Tailscale Ssh Commands

Tailscale Device Discovery & SSH Operations

A comprehensive runbook for discovering networked nodes, filtering online hosts, and executing remote commands securely over Tailscale using Tailscale SSH (zero-key credential management) and traditional SSH over WireGuard.

Trigger Phrases

Why Use Tailscale SSH?

Traditional SSH requires distributing and rotating public keys in ~/.ssh/authorized_keys across every machine.

Tailscale SSH advantages:

• Zero Key Management: Tailscale issues short-lived cryptographic credentials tied to your Tailscale identity.
• Automatic Host Key Verification: The CLI verifies host keys against the Tailscale coordination server, preventing "Host key verification failed" errors.
• Centralized ACL Controls: Control who can SSH into which machine (and as which OS user) directly from Tailscale Admin ACLs.

1. Network Discovery & Device Inspection

Quick Human-Readable Status

# List all machines in your tailnet, connection state, and direct/relay link
tailscale status

Automation Recipes with tailscale status --json

Inspect your tailnet programmatically using jq:

# List all online peers with Hostname, IPv4, and Operating System
tailscale status --json | jq -r '
  .Peer[] | select(.Online == true) | 
  "\(.HostName) \t \(.TailscaleIPs[0]) \t \(.OS)"
'

# Find the IPv4 of a specific hostname
tailscale ip -4 <hostname>

# Check if a specific host is actively connected
tailscale status --json | jq -r '
  .Peer[] | select(.HostName == "<hostname>") | .Online
'

2. Remote SSH Execution

Method A: Native tailscale ssh (Recommended)

Automatically routes through MagicDNS, manages credentials, and authenticates without manual key distribution:

# Interactive shell
tailscale ssh <user>@<hostname>

# Run a single non-interactive command
tailscale ssh <user>@<hostname> "df -h && free -m"

Method B: Standard OpenSSH over Tailscale

If standard OpenSSH is preferred, use automation-safe flags to prevent prompts from blocking agents or background scripts:

# Non-interactive execution with automatic host-key acceptance
ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new <user>@<hostname> '<remote-command>'

3. Practical Remote Inspection Recipes

# Check disk utilization on remote server
tailscale ssh user@my-server "df -h /"

# Inspect Docker container health
tailscale ssh user@my-server "docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'"

# Inspect systemd service logs (last 50 lines)
tailscale ssh user@my-server "journalctl -u my-app.service -n 50 --no-pager"

# Copy files via scp over Tailscale WireGuard link
scp -o StrictHostKeyChecking=accept-new ./build.tar.gz user@my-server:/opt/releases/

# Fast folder synchronization via rsync over Tailscale
rsync -avz -e "ssh -o StrictHostKeyChecking=accept-new" ./src/ user@my-server:/var/www/app/

4. Enabling Tailscale SSH on a Target Node

To allow incoming Tailscale SSH connections on a machine:

# Advertise Tailscale SSH capability on the target host
sudo tailscale up --ssh --accept-routes

Sample ACL Configuration (tailnet Admin Console)

To grant access in your Tailscale ACL policy:

"ssh": [
  {
    // Grant users in autogroup:admin SSH access to all tagged servers
    "action": "check",       // "check" requires periodic web re-auth; "accept" permits passwordless
    "src":    ["autogroup:admin"],
    "dst":    ["tag:servers"],
    "users":  ["ubuntu", "root"]
  }
]

5. Troubleshooting Matrix