Security & Reliability
Do You Still Need a Bastion Host? How Tailscale SSH Handles Keys and Authentication
Tailscale SSH claims port 22 on your tailnet IP, swaps authorized_keys for control-plane-managed node keys, and distributes host keys automatically — which makes your bastion host look suddenly redundant. Here is exactly what changes under the hood, plus the honest cases where you should still keep…
Sep 3, 2026Read article