home-lab/networking/SSH-Tailscale.md

SSH - Tailscale setup

Tailscale

Install Tailscale:

curl -fsSL https://tailscale.com/install.sh | sh

Get Tailscale up:

sudo tailscale up

Run Tailscale at boot:

sudo systemctl enable --now tailscaled

To retrieve the IPv4 address (100.x.y.z) on the Tailscale network:

ip addr show tailscale0

SSH

It is possible to let Tailscale SSH entirely by running on the server:

sudo tailscale up --ssh

Undoing old UFW-SSH setup

Now because we switched to Tailscale SSH, we don't need the UFW rules anymore:

sudo ufw delete allow in on tailscale0 to any port 22 proto tcp

and move the authorize keys (for backup):

mv ~/.ssh/authorized_keys ~/.ssh/authorized_keys.bak

To free up some ram/cpu, we stop openssh and disable it on boot:

sudo systemctl stop ssh.socket # stop the socket from starting openssh.
sudo systemctl disable ssh.socket # stop the socket from starting openssh.
sudo systemctl stop ssh
sudo systemctl disable ssh

SSH-deprecated

From the client, to copy the public key to your server using its Tailscale IP (or the server's name if MagicDNS is enabled in the Tailnet):

ssh-copy-id [email protected]

To deny root login, password auth, keyboard interactive auth and allow public key auth:

sudo nano /etc/ssh/sshd_config.d/50-hardening.conf

and add:

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

then restart ssh:

sudo systemctl restart ssh

UFW

To allow ssh (port 22) connections on tailscale0 interface only in UFW:

sudo ufw allow in on tailscale0 to any port 22 proto tcp