search

juanfont / headscale

An open source, self-hosted implementation of the Tailscale control server
BSD 3-Clause "New" or "Revised" License
23.59k stars 1.29k forks source link

Security audit? #1072

Open marcelmindemann opened 1 year ago

marcelmindemann commented 1 year ago

Hi, as an avid but paranoid self-hoster, I am considering hosting headscale on a cheap VPS in order to establish VPN connections between my devices. The distrust of the closed-source Tailscale coordination server has driven me in this direction. However, I realize that self-hosting headscale makes this thing a single point of failure for my network infrastructure. An authentication bypass vulnerability in headscale could allow an attacker to infiltrate my network easily.

As headscale grows in popularity, and even got endorsed by Tailscale multiple times, I wonder if a security audit would be a worthwhile undertaking? It would certainly provide a lot more trust when opening up my headscale process to the public internet. Alas, it's the only thing I cannot hide behind a VPN, for obvious chicken-and-egg reasons :)

jgonzm commented 1 year ago

Hi,

Yes, I agree with you, but in the meantime, you could filter some ports to access only by specific IP: office & datacenters.

headscale_ports

node_key is another history...

github-actions[bot] commented 1 year ago

This issue is stale because it has been open for 180 days with no activity.

svenstaro commented 1 year ago

This shouldn't get stale botted.

github-actions[bot] commented 10 months ago

This issue is stale because it has been open for 90 days with no activity.

fortitudepub commented 10 months ago

maybe you can use the taillock to lock you devices

github-actions[bot] commented 7 months ago

This issue is stale because it has been open for 90 days with no activity.

marek22k commented 7 months ago

Anti-Stale comment

github-actions[bot] commented 4 months ago

This issue is stale because it has been open for 90 days with no activity.

marek22k commented 4 months ago

Bump

GalaxySnail commented 4 months ago

Not stale.

(Honestly, the stale bot is annoying.)

marek22k commented 4 months ago

Stale bots are always annoying!