Tailscale
- TS-2024-004tailscale.com Security Bulletins · Tailscale
Security notifications affecting the Tailscale client and service Read our incident disclosure and notification policy. If you’re directly affected by a security issue in Tailscale, and we have your contact information, we will contact you.
Description: Unclear network flow logs collection status for alpha testers.
What happened?
When network flow logs first entered private alpha, tailnet admins who were interested in testing out the feature had to request to be manually opted into the alpha testing track. When we subsequently introduced admin console settings for self-serve network flow logs for the public beta launch, these settings were not properly connected to the alpha testing track. As a result, for the small number of tailnets that volunteered for alpha testing, the admin console interface did not show that logs were still being collected as initially requested.
We fixed this bug on April 25, 2024 and the admin console now correctly shows the status of network flow logs for all users.
Who was affected?
15 tailnets were opted into network flow log collection through the alpha testing track that did not re-enroll through the admin console. We notified security contacts for the affected tailnets about this bug.
What was the impact?
The admin panel did not reflect the correct status for network flow log collection for affected tailnets, and admins of these tailnets may not have realized that network flow logs were still being collected.
What do I need to do?
No action is needed at this time.
- Hello headscale users! Did anyone get headscale working in a non standard port? E.g. https://hs.example.com:8443 ? For me It does not work and I think the tailscale clients still send some
@tailscale Hello headscale users! Did anyone get headscale working in a non standard port? E.g. https://hs.example.com:8443 ? For me It does not work and I think the tailscale clients still send some of the requests to the default port 443
- About the Tailscale.com outage on March 7, 2024tailscale.com About the Tailscale.com outage on March 7, 2024
On March 7, 2024, tailscale.com was unavailable for approximately 90 minutes due to an expired TLS certificate. We were able to identify and address the issue quickly, and the downtime was mostly limited to our marketing materials and documentation; still, we would like to explain exactly what happe...
- Tailscale v1.62.1
Linux
- (New) Send load balancing hint HTTP request header
Windows
- (Fixed) Do not allow msiexec to reboot the operating system
macOS
- (Fixed) Issue that could cause the Tailscale system extension to not be installed upon app launch, when deploying Tailscale using MDM and using a configuration profile to pre-approve the VPN tunnel (applies to standalone variant only)
Synology
- (Fixed) IPv6 routing
Kubernetes operator
- (Fixed) Kubernetes operator proxies should not accept subnet routes
- Tailscale SSH is now Generally Availabletailscale.com Tailscale SSH is now Generally Available
We’re thrilled to announce that Tailscale SSH is now Generally Available. Tailscale SSH allows Tailscale to manage the authentication and authorization of SSH connections on your tailnet. From the user’s perspective, you use SSH as normal—authenticating with Tailscale according to configurable rules...
- Explanation on handling DNS
I'm looking into ways to access my home network which is behind a CGNAT. Tailscale looks like the best solution so far. I would like to clarify a doubt on Tailscale
I have a domain name registered with one of the popular services out there. I saw that Tailscale uses MagicDNS. But I wanted to use my personal domain. My doubt is if I want to use my custom domain with Tailscale, the following will be the procedure,
- Setup Tailscale account and add machines.
- My device inside the home network will get a Tailscale IP assigned. From 100.xx.xx.xx pool
- Use this IP to configure an A record in my Domain registrar.
Now when I try to access this domain what will happen is,
- DNS server will resolve the Tailscale IP.
- The outside client will try to connect to my machine in the home network.
- Tailscale takes care of the CGNAT part and helps to establish a direct connection.
- Clients will use the public keys to establish trust and will communicate with each other.
If there is anything wrong in my understanding please correct me. I could not get a clear cut answer on this through searching.
- March Tailscale newslettertailscale.com March Tailscale newsletter
The March newsletter from Tailscale, featuring product updates, highlights from the community, and information about upcoming events.
- Updated Users page
> Users page of the admin console updated to provide more context around user invitations, user approval, and your tailnet’s identity provider
- An update on updatestailscale.com An update on updates
Tailscale auto-updates are now Generally Available, with a number of usability and control improvements. Today's update builds on our previously announced beta release.
> Tailscale auto-updates are now Generally Available (GA), with a number of usability and control improvements. Today's update builds on our previously announced beta release.
- Customize Tailscale at work with MDM Policiestailscale.com Customize Tailscale at work with MDM Policies
Tailscale Mobile Device Management policies enter General Availability today, and we are thrilled to share this new feature set with our Premium and Enterprise customers. Mobile Device Management (MDM) policies bring new levels of control and security to your Tailscale experience.
- Maintain security for your Tailscale secrets with GitGuardiantailscale.com Maintain security for your Tailscale secrets with GitGuardian
Tailscale provides a programmable network to our customers that is both secure enough to earn their trust and flexible enough to meet their networking needs across a wide range of infrastructure set-ups. We focus on making the locks trustworthy so our customers can focus on keeping track of their ke...
- TS-2024-002 · Security Bulletinstailscale.com Security Bulletins · Tailscale
Security notifications affecting the Tailscale client and service Read our incident disclosure and notification policy. If you’re directly affected by a security issue in Tailscale, and we have your contact information, we will contact you.
- No, really: Invite anyone to your tailnettailscale.com No, really: Invite anyone to your tailnet
Right around the turn of the new year, we rolled out a little update to our user invite system. The change: you can now invite people who don't authenticate through GitHub to join a tailnet owned by a user who does. For users who have built out tailnets based on a GitHub login and had run into this...
