Tailscale SSH

~12 min · tailscale-ssh, identity-auth, session-recording

Level 0Pinger

0 XP0/101 lessons0/12 achievements

0/150 XP to next level150 XP to go0% complete

SSH without managing keys

Tailscale SSH replaces traditional SSH key management entirely. Instead of ~/.ssh/authorized_keys on every machine, authentication is handled by Tailscale's identity system — your account is the credential. Enable it on a host with one flag, and any device on your tailnet authenticated as you can SSH in without a key.

What it gives you

Identity-based auth — your Tailscale identity (Google, Microsoft, GitHub, whatever you signed in with) is the credential. No SSH keys to distribute.
Optional re-authentication for high-risk actions — "check mode" can require browser re-auth before granting an SSH session.
Optional session recording for audit trails.
Access policy via Tailscale ACLs instead of authorized_keys files.

Code

Enable on a host·bash

# On the host that should accept Tailscale SSH
sudo tailscale set --ssh

# Now from any other device on your tailnet:
ssh user@office
# No key needed — Tailscale handles auth

# Disable
sudo tailscale set --ssh=false

External links

Tailscale: SSH

Exercise

On one Tailscale device, enable Tailscale SSH (sudo tailscale set --ssh). From another tailnet device, try ssh you_username@hostname — no key prompt, no password. The first time you may be asked to re-authenticate in a browser; from then on it's seamless. Compare to the OpenSSH path you set up in Track 2.