Hardening Tailscale on a Modern System

Tailscale is cool, and it provides a guide to harden a modern system with some additional security practices here. One tiny problem, its for Ubuntu.

As superior Archlinux users, we need updated instructions for hardening stuff - so here it is.

1. Create a tailscale user

# useradd --no-create-home --user-group --shell /bin/nologin tailscale

2. Add the polkit rule to allow the tailscale user to change DNS settings

// Polkit rules are written in Javascript. LOL. Assume ES5

polkit.addRule(function(action, subject) {

  var isValidGroup = subject.isInGroup("tailscale") || subject.isInGroup("wheel");

  var isValidAction = action.id.lastIndexOf("org.freedesktop.resolve1.", 0) === 0;

  if (isValidGroup && isValidAction) {

    return polkit.Result.YES;

  }

});

3. Apply systemctl override to tailscaled.service

# https://tailscale.com/kb/1279/security-node-hardening

[Service]

User=tailscale

Group=tailscale

DeviceAllow=/dev/net/tun

AmbientCapabilities=CAP_NET_RAW CAP_NET_ADMIN CAP_SYS_MODULE

ProtectKernelModules=no

RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK

NoNewPrivileges=yes

PrivateTmp=yes

PrivateMounts=yes

RestrictNamespaces=yes

RestrictRealtime=yes

RestrictSUIDSGID=yes

MemoryDenyWriteExecute=yes

LockPersonality=yes

ProtectHome=yes

ProtectControlGroups=yes

ProtectKernelLogs=yes

ProtectSystem=full

ProtectProc=noaccess

SystemCallArchitectures=native

SystemCallFilter=@known

SystemCallFilter=~@clock @cpu-emulation @raw-io @reboot @mount @obsolete @swap @debug @keyring @mount @pkey

That should give you a "more secure" daemon running as it's own user that drops root and severely restricts access and privs. I also lock down my zerotier-one.service as well, at least with the systemctl override file (not sure about whether zerotier can run under a non-root user, so steps 1 and 2 don't apply yet.)

Stay safe.

Stay tuned!

 ========================
Follow pyamsoft around the Web for updates and announcements about the newest applications!
Like what I do?

Send me an email at: pyam.soft@gmail.com
Or find me online at: https://pyamsoft.blogspot.com

Follow my Facebook Page
Check out my code on GitHub
=========================