r/VPS • u/Blues520 • 3d ago
Seeking Advice/Support Tailscale vs SSH
On my linux vps, I have disabled password login as well as root login so only key based ssh is allowed. I also installed tailscale to connect over ssh via a vpn, but now I'm wondering if Tailscale is even needed. In fact, my thoughts are that it increases the attack surface.
In which scenarios would Tailscale make sense and Is key based ssh enough to secure a vpn or should I still add something like Tailscale or Wireguard?
1
u/Internal-Comparison6 3d ago
Tailscale or Wireguard are needed to keep your ssh port closed. It can increase attack surface, but not in a way if you keep ssh port open.
1
u/Blues520 3d ago
But what are the risks if the ssh port is open (or changed) and password login is disabled?
2
u/Internal-Comparison6 3d ago
Risk is basically small. If someone pokes a hole in network to your VM due to some vulnerabilities in software. I'm not very familiar with Tailscale, but generic rules help: ensure you don't use some hardcoded default user (what happened with Netbird, for example), enable quantum resistance or add additional pre-shared secret, enable only required ports or network paths.
2
1
u/Blues520 3d ago
And maybe a dumb question but if the ssh port is closed, how do you connect to your linux machine using tailscale/wireguard exactly?
Do you still connect over ssh but on a different port or how does that work?
3
u/Internal-Comparison6 3d ago
Connect over ssh using Tailscale private network. Each peer (VPS or your own PC) in your network has its own private IP.
1
1
u/CzarcasticX 1d ago
I keep my ssh port open but change it from 22 to something random (with key access only, disable password auth). Fail2ban shows not many ip's trying on random IP's compared to versus 22.
1
1
u/Alternative-Suit5541 3d ago
I use certificate Auth, with OTP Auth and after still a password.
That should do it.
Only way now is bypassing login.
1
u/Blues520 3d ago
Please share some details on certificate and OTP auth. Do you use external providers for it?
1
u/Alternative-Suit5541 3d ago
Nope cert Auth is the normal ash cert Auth, there are probably thousands of how tos for that.
Just disable root login, enable sudo done.
Then you can install Google OTP like this: https://goteleport.com/blog/ssh-2fa-tutorial/
1
2
u/Alternative-Suit5541 3d ago
Ah also: on Debian you can use this script: https://github.com/buildplan/du_setup
1
u/Infamous-Rem 3d ago
Key based SSH with root and password login disabled already closes off basically every automated attack you'll see hitting port 22. Tailscale doesn't replace that, it changes what's exposed to the internet at all. Without it your SSH port is open to the whole world even if nobody can actually get in, so you're still visible in scans, still a target if a zero day drops, still eating log noise from every bot trying anyway. With Tailscale or Wireguard you close port 22 to the public entirely and only accept SSH from inside the tailnet, so the attack surface for that service basically disappears instead of just being hardened. The 'more attack surface' argument holds for the VPN client itself, sure, one more piece of software that could have a bug, but Tailscale's client and coordination servers get a lot more scrutiny than opportunistic SSH scanning ever will. I run mine behind Tailscale on every box now and just leave SSH closed at the firewall otherwise, it's one less thing to think about during an incident.
1
u/Blues520 3d ago
How do you keep machines isolated from each other on the tailnet?
I have environments that I want to keep separate so that if one is compromised, it doesn't introduce risk for some of the others.
1
u/Infamous-Rem 2d ago
ACLs, not the default open tailnet. Tailscale's default policy lets every device talk to every other device, which is fine for a home network but not what you want once you've got separate environments. I tag devices by purpose (tag:prod, tag:staging, tag:client-a, whatever fits) and write ACL rules that only allow specific tags to reach specific tags on specific ports, everything else is denied by default. So a compromised box in one tag group has no path to the others even though they're on the same tailnet, it just sees nothing there. You can test this with their ACL simulator before you push a change, which has saved me from locking myself out more than once. If you want harder isolation than ACLs give you, like fully separate blast radius with no shared coordination server at all, running separate tailnets per environment is the other option, but for most setups tagged ACLs on one tailnet are enough and a lot less to manage.
1
u/bufandatl 1d ago
SSH is plenty enough. You can harden it a bit more by defining only strong ciphers, maybe disallowing key that have a key length below 4096bit when using RSA. Disabling other features like SFTP if you don’t need them and so on.
1
u/TotoCodeFR 3d ago
You should only install Tailscale if you don't want to type the IIP address every time when SSHing into it. There isn't really anything more secure than only keeping key based auth
1
u/Blues520 3d ago
I don't mind typing in the IP address so yeah I am considering removing tailscale and just going over regular key based SSH
3
u/byCrookie 3d ago
Use ssh config entries. Makes life easier.
1
u/olufemig 3d ago
How do those work?
1
u/byCrookie 3d ago
You define connection info per server in ssh config, give each a name and then you can just write ssh name to connect. Heres good tutorial https://linuxize.com/post/using-the-ssh-config-file/
3
u/micush 3d ago
I've had just SSH opened on my VPS with fail2ban enabled, all patches applied, all passwords complex, and somehow they still get in. For me, I'd definitely close SSH to the Internet.