all, so can't confirm this. The source code checks whether AllowLocalPortForwarding and AllowRemotePortForwarding are set to true when activating the SSH function. The source code doesn't indicate default behaviour; BUT source dumps from bug reports suggest it might be on by default (take this info with a grain of salt). As the article mentions, if you use headscale then it's always on.

  Sorry my bad, yes you did mention in title.

  Checked the config on my PC and the flags are set to false. So that’s a plus at least.

  May be I will finally just go towards plain wire guard tinkering to enable what I need, but Tailscale is too damn nice lol.
• ScreenReader Member

  4:04AM

  @OttoWood said:

  @ScreenReader said:
  orange reddit

  What is orange Reddit?

  news.ycombinator

  Thanked by 1OttoWood