6 ms·

Show HN: Ts-SSH – SSH over Tailscale without running the daemon

103 points by i8code 1y ago

ts-ssh solves a specific problem: accessing machines on your Tailnet from environments where you can't install the full Tailscale daemon (like CI/CD runners or restricted systems). It uses Tailscale's tsnet library to establish userspace connectivity, then provides a standard SSH experience. Works with existing workflows since it supports normal SSH features like ProxyCommand, key auth, and terminal handling. Some features that proved useful: • Parallel command execution across multiple hosts • Built-in tmux session management for multi-host work • SCP-style file transfers • Works on Linux/macOS/Windows (AMD64 and ARM64) The codebase is interesting from a development perspective - it was written almost entirely using AI tools (mainly Claude Code, with some OpenAI and Jules). Not as an experiment, but because it actually worked well for this kind of systems programming. Happy to discuss the workflow if anyone's curious about that aspect. Source and binaries are on GitHub. Would appreciate feedback from anyone dealing with similar connectivity challenges.

_9y71 1y ago
This is why you don't let Claude handle versioning and the release process. From v0.1.0 to v1.0.0 to v2.0.0, and then suddenly 1.2.0? Semantic versioning isn't quantum mechanics. (Even then, I'll admit it's sometimes hard for me too to decide the right increment when tagging versions. :)
- deleted 1y ago
  [deleted]
- ape4 1y ago
  In general, maybe security code (which is what this is) might not be the best place for AI.
- KomoD 1y ago
  > This is why you don't let Claude handle versioning and the release process. Or anything else without reviewing it. lol @ the issue in the repo: "module declares its path as: github.com/yourusername/ts-ssh"
- ramon156 1y ago
  - 0.0.1 -> improvements - 0.1.0 -> breaking changes - 1.0.0 -> overhaul/refactor needed I know not every case is easy but this is my rule of thumb. I've honestly never needed a major version change
  - Timon3 1y ago
    That kind of goes counter to semantic versioning, where: - x.y.Z (patch) -> backward compatible bug fixes - x.Y.z (minor) -> backward compatible new features - X.y.z (major) -> breaking changes But of course it's fine to use whatever versioning scheme you like, as long as you communicate it to your consumers. https://semver.org/ https://semver.org/ Edit: updated the version strings for clarity.
    - zamadatix 1y ago
      Minor note, but since the topic is accurate semvar: rule 4 specifies 0.x.y is a special case where anything may change at any time.
      - _9y71 1y ago
        Relevant section: https://semver.org/#:~:text=How%20should%20I,next%20major%20version. https://semver.org/#:~:text=How%20should%20I,next%20major%20...
      - Timon3 1y ago
        Good point, if we're already being pedantic we should be accurate. I've updated the version strings in my comment, thanks!
  - chrisweekly 1y ago
    Using a 3-digit version like semver, while assigning different semantics, is a recipe for confusion if anyone except you ever refers to a package using this "rule of thumb".
  - indrora 1y ago
    0.0.1 - I fixed a bug 0.1.0 - I rearchitected the bug 1.0.0 - The bug is integral to the codebase.
- 0x457 1y ago
  https://preview.redd.it/ou8h9owirmme1.png?width=1024&auto=webp&s=3f2654b3c69ba04cff6a17ef014517c5276971de https://preview.redd.it/ou8h9owirmme1.png?width=1024&auto=we...
- cedws 1y ago
  Semantic versioning isn’t the only way of versioning. Linus Torvalds versions Linux how he sees fit.
anotherpaulg 1y ago
Looks very interesting. I was hoping it would solve a problem I’ve had recently: I want to ssh into a windows box that I only have a normal user account on. So I can’t (and don’t want to) change any admin settings or install anything as admin. All the obvious approaches hit roadblocks. Seems like this tool solves the opposite problem: sshing out from a minimally privledged environment.
- paxys 1y ago
  You can start your own ssh daemon from the unprivileged account pointing to a random port.
  - anotherpaulg 1y ago
    Ya, you would think so. But when you connect to it and sshd tries to fork a process to handle the session… you get a privileges error.
huslage 1y ago
I am scared that this is vibe coded and not audited in any way. tsnet is good software, but wrapping it in this way is a recipe for disaster. Please reconsider.
- KetoManx64 1y ago
  Can you explain what the possible risks are?
- mystifyingpoi 1y ago
  > I am scared that this is vibe coded Totally serious question: would you feel better about this piece of software, if you didn't know that it was vibe coded? Do we need "build without AI" stickers on every piece of software created these days?
  - cchance 1y ago
    [flagged]
    - KomoD 1y ago
      I don't really care if "AI assistance" was used as long a human is actually reviewing the output, which just doesn't seem to be the case here (and usually not the case when it comes to "vibe coding")
    - Bender 1y ago
      Somewhat off topic question but I ask this from time to time and maybe now is that time. Has AI started fixing everyone's software bugs and closing out all the CVE's yet?
      - cchance 1y ago
        I saw a youtube video of a few CVE's being closed out by some automated AI bot they were talking about recently i can't remember the channel sorry :( That said coderabbit's pretty damn impressive for just generally reviewing PR's and catching shit for human review.
rsync 1y ago
Tangential ... I think I read somewhere that I cannot become a customer of tailscale without FAANG credentials ? As in, I cannot simply sign up with my own personal identifiers (email, phone, etc.) but need to participate in a google auth or FB auth mechanism ? I found it hard to believe - is this, indeed, the case ?
- erinnh 1y ago
  You need one of the following: Google, Microsoft, Github, Apple or your own OIDC Provider. They do not have their own account backend. So you dont technically need a FAANG account if you have a Gitea, Gitlab, Authentik Account or something like that.
- Deathmax 1y ago
  Since April 2023 they support custom OIDC providers[1], and as of April 2024 that was extended to the free plan as well[2], so you can bring your own auth. [1]: https://tailscale.com/kb/1240/sso-custom-oidc https://tailscale.com/kb/1240/sso-custom-oidc [2]: https://tailscale.com/blog/sso-tax-cut https://tailscale.com/blog/sso-tax-cut
- _ks3e 1y ago
  It's possible to use Tailscale with just a passkey [0], but it's a weird process because they don't let you create a tailnet and a passkey account at the same time. Instead, you need to create an account with a throwaway FAANG credential and send yourself an invite to that account's tailnet, and then use that invite to create a passkey-linked Tailscale account. This account can then create its own tailnet, at which point the original tailnet (and the throwaway FAANG account) can be discarded. It's a weird process and not particularly user friendly (passkey accounts are tied to a specific passkey and can't have additional ones added, so you need to create a new account if you, say, migrate from one hardware key to another). Hopefully they improve the process before passkey support goes out of beta. [0] https://tailscale.com/kb/1269/passkeys https://tailscale.com/kb/1269/passkeys
  - xeonmc 1y ago
    I feel like maybe they should allow adding SSH keys as a login method instead of passkeys. Though I suppose there is the potential problem of identitiy collision due to public key resuse unless the keys were generated serverside to guarantee uniqueness.
amacneil 1y ago
Meta question: How does a HN post like this come to exist with _both_ a link and a body? Anytime I've submitted with both url + body the body is posted as a comment.
- ambigious7777 1y ago
  not sure, but i think this may be a special feature for Show HNs
- pvg 1y ago
  Show HN's get to have text and a link, most other things don't.
- deleted 1y ago
  [deleted]

