Tailscale Authentication for Nginx(tailscale.com) |
Tailscale Authentication for Nginx(tailscale.com) |
It's a generic setup where you can do _anything_ you want via firing off an HTTP request as a clone of the original, and re-handling the request after getting back the response.
Big shoutout to the Authelia team for helping out with testing and confirming that it works. Will be merged very soon (today?) and some follow-up work is coming to make the config for it even shorter (some sugar for the common forward_auth usecase).
One interesting enhancement, which is probably not within scope of this tool, would be a way to logically AND a bunch of these auth tools together. With that you could use this tool without changes to assert that someone is allowed on the tailnet then pass those results to a second process that checks what groups they belong to and authorizes them for the particular upstream being checked. One could accomplish that with one nginx proxy per application, of course, and lean into Tailscale's ACLs for authz.
And if you don't have time or want to do that, check out Pomerium it's basically a forward auth proxy with OPA policy engine integrated into it already: https://www.pomerium.com/
location /auth {
...
proxy_set_header X-Required-Caps $required_caps;
...
}
location /grafana {
...
set $required_caps "grafana.com/read,grafana.com/write"
auth_request_set $auth_caps $upstream_http_tailscale_caps;
proxy_set_header X-Webauth-Caps $auth_caps;
...
}
Now all I want from them is a way to bind an auth key to a specific IP address (for containers when they restart they keep the same DNS record). I only mention this because I know the devs read HN and I'm hoping they'll see this :)
I may have missed this in the post, but is there any plans to make a general purpose one rather than Grafana, etc? like tailscaled --proxy --to or (and I saw mholt's post) just rely on something like Caddy for that?
I'd love to be able to control some of these kinds of things right in the Admin UI.
Like being able to say "create new proxy, use this relay that gets me into this network, look at this acl to decide who gets in"
I could see this as really useful for the long tail of "admin" type services. Like admin UIs for Sidekiq (Ruby bg jobs) or Oban (Elixir bg job), our HashiCorp Nomad or Consul admin screens, etc without having to mess around with extra tokens.
For this implementation, how does the request work for the user? Is it http-auth, or some other SSO web login form?
You could do other things too like exposing services publicly without auth (by tailscale anyway) like ngrok.
I can conceptualize it well, but, I'm not a huge fan of the idea honestly primarily because tailscale is so easy to use.
The post briefly mentions that the proxy can be set to listen a unix socket instead of a TCP socket. Is that referring only to the subauth socket, or the entire nginx? It seems like the real security value is in the latter, but that would be nginx config right? Setting it to only accept traffic from Tailscale rather than from :80?
I'm imagining a use-case where Tailscale + Nginx is acting kind of like an Azure App Proxy where you want to ensure that all access to the upstream service is validated against the Tailscale ACL. Maybe that's already implicitly the case since the auth_request goes to nginx-auth, so any traffic that isn't coming from a Tailscale IP is going to be denied anyways.
[1] https://doc.traefik.io/traefik/middlewares/http/forwardauth/
Good job Tailscale!
the good thing is a lot of stuff kind of implicitly checks the host header. like if you are using vhosting (without a default) then you have an implicit host header check even if you didn't set it up explicitly for security.
EDIT: and of course if you are using HTTPS then it should not be an issue because the server will not be able to serve a certificate that matches the hostname.
The disadvantage to Tailscale’s implicit authentication is that it can’t take advantage of modern features like SameSite cookies, which can be a strong defense against CSRF. You would need to implement CSRF tokens everywhere, or try to rely on Origin/Referer (which is sketchy).