From 1485084d0e9b8a07116fba6d78f4369593ef128e Mon Sep 17 00:00:00 2001 From: Pierre Vandermeersch Date: Fri, 11 Sep 2026 12:50:54 +0200 Subject: [PATCH] Update to use Tailscale SSH instead of OpenSSH --- networking/SSH-Tailscale.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/networking/SSH-Tailscale.md b/networking/SSH-Tailscale.md index bd3dc49..659c1e7 100644 --- a/networking/SSH-Tailscale.md +++ b/networking/SSH-Tailscale.md @@ -21,6 +21,29 @@ ip addr show tailscale0 ``` ## SSH +It is possible to let Tailscale SSH entirely by running on the server: +```bash +sudo tailscale up --ssh +``` + +### Undoing old UFW-SSH setup +Now because we switched to Tailscale SSH, we don't need the UFW rules anymore: +```bash +sudo ufw delete allow in on tailscale0 to any port 22 proto tcp +``` +and move the authorize keys (for backup): +```bash +mv ~/.ssh/authorized_keys ~/.ssh/authorized_keys.bak +``` +To free up some ram/cpu, we stop openssh and disable it on boot: +```bash +sudo systemctl stop ssh.socket # stop the socket from starting openssh. +sudo systemctl disable ssh.socket # stop the socket from starting openssh. +sudo systemctl stop ssh +sudo systemctl disable ssh +``` + +## SSH-deprecated From the client, to copy the public key to your server using its Tailscale IP (or the server's name if MagicDNS is enabled in the Tailnet): ```bash ssh-copy-id username@100.x.y.z