Privileged access
Tailscale SSH: privileged access without separately distributed user SSH keys.
Tailscale SSH can bind a port-22 connection to tailnet identity and policy. Check mode can require IdP reauthentication; time-limited access is implemented through an appropriate JIT workflow rather than assumed from one SSH rule.
Three distinct models
Private SSH connectivity, Tailscale SSH and PAM are not interchangeable.
Standard SSH can run over a tailnet while the host's SSH daemon keeps authentication responsibility. Tailscale SSH instead handles authentication and authorisation for Tailscale-originated port-22 traffic and requires both network access and an SSH access rule. It does not control standard SSH on other interfaces or other TCP connections.
Tailscale SSH
The server component supports Linux and the open-source tailscale/tailscaled variant on macOS. Clients can connect from any supported platform.
Check and JIT
Check mode reauthenticates at a configured interval. JIT entitlement can be granted and expired through an IdP/SCIM group, posture attribute, automation or an approved integration; the approval workflow must be designed explicitly.
Border0 / PAM
Tailscale's beta Border0 product adds broader privileged-access workflows and application/session controls. It is separate from core Tailscale SSH and is not a current standard Defense First deliverable.
Production questions
Privileged access requires more than an SSH rule.
- Who approves access, and to which existing local user?
- How is the JIT entitlement granted, expired and revoked?
- How does break-glass access work without creating an unsafe lockout?
- Where are audit and session recordings retained?
- How are network access, SSH rules and ordinary SSH paths tested?
Session-recording boundary
Tailscale SSH session recording is beta and currently available on Personal and Enterprise plans. It requires a recorder node and records terminal output, not keystrokes. Sessions fail open when recorders are unreachable unless enforceRecorder is enabled; fail-closed availability, sensitive output, storage and access to the recorder must be tested.
AIM model
Privileged access is built around the use case.
Advice defines administrator groups, check/JIT principles and the break-glass model. Integrate implements the SSH policy, entitlement workflow, negative tests and logging. Manage maintains groups, rules, recording and reviews.
