Tailscale SSH: Investigation and remediation update
tailscale.com245 points by figmert 9 hours ago
245 points by figmert 9 hours ago
Former tailscalar here and now someone managing tailscale at an org.
Having done my own review of the vulns and the fixes as they are landing in github, its pretty clear to me that this only affects situations where you use ACLs to permit ssh into a node (via tailscale ssh, not via opensshd), but dont give a path to sudoers/root.
If a user had no SSH access and/or connectivity to a vulnerable node, none of these vulns give them access.
However, if you have a vulnerable tailscaled and you give ssh access as some non-root account/privs, then yes, these vulns are relevant as theres now known privilege escalations that give access beyond some specific user account.
Not trying to play down the vuln (its important), but its not a free-for-all RCE that some ppl are acting like it is.
Calling it “tailworm” feels like alarmism to promote their find more.
Would only show worm behavior if machines within the tailnet had the right settings and also were members of other tailnets with those settings but then it would require someone in that tailnet to have another tailnet with the right settings…
It’s far fetched.
But a large portion of Tailscale users should be software engineering professionals, so a lot of the time, people use Tailscale just for SSH. I personally feel the impact is still quite big, especially since SSH leads directly to control of the server.
Do you use tailscale ssh but either dont have sudo, or don't permit login as root?
If all your tailscale-ssh ACLs allow you into an account with sudo, or allow you into root, theres no impact (you cant do anything with these vulns you couldnt do a month ago). Thats the nuance I'm trying to get across (admittedly my english is bad).
On the majority of nodes I provide Tailscale SSH access to, it's as root or a user with passwordless sudo. It's being used for admin access. So yeah, on those it doesn't matter as much.
There are a handful which restrict users to their own user accounts. But it's on dev server with friendly devs, so even for that use case it's not really the end of the world.
I'm sure our infosec folks are going to demand that we upgrade everywhere, however.
Engineers use vanilla SSH for SSH, Tailscale SSH is more focused on enterprise stuff where you can have an audit trail of all commands executed and enforce ACLs.
Tailscale SSH is different than doing SSH with Tailscale
Say more? I'd really like to understand the difference.
Basically you can use Tailscale for authnz instead of plain old keys and they add some extra logging and stuff [1]
I’ve used tailscale in quite a few jobs now and not one have we used tailscale ssh. Call us old school or whatever but at my current place of employment we provision ssh keys on a box with ansible and just use regular old ssh over the tailnet, not tailscale ssh
I use tailnet as a vpn and ssh into my server via the tailnet, but I dont use tailscale ssh the product. I think most people fall into this bucket.
Of course it should be taken seriously, but this topic is also piggy backing off of 7 days straight of non stop viral engagement farming on X after php2shell, where people we're farming likes by just posting stuff like
"YoU ThInK PhP2ShELl iS BaD JuST WaIt unTiL TaIlScAlE get HaCkED, ThIS JuSt ThE BeGiNNiNG oF a CybeR ReCKoNiNG"
To farm FUD from normies. Which of course led researchers who were working on tailscale vulns to take advantage of that algorithmic attention as well and talk about their research.
Like Im pretty sure we knew about this vuln for 3 days now, or atleast that it was responsibly disclosed (and not being used in the wild).
The attention this is getting is definately the product of some cringe viral snowball effect of the also rather benign p2pshell vuln.
It feels like there's a ton of AI influencer astroturfing going on, because its wildly easy to get engagement when you add the words "agent/ai" with "vulnerbility" and [insert popular service].
The vast majority of tailnets are just hobbyists on the generous free tier and probably don't use tailscale ssh, but rather ssh over a tailnet. Usually it's either just one person or a family sharing access to the tailnet. But for corporate accounts where ACLs are used for SSH yeah this is big.
I backup my different devices to my NAS. The user is a restricted backup user seeing only their own directory. I obviously don't want my torrent computer gets root on my NAS.
I personally use openssh, but someone else may use tailscale SSH.
I think this does downplay the vulnerability, since it assumes that teams using tailscale SSH have a lax security posture. I would hope that a security conscious team has accounts with least privilege available i.e. no root access. Please don't discount this critical vulnerability.
vaguely related - I want to make it easy for the llms to deploy and manage derp,tailgate etc with the hard requirement that you can continue to use the tailscale clients (very thankful to tailscale for making this so easy!):
I am fairly glad I have stuck with stock OpenSSH that ships with Linux. This incident proves I am glad with that choice.
