Architecture, reliability & security assurance — found from sitemap — Tailscale

Cited by

Facts read from this source

• Dataplane wireguard Report an error

  “Our base layer is the increasingly popular and excellent open source WireGuard package (specifically the userspace Go variant, wireguard-go).”

• Mesh network Report an error

  “Remember those “extremely lightweight” WireGuard tunnels? Wouldn’t it be nice if you could directly connect all the nodes to all the other nodes? That’s called a mesh network:”

• Control plane coordination server Report an error

  “It talks to what we call a “coordination server” (in our case, login.tailscale.com)—essentially, a shared drop box for public keys.”

• Private key never leaves node Report an error

  “Note that the private key never, ever leaves its node.”

• End to end encryption Report an error

  “It’s important to keep that in mind: Tailscale node connections are end-to-end encrypted (a concept called “zero trust networking”).”

• Subnet routes hybrid Report an error

  “(The exception is if you use subnet routes, which are useful for incremental deployment, which Tailscale supports. You can create a hybrid network that combines new-style mesh connections with zero or more old-style “hubs” that decrypt packets, then forward them to legacy physical networks.)”

• External identity provider auth Report an error

  “However, we don’t handle user authentication ourselves. Instead, we always outsource authentication to an OAuth2, OIDC (OpenID Connect), or SAML provider. Popular ones include Gmail, GSuite, and Office365.”

• Pii minimization Report an error

  “Tailscale is able to operate a highly reliable central coordination service while holding a minimum of your users’ personally identifiable information (PII).”

• Nat traversal Report an error

  “Tailscale uses several very advanced techniques, based on the Internet STUN and ICE standards, to make these connections work even though you wouldn’t think it should be possible. This avoids the need for firewall configurations or any public-facing open ports”

• Derp relays Report an error

  “For those situations, Tailscale provides a network of so-called DERP (Designated Encrypted Relay for Packets) servers.”

• Derp no decryption Report an error

  “It just blindly forwards already-encrypted traffic from one node to another.”

• Tcp via derp Report an error

  “Currently this is not built into WireGuard itself, but the open source Tailscale node software includes DERP support, which adds this feature.”

• Derp open source Report an error

  “We have also open sourced the (quite simple) DERP relay server code so you can see exactly how it works.”

• Node software open source Report an error

  “except you don’t have to, since our node software is open source and we have a flexible free plan.”

• Acl central policy distributed enforcement Report an error

  “your company’s security policy is stored on the Tailscale coordination server, all in one place, and automatically distributed to each node. This way you have central control over policy, but efficient, distributed enforcement.”

• Default deny Report an error

  “If an ‘accept’ rule doesn’t exist, the traffic is rejected.”

• Key based isolation Report an error

  “Other Internet computers are unable to even request a connection, because without the right public key in the list, their encrypted packets cannot be decoded.”

• Audit logs streaming Report an error

  “Because logs are streamed in real time from each node, rather than batched, the window for local log tampering on a node is extremely short, in the order of dozens of milliseconds”

• Audit logs double logging Report an error

  “An interesting side effect of this design is that every connection is logged twice: on the source machine and the destination machine. As a result, log tampering is easy to detect, because it would require simultaneous tampering on two different nodes.”

• Log retention controllable Report an error

  “Tailscale’s central logging service has controllable retention periods and each node just logs some metadata about how your internal mesh is established, not Internet usage or personal information.”

• Logs export streaming Report an error

  “the Tailscale logging service is intended as a real-time streaming data collector that can then stream data out into other systems for further analysis.”

• Incremental deployment Report an error

  “Tailscale is uniquely suited to incremental deployments. Since you don’t need to install any hardware or any servers at all, you can get started in two minutes: just install the Tailscale node software onto two devices (Linux, Windows, macOS, iOS), login to both devices with the same user account or auth domain, and that’s it!”

• Machine certificates Report an error

  “A system administrator could also set up your machine with a “machine certificate” — a key that belongs permanently (or semi-permanently) to the device rather than to the user account.”

Scores citing this record

• The DevOps Engineer Access model & connectivity
• The DevOps Engineer Identity, access policy & device posture
• The DevOps Engineer Logs, audit trail & incident response
• The DevOps Engineer Architecture, reliability & security assurance
• The IT Lead Access model & connectivity
• The IT Lead Logs, audit trail & incident response
• The IT Lead Architecture, reliability & security assurance
• The MSP Technician Access model & connectivity
• The MSP Technician Identity, access policy & device posture
• The MSP Technician Logs, audit trail & incident response
• The MSP Technician Architecture, reliability & security assurance
• The Operations Manager Access model & connectivity
• The Operations Manager Identity, access policy & device posture
• The Operations Manager Logs, audit trail & incident response
• The Operations Manager Architecture, reliability & security assurance
• The Information Security Officer Access model & connectivity
• The Information Security Officer Logs, audit trail & incident response
• The Information Security Officer Architecture, reliability & security assurance
• The Skeptic Access model & connectivity
• The Skeptic Logs, audit trail & incident response
• The Skeptic Architecture, reliability & security assurance