Post

this post is correct but also tailscale ssh is awesome: no more shipping pubkeys, ssh powered by sso, fleet-wide policy changes rollout instantly with tailscale ACLs

This post is unavailable.

Randy Northrup

@randynorthrup.bsky.social

Do you run it in check mode for the sensitive boxes? Forcing a fresh SSO login before root feels like the sweet spot between convenient and reckless.

austin (eeek!/ackkk! 👻)

@thebadcode.com

yeah exactly, and tsrecorder for every session. theres only a handful of "real" break-glass ssh keys and everything else is tailscale ssh

25/10/26, 5:20 am0 reposts0 likes

Randy Northrup

@randynorthrup.bsky.social

tsrecorder on every session is the part most setups skip. Do the recordings stay on a node inside the tailnet, or get shipped somewhere the hosts themselves can't touch?

austin (eeek!/ackkk! 👻)

@thebadcode.com

s3 WORM bucket

Randy Northrup

@randynorthrup.bsky.social

Nice. Compliance mode, or governance? Governance always felt like a WORM bucket with a side door lol

austin (eeek!/ackkk! 👻)

@thebadcode.com

thank you for reminding me to flip the bucket into compliance mode after its soak 🫡