Over the decades, I have maintained remote access through port forwarding on my router - at one point in 2008 I put SSH on port 80 so I could access it from the restricted wifi network at the hospital my grandmother was at. I have also used openvpn. I have also used cloudflare tunnels. But in the end, I always connect to hardened openssh with key only authentication.
I gather the bug allows people you've explicitly authorized to ssh into some account on your machine, to access more than that account can. So if you only use ssh yourself, or only give ssh keys for users with sudo, or only to people you trust not to exploit this, or if other vulnerabilities allow local shell users to escalate, or if you only use tailscale for port forwarding, then you're unaffected. Arguably even less exposed than a public openssh instance, though I can't say I have any issue doing that
I'm with you- the attack surface of openssh (and my trust in damien) is a better match imo
Doing ssh through port 80 or 53 or 443 is immediately flagged.
I understand port 443 is always opened but nowadays you can’t just run ssh traffic on 443 without it being detected as not being https
Flagged by who? The Internet Police? This comment is absurd.
By restricted networks, like hospitals, workplaces, schools, etc.
If their firewalls can detect it not being typical http/s traffic, they can block it.
I run WireGuard VPN on port 443 UDP. Many times I can connect to that from various public WiFi networks like coffee shops and public libraries. And then I ssh into my machines at home over my self-hosted VPN.
I’ve been hoping that HTTP3 adoption would make 443 UDP accessible from even more places. But maybe they already do the kind of thing you said for that too, looking at the traffic flow to determine that it is not HTTPS.
Weirdly sometimes there are WiFi networks where I am not able to connect to my WireGuard VPN on 443 UDP, but I can connect to servers over ssh on standard port 22 TCP. Perhaps they sometimes block all UDP traffic because they don’t want people to use BitTorrent etc, but one would think that with all the online meeting platforms that do video streaming there would be a lot of problems for people if all UDP traffic was blanket blocked.
I might eventually try out AmneziaWG instead of vanilla WireGuard, but at the moment I am fine not being able to Connect to my VPN sometimes. I only use it to connect to my other machines anyway, not as a VPN tunnel for my web browsing etc.
it's possible commercial routers such as the ones utilized by restaurants allow wireguard through these days? wireguard makes no effort to be stealthy when emitting.
some VPN apps bypass wireguard blocks automatically by using https tunnels and whatnot.
Does mosh help with it? Seems to be based on udp, and it looks good. I am not entirely sure if it helps the issue that you are talking about so hoping for someone more experienced to chime in
It worked in 2008 - 18 years ago. I have other options now like said cloudflare tunnel.
Naive. There's not much that prevents you from running ssh over https. Not even traffic patterns will give you up in the age of ubiquitous websockets and/or http2 streams.
Somehow I don't think it's a good idea to let Tailscale handle service authentication at all. It's supposed to be an additional security layer around existing infrastructure and services.
Letting Tailscale handle VPN and SSH at the same time is basically once again a single point of failure. Similar to exposing SSH directly to the internet.
There are too many features, and lines of code (probably more than OpenVPN). I'm pretty sure there are all kinds of zero days in it, with this attack surface and feature set.
I use it extensively, and I would rather pay them a fee if they could review thr code.
A possibility is a lock down mode, disabling risky features.
I just want a VPN for connrctiviy, no taildrop, taildrive, SSH, funnel, services, DNS, node sharing, ...They are disabled in my admin console, but the code runs on my devices and they can be enabled by mistake.
A question. Taildrop enables unauthenticated input and doesn't even obey ACLs. I'm not quite sure about this, but couldn't malware in a low trust device send a file to my Synology NAS, which will then automatically process it for indexing things like thumbnail, leading to potential code execution? Why doesn't it obey ACLs, and why isn't the recipient approval needed before the file exits the sender's device? I use tags, but I'm the owner not the tag.
Taildrop only works with devices that are yours, i.e. you can't send or receive anything from a device that's either tagged or owned by someone else. The only way malware is getting onto your NAS (via Taildrop) is if you're the one sending it there.
This is also how I feel about Tailscale and its popular alternatives. They do too much.
Does anyone know of a Tailscale alternative that sticks to the basics?
Something that’s just WireGuard but without the manual key exchange, and with Tailscale-like NAT hole-punching that falls back to using an oblivious relay?
https://github.com/netbirdio/netbird
Bit more than the basics, but not as much as tailscale.
