June 2023 Summaries

Network flow logs are now generally available for Tailscale customers, enabling them to monitor network activity within their tailnet to detect threats, investigate security incidents, and maintain compliance with security policies. These logs capture metadata about network traffic without recording content, ensuring connections remain end-to-end encrypted and inaccessible to Tailscale. Available for Premium and Enterprise plan customers, log streaming, including configuration audit logs, is also offered to Enterprise plan users. To utilize these features, customers are encouraged to consult the documentation on logging and events.

Tailscale's June newsletter highlights several exciting developments, including the success of their inaugural community conference, Tailscale Up, where they unveiled new features such as inviting external users to Tailnet and a passkey login system. The company is actively engaging with the tech community through sponsorships at LeadDev London and BlackHat USA, offering opportunities to learn about their latest releases. Community contributions showcase Tailscale's ease of use as a personal VPN solution and its application in home networks, while the Engineering Leadership Podcast offers insights from Tailscale's co-founder on rapid prototyping. The newsletter also announces the release of a Tailscale extension for Visual Studio Code, the availability of the Tailscale app in the QNAP App Center, and highlights customer stories, such as Bamboo Health's enhanced network security through Tailscale. Additionally, Tailscale is expanding its team and invites interested individuals to explore open positions.

An official Tailscale app is now available in the QNAP App Center, allowing users of QNAP's network-attached storage devices to easily download and install the Tailscale client on x86-64bit and arm-64bit models, though it remains unavailable for arm41 devices. While users can still install Tailscale on QNAP devices via QPKG builder scripts, with thanks to @ivokub for the original project, the App Center will continue to receive updates, albeit with potential delays due to the review process. Users seeking more detailed guidance on using Tailscale with QNAP or other NAS devices can refer to the documentation in the knowledge base.

Tailscale has released a beta extension for Visual Studio Code, enabling developers to integrate their tailnet directly into the popular text editor on macOS and Windows platforms. This extension simplifies the process of sharing local development environments over the internet for collaboration and testing, utilizing the Tailscale Funnel feature to securely expose local ports with auto-provisioned TLS certificates. Users can start a Funnel through the VS Code interface, either via a toast notification for port discovery or through the command palette. This open-source extension is actively being developed, with updates and unstable builds available on GitHub, where users can also report issues or request new features.

Tailscale has never supported password-based authentication, viewing passwords as outdated and insecure due to complexities in creating, remembering, and managing them. Instead, Tailscale initially relied on Google and Microsoft authentication providers and later expanded to include GitHub, Apple, and custom OIDC providers. Now, Tailscale is promoting the use of passkeys as a modern, secure alternative to passwords. Passkeys are unique for each account and site, resistant to phishing, and synchronized across devices through services like iCloud Keychain, Google Password Manager, and 1Password. For Tailscale users, admins can invite new users to their tailnet using a passkey, creating a public/private key pair unique to Tailscale for each user. Passkeys offer a passwordless experience, enhancing security by eliminating the risk of phishing and syncing credentials securely across devices. Although passkeys are currently available in beta for Apple macOS and iOS, Google Chrome and Android, as well as with 1Password and Yubikey, adding a passkey to an existing login is not yet possible, requiring an additional user for backup access.

Tailscale Enterprise offers a comprehensive solution for secure and efficient network management by creating a mesh-capable VPN that simplifies connecting devices without complex configurations, while ensuring robust security measures. Users can easily join the network using identity providers like GitHub or Okta, facilitating seamless access to infrastructure and resources. Tailored for enterprises, Tailscale integrates with existing systems, complies with security standards, and offers advanced features like Access Control Lists (ACLs) for granular permissions, SCIM for user synchronization, Tailnet Lock for enhanced security, and log streaming for comprehensive auditing. The platform also supports zero trust networking by enforcing least-privilege access, thus mitigating risks of lateral attacks. With flexible pricing models that align with usage, Tailscale aims to provide a scalable, user-friendly, and secure networking environment adaptable to various organizational needs.

Tailscale has introduced a feature that enables users to invite anyone to their Tailscale network (tailnet), regardless of domain, allowing for seamless integration of family, friends, external contractors, and partners without requiring temporary email accounts or identity provider additions. This update is particularly beneficial for users on shared domains like Gmail or Outlook, as it facilitates the inclusion of multiple users on the same tailnet. The process involves generating a unique invitation link for new users, who can join using any identity provider, such as passkeys. Existing security controls remain intact, ensuring that admins can manage access rights and monitor user activity through approval processes and audit logs. Additionally, a new admin control allows organizations to restrict users from joining external tailnets, enhancing network security.