5 ms·

> In theory, there is no path for a malicious Tailscale control plane to remotely execute code on your machine, unless you happen to run network services that a

> In theory, there is no path for a malicious Tailscale control plane to remotely execute code on your machine, unless you happen to run network services that are designed to allow it, like an SSH server with Tailscale-backed authentication. Now I feel less crazy for not using Tailscale SSH for similar reasons. I'd like to see a security evaluation of Tailscale, on a per feature basis. I'd like to see tailscaled run with far fewer privileges. Is there a Tailscale alternative that just does Wireguard + NAT traversal and doesn't try to do key management?

mikestaub 4y ago
I have a task to investigate https://www.firezone.dev https://www.firezone.dev
klabb3 4y ago
> Is there a Tailscale alternative that just does Wireguard + NAT traversal and doesn't try to do key management? I really wish there was a NAT traversal protocol or library that wasn't overly complex and focused on the 90% cases. It would help not just tailscale's but anyone building p2p tech.
- anderspitman 4y ago
  I believe libp2p has some NAT traversal stuff: https://docs.libp2p.io/concepts/nat/ https://docs.libp2p.io/concepts/nat/
  - freedinosaur 4y ago
    https://github.com/hyprspace/hyprspace https://github.com/hyprspace/hyprspace is built on top of that. It's remarkably simple: libp2p's DHT + libp2p's NAT punching + TUN device. I don't think it offers authn/authz, but that's fine: neither does my ISP. I just want SSH reachability.
- doublepg23 4y ago
  I wonder if IPv6 will ever be the “path of least resistance” vs. NAT punching.
  - api 4y ago
    You usually still have to punch with IPv6 as there is usually a stateful firewall in the way. You just get 100% success vs the 80-90% you get with V4 (and getting worse as CGN gets more common).
    - klabb3 4y ago
      This is correct. It's very annoying for any p2p like application, because the punching is a coordinated and time sensitive dance that just circumvents particular firewall bs. The firewall approach comes from this heavily flawed idea of the client initiated model of communication, extrapolated to client=consumers and server=service providers. It's just awful that the majority of the nodes on the internet aren't even reachable by default. Anyway, it would be much better to leave the socket APIs to handle this, possibly with OS safeguards and privileges. Writing p2p applications is analogous to being constantly protected "for your own good" by a guardian. /rant
      - adql 4y ago
        It's used like that because for a long time that approach worked. Users are terrible at securing their own machines and will click yes on anything just to get a thing they want and so putting stateful firewall allowing only outgoing connections was very effective measure. Much less relevant when now even windows comes with half decent, reasonable default firewall out of the box. Then again "user clicking allow button till it works" is still a problem.
      - robertlagrant 4y ago
        > It's just awful that the majority of the nodes on the internet aren't even reachable by default. Who'd pay for the routing? :)
infotogivenm 4y ago
Yep. Same boat. Absolutely zero interest in granting them ssh authZ; transport wrapping is all I want to outsource. Just deliver my bits and I pay you, tyvm. My suspicions have been proven correct here. Unfortunately reading about this remote RCE vector has me wondering whether I can use the product at all without all this bloat (taildrop, ssh, etc) affecting me. Going to have my team look at zerotier this week, I’ve heard a few ok things.
- andai 4y ago
  Top result on HN: https://news.ycombinator.com/item?id=28590625 https://news.ycombinator.com/item?id=28590625 "Zerotier: multiple vulnerabilities lead to private network access."
  - infotogivenm 4y ago
    Saw that when it came out, yikes, but here it makes my point for me. The zerotier software failed - as such you could (in the simplest terms) bypass the transport “firewall”. At no point could you execute code on my machines. At no point could you spoof any authorization layers outside of what’s required to reach my ports. So when the model catastrophically failed here, attackers still cannot login to my machine. Other attacks might make this possible (e.g. code exec in the agent), but were not found - I suspect due to the lack of attack surface.
    - api 4y ago
      All software can have serious bugs, which is why you do defense in depth. Never depend on just one thing for your entire security perimeter. Outside narrow very well defined cases where proofs of security are possible, it might be impossible create perfectly secure computing systems due to the insolubility of the halting problem and the sheer size of the combinatorial space. If you watch the CVE announcements it's a continuous stream of serious bugs in all kinds of major software applications including OSes, web browsers, networking hardware, VPNs, cryptographic libraries, and so on. Microsoft, Apple, Cisco, etc. have serious vulnerabilities fairly often.
wankle 4y ago
I use a cheap public VPS and Wireguard and it works over my ISP connection at home. My servers run here at home but are only publicly visible at my VPS public ISP address. Is that the same as what you're asking for with 'NAT traversal'? If so, the config is straightforward for techies, just Wireguard config, it routes into my home server and I use Apache Reverse Proxy to route to the backend services.
skrowl 4y ago
https://github.com/jwhited/wgsd https://github.com/jwhited/wgsd does NAT traversal with Wireguard, but you need to operate a CoreDNS server to do it. More info on how it works: https://www.jordanwhited.com/posts/wireguard-endpoint-discovery-nat-traversal/ https://www.jordanwhited.com/posts/wireguard-endpoint-discov...
g_p 4y ago
> I'd like to see tailscaled run with far fewer privileges. Yeah - I have a dislike for services running as root when it's not necessary, and then getting users to escalate to root to interact with them routinely. One thing I was thinking about was trying to identify the Linux capabilities which let tailscaled run, and then look at if it's feasible to adjust the default systemd unit to run it as a non root user. Closely followed by then trying to harden up the service with as many of the recommendations as possible in "systemd-analyze security". Despite there being a pretty good range of restrictions available, it seems to be pretty rare that service definitions actually come locked down... Might be something for the tailscale team to look at in future?
- mindwok 4y ago
  Software shipped by the distro maintainers I find is often properly locked down with systemd features, but third party stuff is always hit and miss. Definitely agree Tailscale should be shipping with the bare minimum privileges required.
jarym 4y ago
Twingate comes close - not wireguard (uses QUIC) but does NAT traversal and doesn’t try to interfere with intercepting/manipulating network traffic. Focus is more on device identity/posture, DNS + remote access rather than straight VPN like Tailscale & co
adql 4y ago
Yeah the whole "run local http server as control panel" is iffy for non security centric stuff, let alone VPN software. I guess it is because it's easy ? But now even windows can make unix sockets, that seems like reasonably easy and secure solution for "talk with some daemon portably"
ehutch79 4y ago
Nebula might fit, but it’s not wireguard specifically.