I've been toying around with nebula, self host your lighthouse on a cheap VPS (which even if it gets hacked, the most it can do is lie about traffic, not lie about node certs). Basically you're just paying for the punchthrough (you may even be able to do some duckdns shenanigans?) The main issue is that updating nodes is a pain in the butt, which is the main advantage of tailscale IMO - centralized control plane. Keeps it simple.
I was trying to do some kind of insane workflow where you as the operator have a privileged hardware yubikey that admins the nodes when you plug it in, and the point is the nodes would self-propogate the changes outwards. I immidiately ran into classic issues with distributed security in distributed systems (even with only one central operator trying to admin everything). Tailscale is also a bit more secure in its oauth layer - with this architecture, you need to set proper time limits for expiring so one node compromise doesn't get access to the whole fleet. Couldn't really come up with better ideas than forcing the operator to reuse some kind of hardware key (the idea trying to be avoiding maintaining a cloud control plane as much as possible)
Fun foray but creating such a system requires a lot of expertise that I unfortunately lack
I used Nebula extensively.
I really liked it. I like the idea of embedding firewall rules in a certificate.
But , like you observed, it does not scale as well as tailscale.
You can run Tailscale in this mode just fine, or use Tailcat if you want.
The point, in the context of this thread, is that the attack surface is huge.
You could just use IPsec. It’s been probably 20 years but look into SWAN. It’s just a vpn in the vpn sense.
As a indie hacker(viber :) ) built mutiple tailscale based stuffs dated to the early days of tailscale, I like it but actually I do agree with you
There are too much features added now, perhaps some related to enterprise features because that must drive the revenue
Sometimes I am thiking perhaps they provide a light tailscale version but that seems not viable given the complexity now, headscale is great, but the OSS client still have plenty features, though they are gradually added feature based switch in the client source which I think is great, perhaps we can build a light version over it
This is also I do not think the tailscale-rs(which aim to rewrite tailscale with rust) will not be ready in a short time because too much (feature + cross platform) need to be tested
Re: Your question. Taildrop only works between devices in the same account. So if you don't put low trust devices in the same account as your NAS this is mitigated.
Tailnet owner may not trust all their devices to the same extent. Here is a concrete example.
I install tailscale on my cloud vps which I use for downloading torrents. I want my laptop to talk to this node, but I don't want this vm talk to my laptop, which is the whole purpose of ACLs. My ACL is deny by default, so that is great and easy to set. But now this node can still send arbitrary files to my laptop. If I don't remember to tag it, I'm vulnerable. If I do, there is still a window that this node can send me files until I tag it (I can't install tailscale to a tag).
Sending a file otherwise normally requires an app listening to a port, so taildrop permissions should be same as network permissions set by ACL.
BTW, last year or so tailscale advertised a position for someone to manage complexity of tailscale. Founder was talking about this issue. They seem to be aware of the problem.
Tags are a key part of managing ACLs. If you're concerned about an untrustworthy node on your tailnet, use tags. Even if you forget to add a tag to a newly added node (API keys can be set to automatically assume a tag when used fwiw), if your other devices are tagged then they're ineligible for taildrop.
(Tailscalar)
FWIW you can rebuild tailscaled to omit all the optional stuff:
https://github.com/tailscale/tailscale/tree/main/feature#mod...
e.g.