103 points by i8code 1y ago

_9y71 1y ago

This is why you don't let Claude handle versioning and the release process. From v0.1.0 to v1.0.0 to v2.0.0, and then suddenly 1.2.0? Semantic versioning isn't quantum mechanics. (Even then, I'll admit it's sometimes hard for me too to decide the right increment when tagging versions. :)

deleted 1y ago
[deleted]
ape4 1y ago
In general, maybe security code (which is what this is) might not be the best place for AI.
KomoD 1y ago
> This is why you don't let Claude handle versioning and the release process. Or anything else without reviewing it. lol @ the issue in the repo: "module declares its path as: github.com/yourusername/ts-ssh"
ramon156 1y ago
- 0.0.1 -> improvements - 0.1.0 -> breaking changes - 1.0.0 -> overhaul/refactor needed I know not every case is easy but this is my rule of thumb. I've honestly never needed a major version change
- Timon3 1y ago
  That kind of goes counter to semantic versioning, where: - x.y.Z (patch) -> backward compatible bug fixes - x.Y.z (minor) -> backward compatible new features - X.y.z (major) -> breaking changes But of course it's fine to use whatever versioning scheme you like, as long as you communicate it to your consumers. https://semver.org/ https://semver.org/ Edit: updated the version strings for clarity.
  - zamadatix 1y ago
    Minor note, but since the topic is accurate semvar: rule 4 specifies 0.x.y is a special case where anything may change at any time.
    - _9y71 1y ago
      Relevant section: https://semver.org/#:~:text=How%20should%20I,next%20major%20version. https://semver.org/#:~:text=How%20should%20I,next%20major%20...
    - Timon3 1y ago
      Good point, if we're already being pedantic we should be accurate. I've updated the version strings in my comment, thanks!
- chrisweekly 1y ago
  Using a 3-digit version like semver, while assigning different semantics, is a recipe for confusion if anyone except you ever refers to a package using this "rule of thumb".
- indrora 1y ago
  0.0.1 - I fixed a bug 0.1.0 - I rearchitected the bug 1.0.0 - The bug is integral to the codebase.
0x457 1y ago
https://preview.redd.it/ou8h9owirmme1.png?width=1024&auto=webp&s=3f2654b3c69ba04cff6a17ef014517c5276971de https://preview.redd.it/ou8h9owirmme1.png?width=1024&auto=we...
cedws 1y ago
Semantic versioning isn’t the only way of versioning. Linus Torvalds versions Linux how he sees fit.