mikestaub 4y ago

I have a task to investigate https://www.firezone.dev https://www.firezone.dev

klabb3 4y ago

> Is there a Tailscale alternative that just does Wireguard + NAT traversal and doesn't try to do key management? I really wish there was a NAT traversal protocol or library that wasn't overly complex and focused on the 90% cases. It would help not just tailscale's but anyone building p2p tech.

anderspitman 4y ago
I believe libp2p has some NAT traversal stuff: https://docs.libp2p.io/concepts/nat/ https://docs.libp2p.io/concepts/nat/
- freedinosaur 4y ago
  https://github.com/hyprspace/hyprspace https://github.com/hyprspace/hyprspace is built on top of that. It's remarkably simple: libp2p's DHT + libp2p's NAT punching + TUN device. I don't think it offers authn/authz, but that's fine: neither does my ISP. I just want SSH reachability.
doublepg23 4y ago
I wonder if IPv6 will ever be the “path of least resistance” vs. NAT punching.
- api 4y ago
  You usually still have to punch with IPv6 as there is usually a stateful firewall in the way. You just get 100% success vs the 80-90% you get with V4 (and getting worse as CGN gets more common).
  - klabb3 4y ago
    This is correct. It's very annoying for any p2p like application, because the punching is a coordinated and time sensitive dance that just circumvents particular firewall bs. The firewall approach comes from this heavily flawed idea of the client initiated model of communication, extrapolated to client=consumers and server=service providers. It's just awful that the majority of the nodes on the internet aren't even reachable by default. Anyway, it would be much better to leave the socket APIs to handle this, possibly with OS safeguards and privileges. Writing p2p applications is analogous to being constantly protected "for your own good" by a guardian. /rant
    - adql 4y ago
      It's used like that because for a long time that approach worked. Users are terrible at securing their own machines and will click yes on anything just to get a thing they want and so putting stateful firewall allowing only outgoing connections was very effective measure. Much less relevant when now even windows comes with half decent, reasonable default firewall out of the box. Then again "user clicking allow button till it works" is still a problem.
    - robertlagrant 4y ago
      > It's just awful that the majority of the nodes on the internet aren't even reachable by default. Who'd pay for the routing? :)

