The Tailworm report is a good excuse to clean up your tailnet SSH rules. The idea is simple: no broad “everybody can SSH everywhere” rules. Each rule names one source and one destination. Here’s how I approach it.
1. See what you’ve got
On each machine, check whether Tailscale SSH is even on. If a box doesn’t need it, turn it off and use regular OpenSSH with keys instead:
tailscale status
# turn Tailscale SSH off on this node
sudo tailscale set --ssh=false
# turn it back on later if you need it
sudo tailscale set --ssh2. Tag machines by role
Give each server its own tag in the policy file, instead of one big tag:server for everything. Placeholder names below; use your own.
3. One rule per pair
In the policy file’s ssh section, write one rule per source-and-target pair, and use check so a fresh login is required before a session:
"ssh": [
{
"action": "check",
"src": ["tag:admin-laptop"],
"dst": ["tag:web-a"],
"users": ["deploy"]
},
{
"action": "check",
"src": ["tag:admin-laptop"],
"dst": ["tag:dns-a"],
"users": ["deploy"]
}
]Avoid autogroup:member to tag: rules and avoid root as a user. If you run headscale 0.29.5, remember forwarding can’t be turned off there, so every SSH grant is effectively root on the target.
4. Lock the rest down
- Turn on Tailnet Lock so a stolen enrollment key can’t add a new node by itself.
- Leave key expiry on for laptops and anything that travels.
- Run
tailscale serve statusand remove anything pointing at a Unix socket. - Keep the Tailscale client updated and watch for the fix.
5. Test it
From a device that should not have access, try to SSH in. It should fail. Then try from the one device that should. If both work, your rules are too wide.
Have a blessed day! And Happy Hacking!