anotherpaulg 1y ago

Looks very interesting. I was hoping it would solve a problem I’ve had recently: I want to ssh into a windows box that I only have a normal user account on. So I can’t (and don’t want to) change any admin settings or install anything as admin. All the obvious approaches hit roadblocks. Seems like this tool solves the opposite problem: sshing out from a minimally privledged environment.

paxys 1y ago
You can start your own ssh daemon from the unprivileged account pointing to a random port.
- anotherpaulg 1y ago
  Ya, you would think so. But when you connect to it and sshd tries to fork a process to handle the session… you get a privileges error.

huslage 1y ago

I am scared that this is vibe coded and not audited in any way. tsnet is good software, but wrapping it in this way is a recipe for disaster. Please reconsider.

KetoManx64 1y ago
Can you explain what the possible risks are?
mystifyingpoi 1y ago
> I am scared that this is vibe coded Totally serious question: would you feel better about this piece of software, if you didn't know that it was vibe coded? Do we need "build without AI" stickers on every piece of software created these days?
- cchance 1y ago
  [flagged]
  - KomoD 1y ago
    I don't really care if "AI assistance" was used as long a human is actually reviewing the output, which just doesn't seem to be the case here (and usually not the case when it comes to "vibe coding")
  - Bender 1y ago
    Somewhat off topic question but I ask this from time to time and maybe now is that time. Has AI started fixing everyone's software bugs and closing out all the CVE's yet?
    - cchance 1y ago
      I saw a youtube video of a few CVE's being closed out by some automated AI bot they were talking about recently i can't remember the channel sorry :( That said coderabbit's pretty damn impressive for just generally reviewing PR's and catching shit for human review.

rsync 1y ago

Tangential ... I think I read somewhere that I cannot become a customer of tailscale without FAANG credentials ? As in, I cannot simply sign up with my own personal identifiers (email, phone, etc.) but need to participate in a google auth or FB auth mechanism ? I found it hard to believe - is this, indeed, the case ?

erinnh 1y ago
You need one of the following: Google, Microsoft, Github, Apple or your own OIDC Provider. They do not have their own account backend. So you dont technically need a FAANG account if you have a Gitea, Gitlab, Authentik Account or something like that.
Deathmax 1y ago
Since April 2023 they support custom OIDC providers[1], and as of April 2024 that was extended to the free plan as well[2], so you can bring your own auth. [1]: https://tailscale.com/kb/1240/sso-custom-oidc https://tailscale.com/kb/1240/sso-custom-oidc [2]: https://tailscale.com/blog/sso-tax-cut https://tailscale.com/blog/sso-tax-cut
_ks3e 1y ago
It's possible to use Tailscale with just a passkey [0], but it's a weird process because they don't let you create a tailnet and a passkey account at the same time. Instead, you need to create an account with a throwaway FAANG credential and send yourself an invite to that account's tailnet, and then use that invite to create a passkey-linked Tailscale account. This account can then create its own tailnet, at which point the original tailnet (and the throwaway FAANG account) can be discarded. It's a weird process and not particularly user friendly (passkey accounts are tied to a specific passkey and can't have additional ones added, so you need to create a new account if you, say, migrate from one hardware key to another). Hopefully they improve the process before passkey support goes out of beta. [0] https://tailscale.com/kb/1269/passkeys https://tailscale.com/kb/1269/passkeys
- xeonmc 1y ago
  I feel like maybe they should allow adding SSH keys as a login method instead of passkeys. Though I suppose there is the potential problem of identitiy collision due to public key resuse unless the keys were generated serverside to guarantee uniqueness.

amacneil 1y ago

Meta question: How does a HN post like this come to exist with _both_ a link and a body? Anytime I've submitted with both url + body the body is posted as a comment.

ambigious7777 1y ago
not sure, but i think this may be a special feature for Show HNs
pvg 1y ago
Show HN's get to have text and a link, most other things don't.
deleted 1y ago
[deleted]