infotogivenm 4y ago

Yep. Same boat. Absolutely zero interest in granting them ssh authZ; transport wrapping is all I want to outsource. Just deliver my bits and I pay you, tyvm. My suspicions have been proven correct here. Unfortunately reading about this remote RCE vector has me wondering whether I can use the product at all without all this bloat (taildrop, ssh, etc) affecting me. Going to have my team look at zerotier this week, I’ve heard a few ok things.

andai 4y ago
Top result on HN: https://news.ycombinator.com/item?id=28590625 https://news.ycombinator.com/item?id=28590625 "Zerotier: multiple vulnerabilities lead to private network access."
- infotogivenm 4y ago
  Saw that when it came out, yikes, but here it makes my point for me. The zerotier software failed - as such you could (in the simplest terms) bypass the transport “firewall”. At no point could you execute code on my machines. At no point could you spoof any authorization layers outside of what’s required to reach my ports. So when the model catastrophically failed here, attackers still cannot login to my machine. Other attacks might make this possible (e.g. code exec in the agent), but were not found - I suspect due to the lack of attack surface.
  - api 4y ago
    All software can have serious bugs, which is why you do defense in depth. Never depend on just one thing for your entire security perimeter. Outside narrow very well defined cases where proofs of security are possible, it might be impossible create perfectly secure computing systems due to the insolubility of the halting problem and the sheer size of the combinatorial space. If you watch the CVE announcements it's a continuous stream of serious bugs in all kinds of major software applications including OSes, web browsers, networking hardware, VPNs, cryptographic libraries, and so on. Microsoft, Apple, Cisco, etc. have serious vulnerabilities fairly often.

wankle 4y ago

I use a cheap public VPS and Wireguard and it works over my ISP connection at home. My servers run here at home but are only publicly visible at my VPS public ISP address. Is that the same as what you're asking for with 'NAT traversal'? If so, the config is straightforward for techies, just Wireguard config, it routes into my home server and I use Apache Reverse Proxy to route to the backend services.

skrowl 4y ago

https://github.com/jwhited/wgsd https://github.com/jwhited/wgsd does NAT traversal with Wireguard, but you need to operate a CoreDNS server to do it. More info on how it works: https://www.jordanwhited.com/posts/wireguard-endpoint-discovery-nat-traversal/ https://www.jordanwhited.com/posts/wireguard-endpoint-discov...

g_p 4y ago

> I'd like to see tailscaled run with far fewer privileges. Yeah - I have a dislike for services running as root when it's not necessary, and then getting users to escalate to root to interact with them routinely. One thing I was thinking about was trying to identify the Linux capabilities which let tailscaled run, and then look at if it's feasible to adjust the default systemd unit to run it as a non root user. Closely followed by then trying to harden up the service with as many of the recommendations as possible in "systemd-analyze security". Despite there being a pretty good range of restrictions available, it seems to be pretty rare that service definitions actually come locked down... Might be something for the tailscale team to look at in future?

mindwok 4y ago
Software shipped by the distro maintainers I find is often properly locked down with systemd features, but third party stuff is always hit and miss. Definitely agree Tailscale should be shipping with the bare minimum privileges required.

jarym 4y ago

Twingate comes close - not wireguard (uses QUIC) but does NAT traversal and doesn’t try to interfere with intercepting/manipulating network traffic. Focus is more on device identity/posture, DNS + remote access rather than straight VPN like Tailscale & co

adql 4y ago

Yeah the whole "run local http server as control panel" is iffy for non security centric stuff, let alone VPN software. I guess it is because it's easy ? But now even windows can make unix sockets, that seems like reasonably easy and secure solution for "talk with some daemon portably"

ehutch79 4y ago

Nebula might fit, but it’s not wireguard specifically.