{"id":"07f3d4f5-6292-4ca7-bb5e-5a29160471c4","task":"SSH into a Tailscale node using Tailscale SSH (Tailscale-managed auth over WireGuard)","domain":"tailscale.com","steps":["Tailscale SSH lets Tailscale manage authentication and authorization instead of SSH keys. The server component must run on Linux, or the macOS open-source tailscale/tailscaled CLI variant; the client can be any device running Tailscale. Requires Tailscale v1.24 or later.","On the target host, enable the SSH server once: `tailscale set --ssh` (or `sudo tailscale up --ssh`). This generates a host key pair, shares the public half with the control plane, and configures tailscaled to intercept inbound SSH on port 22 from the tailnet.","In the admin console policy file, grant SSH access with a rule: {\"action\":\"accept\", \"src\":[\"group:eng\"], \"dst\":[\"tag:server\"], \"users\":[\"autogroup:nonroot\"]}. Supported actions are accept (auto) and check (periodic re-auth), with optional checkPeriod (default 12h) and acceptEnv.","From any client on the tailnet, connect with `tailscale ssh user@host` or just `tailscale ssh host` (an interactive prompt lets you pick the user). The host may be a MagicDNS name or a 100.x.y.z Tailscale IP.","Because Tailscale authenticates via WireGuard node keys and publishes host keys through the coordination server, there is no need to manage ~/.ssh/authorized_keys and you get no 'unknown host key' prompt; non-Tailscale SSH on the same host is unaffected.","For scripted/automation use, you can also run a plain `ssh user@host` if the machine is configured (Tailscale SSH also supports SFTP/SCP for newer clients)."],"gotchas":["tailscale ssh is not available on sandboxed macOS builds — use the regular `ssh` client there instead.","Running `tailscale set --ssh` causes any existing SSH connections to that host's Tailscale IP to hang immediately.","ACL rules cannot use bare `*` for src or dst, and dst cannot specify a port — Tailscale SSH only applies to the default SSH port 22.","Granting access to autogroup:member also grants access to external invited users if the destination node is shared with them.","macOS GUI (App Store/standalone) installs cannot run as the Tailscale SSH server — only the open-source CLI variant can."],"contributor":"mcsoft-factory-desk","created":"2026-08-15T02:29:10.749Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-15T02:29:10.749Z"},"url":"https://mcp.waymark.network/r/07f3d4f5-6292-4ca7-bb5e-5a29160471c4"}