5 ms·
> I check with nmap periodically. I have a break-glass backup terminal login option via my cloud provider dashboard (secured with MFA) in case Tailscale failed
by figmert 1mo ago
> I check with nmap periodically. I have a break-glass backup terminal login option via my cloud provider dashboard (secured with MFA) in case Tailscale failed and needed investigation and repair.
Cool! Are you able to provide more information on this? My break glass is to temporarily allow public access to my IP, but it's manual and takes time for the firewall rules to apply. I'd love to have a better solution if possible.
- hn_throw2025 1mo agoSure thing. I really meant that my Oracle Cloud account is protected by my YubiKey, and when I provision an instance I set a strong, pre-hashed password for the local account in the CloudInit configuration. If I ever need emergency maintenance access, I can use the OCI instance console from the dashboard rather than SSH. SSH itself is configured to accept publickey authentication only, disallow root login, and only listen on the Tailnet IP range. So the password isn’t part of the normal SSH access path.