Configure Tailscale SSH

Tailscale SSH replaces SSH keys with tailnet identity and policy. Instead of distributing an authorized_keys file to every server, you let the Tailscale client on the server authenticate incoming connections.

When it is on, the client handles connections to TCP port 22 that arrive over the tailnet, and it checks them against your tailnet identity. No keys to distribute, no key rotation when someone leaves. Access follows the policy file, which you already know how to test.

Enable it on the server

Turn it on with tailscale set --ssh:

sudo tailscale set --ssh

One warning before you run it. Existing connections to the Tailscale IP can hang when you enable it, because the client takes over port 22 on the tailnet interface. Keep your recovery session open, the one on the public address or the cloud console, while you flip this switch. Same rule as always.

Permit it in policy

Two things must be true in the policy. Network access to TCP port 22 must be granted, which you did in the previous module. And the ssh section must have an entry for the destination and the operating-system users:

{
  "ssh": [
    {
      "action": "accept",
      "src": ["[email protected]"],
      "dst": ["tag:server"],
      "users": ["ubuntu"]
    }
  ]
}

The users list names the OS accounts the source may become. Granting root here is possible and should be rare. Name the specific unprivileged account the work needs. If you need root for one task, use sudo after you are in.

Test and verify the boundary

From your laptop:

ssh ubuntu@lab-server

The connection authenticates through Tailscale. Identity came from the tailnet, not from a key in ~/.ssh. If you want proof, move your SSH key aside temporarily and connect again. It still works.

Now check the negative side. Have a second user try to connect, or temporarily remove your ssh rule and watch the connection get rejected. A rule you have not seen fail is a rule you do not fully trust yet.

The detail worth remembering

Tailscale SSH only answers on the tailnet path. SSH to the public address still goes through sshd and normal keys. That is your migration safety net. Keep it until you have used Tailscale SSH for a while and know it works, then close the public port deliberately.