Add SSH - Tailscale setup procedure

networking/SSH-Tailscale.md

@@ -0,0 +1,50 @@
+# SSH - Tailscale setup
+## Tailscale
+Install Tailscale:
+```bash
+curl -fsSL https://tailscale.com/install.sh | sh
+```
+
+Get Tailscale up:
+```bash
+sudo tailscale up
+```
+
+Run Tailscale at boot:
+```bash
+sudo systemctl enable --now tailscaled
+```
+
+To retrieve the IPv4 address (100.x.y.z) on the Tailscale network:
+```bash
+ip addr show tailscale0
+```
+
+## SSH
+From the client, to copy the public key to your server using its Tailscale IP (or the server's name if MagicDNS is enabled in the Tailnet):
+```bash
+ssh-copy-id [email protected]
+```
+
+To deny root login, password auth, keyboard interactive auth and allow public key auth:
+```bash
+sudo nano /etc/ssh/sshd_config.d/50-hardening.conf
+```
+and add:
+```
+PermitRootLogin no
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PubkeyAuthentication yes
+```
+then restart ssh:
+```bash
+sudo systemctl restart ssh
+```
+
+## UFW
+
+To allow ssh (port 22) connections on tailscale0 interface only in UFW:
+```bash
+sudo ufw allow in on tailscale0 to any port 22 proto tcp
+```