% go run ./cmd/featuretags --min
ts_omit_ace,ts_omit_acme,ts_omit_advertiseexitnode,ts_omit_advertiseroutes,ts_omit_androidbin,ts_omit_androiddns,ts_omit_appconnectors,ts_omit_aws,ts_omit_bakedroots,ts_omit_bird,ts_omit_c2n,ts_omit_cachenetmap,ts_omit_captiveportal,ts_omit_capture,ts_omit_cliconndiag,ts_omit_clientmetrics,ts_omit_clientupdate,ts_omit_cloud,ts_omit_colorable,ts_omit_completion,ts_omit_completion_scripts,ts_omit_conn25,ts_omit_connreject,ts_omit_dbus,ts_omit_debug,ts_omit_debugeventbus,ts_omit_debugportmapper,ts_omit_desktop_sessions,ts_omit_dns,ts_omit_dnsresolvecache,ts_omit_doctor,ts_omit_drive,ts_omit_exitnodehealth,ts_omit_favorites,ts_omit_flashappliance,ts_omit_gro,ts_omit_health,ts_omit_hujsonconf,ts_omit_identityfederation,ts_omit_ipnbus,ts_omit_iptables,ts_omit_kube,ts_omit_linkspeed,ts_omit_linuxdnsfight,ts_omit_listenrawdisco,ts_omit_logtail,ts_omit_nattraversal,ts_omit_netlog,ts_omit_netstack,ts_omit_networkmanager,ts_omit_oauthkey,ts_omit_osrouter,ts_omit_outboundproxy,ts_omit_peerapiclient,ts_omit_peerapiserver,ts_omit_portlist,ts_omit_portmapper,ts_omit_posture,ts_omit_qrcodes,ts_omit_relayserver,ts_omit_remoteconfig,ts_omit_resolved,ts_omit_routecheck,ts_omit_runtimemetrics,ts_omit_sdnotify,ts_omit_serve,ts_omit_serviceclientprefs,ts_omit_ssh,ts_omit_synology,ts_omit_syslog,ts_omit_syspolicy,ts_omit_systray,ts_omit_taildrop,ts_omit_tailnetlock,ts_omit_tap,ts_omit_tpm,ts_omit_tundevstats,ts_omit_udptransport,ts_omit_unixsocketidentity,ts_omit_useexitnode,ts_omit_useproxy,ts_omit_usermetrics,ts_omit_useroutes,ts_omit_wakeonlan,ts_omit_webbrowser,ts_omit_webclientI wouldn't be too surprised if tailscale has become a critical vector of the internet like cloudflare over the years as most ai companies seem to use it
Tailscale is best used as an additional layer of security rather than your only layer. I host everything behind tailscale as if it was the public internet, with proper authentication, https, etc.
So a failure in tailscale is not an issue on it's own because you'd then also have to find an exploit in what I'm actually hosting as well. Both of those things happening at the same time is much less likely.
Yet another single point of failure.
I don't see the reason for Tailscale instead of plain old simple Wireguard, it's WG under the hood anyway.
This exactly. All the extra stuff Tailscale provides buys convenience, but increases complexity, the attack surface of the stack, and adds commercial components to an otherwise open protocol. Call me old fashioned but I will keep managing keys manually.
They may not recommend disabling Tailscale SSH but I do. It interferes with sshd features and adds to your attack surface. Distribute your SSH keys the old-fashioned way and disable Tailscale SSH.
I make my sshd only listen on the Tailscale IP. Then I don’t even bother setting up SSH keys. I use password authentication, except on mobile where my password is too difficult to type with an onscreen keyboard.
As I understand it, that use case isn't impacted by these vulnerabilities since it's not using Tailscale SSH, just OpenSSH over Tailscale.
I like Tailascale as a product but I decided to move my homelab to plain WireGuard.
I wasn't using any of the additional features, I can get away with exposing a port on my router and I am changing devices rarely.
News like this make me happy I removed a lot of complexity and attack surface
> I can get away with exposing a port on my router
using wireguard is awesome, but I wouldn't say deploying and maintaining it lacks complexity exactly. and you didn't get rid of attack surface, you just made it your responsibility ;)
Always is your responsibility even with tailscale. Now it is his responsibility without tailscale.
Attack surface almost entirely goes away if you just require a good port knock first! I do that with my protection SSH servers and it works just fine. Also prevents anyone from knowing there even is an SSH server there. Or any server if it doesn't respond to pings either, and only uses reverse tunnels to accept public connections
Wireguard doesn’t respond to malformed packets or handshakes from unknown devices by design.
Is there a way to automate port knocks in your .ssh/config? I think that’s the main reason why I haven’t added it to my home server.
Technically you could use a ProxyCommand that does the knock and then runs nc to your target.
Port knocking is idiotic and amounts to Biff Tannen's "only I know how to start this car".
Dunno, in combination with having an up to date system following best practices, port knocking is probably going to save you when bots start scanning the internet with the next SSH 0day. Any amount of friction will cause the bots to move to the next IP address.
Just moving SSH off a default port gets you 98% there.
An attacker only has to get lucky once, so while I do put SSH on a non-default port too, it's not enough to avoid attacks on its own.
I mostly do it to quiet down the noise from the non-stop bots and scanners.
Being off the IPv4 space completely can be even more effective at that, FWIW, but that can have other issues. Only feasible for some!
LLMs port knock for redteam scans. Have for a long time.
My knock for SSH was 20 ports within 2 seconds. knockd resets the sequence if you hit any of its ports out of order. I generated the sequence with a CSPRNG.
That's not a knock, it's a password :-)
I mean, it suffers from some of the same issues with knocks, like being replayable. Wonder if anyone's come up with a TOTP-like thing for port knocks, where the code changes every little bit...