Selfhosted

63543 readers

425 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

224

PSA: Update your Tailscale! (lemdro.id)

submitted 6 days ago by stratself@lemdro.id to c/selfhosted@lemmy.world

19 comments fedilink hide all child comments

Just a quick notice for anyone using this software in their homelab. Tailscale has released v1.104.4 to address a series of prominent vulnerabilities disclosed last week. These vulns affect the Tailscale Serve and Tailscale SSH functionalities of the software, and allow already-authorized attackers to gain further privileges erroneously. Kindly update to that version or higher, especially if you are using one of the SSH/Serve features.

For headscale selfhosters that also use Tailscale SSH, consider setting TS_SSH_DISABLE_FORWARDING=1 on all clients, as headscale does not have a way to force turning off SSH forwarding (one of the attack vectors). Headscale also has a relevant disclosed vulnerability affecting node registration, and an in-progress patch for that which is trackable here.

Finally, do give your SSH grants/access control list a review again. You may also disable these ssh/serve features if you don't need them (and even compile the binary without them if you know how), and consider traditional alternatives such as OpenSSH + normal reverse proxy.

Further links:

Tailscale's blogpost on findings and fixes, with security recommendations
Tailscale's security bulletin for more info on the vulnerabilities (see TS-2026-014 to TS-2026-017)
Their prior investigation notes here

you are viewing a single comment's thread
view the rest of the comments

[–] lemmyvore@feddit.nl 1 points 2 days ago (1 children)

It does, there's a lot of features and UI added on top of it because it's primarily an enterprise-oriented service and large companies tend to have a lot more complex usage scenarios than self-hosters.

Headscale is a FOSS reimplementation from scratch of some of the Tailscale proprietary features. It's inteded as a fallback option for Tailscale users in case the Tailscale service ever enshittifies, and also as a canary for ongoing verification of the Tailscale claim that the client plane functionality is entirely FOSS and above-board.

Speaking of which, Tailscale today is a great example of a company using FOSS well. They are able to provide commercial services and have proprietary code while at the same time opening the client-facing code so users can see for themselves their privacy is cryptographically proven. They also cooperate very well with Headscale and provide a generous gratis service tier.

[–] hirihit640@sh.itjust.works 1 points 2 days ago

My issue with Headscale is that it seems like they are providing a very complex product and haven't had any security audits (at least last I checked)...

Wireguard is nice because it is very simple, and thus has a much smaller attack surface.