cmd/tailcat, README.md: warn when a DNS-named SSH destination is wide open

[bradfitz]

A tailcat address published in a DNS TXT record is public, so the
server behind it must authenticate clients by something other than
possession of the address (--allow or --ssh-authorized-keys). People
were missing that connection and publishing no-auth-ssh servers in
DNS, handing a shell to anyone who reads the record.

Make the README say this explicitly in every section that touches
DNS TXT records or auth-free SSH, and make "tailcat ssh" catch the
misconfiguration: before connecting to a DNS-named destination, probe
the server the way a stranger would, with a freshly generated node
key and no SSH credentials, only the "none" auth method that the
no-auth-ssh service accepts. The probe authenticates only, with no
command or PTY request. If the server accepts the stranger, refuse
to connect and explain how to lock it down, unless the new
--skip-dns-safety-check flag is set (which also saves the probe's
round trips). Probe failures are not fatal: a --allow-protected
server ignores strangers entirely, so the probe just times out and
the real connection proceeds.

This can't catch someone who publishes an open server and never
connects to it, but the common path is to test your own server right
after setting it up, and the first such test now sounds the alarm.

Fixes #100

[raggi]

People were missing that connection and publishing no-auth-ssh servers in
DNS, handing a shell to anyone who reads the record.

fwiw, I don't think we've seen anyone actually do this?

[bradfitz]

fwiw, I don't think we've seen anyone actually do this?

Yeah, I guess the "could've potentially been" was too implicit there.

I think the intersection of:

• people who use tailcat
• people who use its SSH mode
• people who don't understand that DNS TXT records are public
• ... people who have a domain name
• people who don't understand how tailcat works
• people who then publish those tailcat addresses of their wide open SSH serverrs

... it zero.

Many of those factors alone are basically zero.