FR: Fast user switching

[apenwarr]

(context added on 2022/09/14)

What are you trying to do?

Log into multiple tailscale accounts at once (eg. example@gmail.com and example@example.com) and easy switch between accounts, i.e. improve the "Log in to a different account..." flow on a device, (possibly) without requiring re-authentication. Access only machines on the network you are currently logged into.

FR to access all the machines on both networks simultaneously: #183

How should we solve this?

The basics of this are not that complicated to do purely client side:

• have ipn.Backend start multiple controlclient instances, one per login
• merge the netmaps from the two instances and feed the merged result to wgengine

Complexity arises from specific details:

1. Should we have multiple local IP addresses, one per account? Is that even possible on all platforms? Or should we get help from the control server to assign the same IP address to all accounts? But if we do that, what about accounts with custom IP subnet designations?

2. If we have multiple local IP addresses, there needs to be a good way to choose which local IP address to use for a given outgoing connection. (Based on routes?)

3. If we use a single local IP address, this could violate users' privacy expectations. Their distinctive identities end up tied together in the control server. It's a lot more elegant if we can support multi-login entirely client side.

4. If two accounts export the same subnet routes (--advertise-subnets), you can get conflicts between them.

5. If two accounts have different DNS overrides, they can conflict. (This isn't so bad if we use the DNS settings only for particular subdomains rather than globally.)

6. Corporate admins may not like the idea of a single machine being on both the corporate and non-corporate networks at once (although it's probably not as bad as being on both the Internet and the corporate network at once.)

[happyalu]

Although not at the same time, I find it useful to be able to switch accounts to access different groups of machines from my laptop. Prior to 1.0, with the tailscale-linux-switchuser tool I was saving copies of relay.conf for different email addresses and setting relay.conf to the required account. It seems that now the information is saved in tailscaled.state with a base64 encoded field.

I tried to save this new file for different email addresses similarly, and copy the right one for the address I want to login to tailscale with, but that didn't seem to work even after restarting tailscaled. Is there an easy way to switch accounts in the current setup? I thought I'll ask before trying to dive down into finding the details of the new file :)

[apenwarr]

Note: related issue: #183

[apenwarr]

@happyalu, a workaround for user switching is to install the latest unstable tailscale stream (at least version 1.1.372) and try the tailscale up --force-reauth option. This should let you switch between accounts more easily than by switching config files entirely.

[DentonGentry]

Related issue: #662

[noopsy]

tailscale up --force-reauth will create a new machine and with a new tailscale IP in the tailscale admin panel. I have found that I need to delete the old machine in the tailscale admin panel before I can get network connectivity to/from the new machine/IP. All systems I was testing with were running linux, tailscale client version 1.4.4

[pirate]

A hacky 🧙‍♂️ workaround to achieve this is to run two separate tailscale containers in Docker and connect them to a shared container LAN. Then you can manually route any traffic that you want to expose/route to those networks from the host using iptables rules.

docker-compose.yml:

version: '2.4'
services:
    tailscale1:
        hostname: tailscale1
        image: tailscale:latest
        build: https://github.com/tailscale/tailscale.git#v1.4.4
        command: tailscaled
        networks:
            tslan0:
                ipv4_address: 192.168.99.10
        cap_add:
            - NET_ADMIN
        volumes:
            - /dev/net/tun:/dev/net/tun
            - ./tailscale1_state:/var/lib/tailscale
            
     tailscale2:
        hostname: tailscale2
        image: tailscale:latest
        command: tailscaled
        networks:
            tslan0:
                ipv4_address: 192.168.99.20
        cap_add:
            - NET_ADMIN
        volumes:
            - /dev/net/tun:/dev/net/tun
            - ./tailscale2_state:/var/lib/tailscale

networks:
  tslan0:
    external: true
    name: tslan0

# create the virtual LAN that will be shared by the two hosts, each connected to a separate tailscale network
docker network create --driver=bridge --subnet=192.168.99.0/16 tslan0

# then make any forwarding rules you want with iptables, e.g.
# iptables -t nat -A PREROUTING -p tcp --dport 8000 -j DNAT --to-destination 192.168.99.10:8000
# iptables -t nat -A POSTROUTING -j MASQUERADE

# then start the containers and log into your two separate tailscale accounts
docker-compose up
docker-compose exec tailscale1 tailscale up   # click the link and auth node 1 to account #1 (then clear your cookies / logout)
docker-compose exec tailscale2 tailscale up   # click the link and auth node 2 to account #2 (using your other tailscale account)

It's a bit cumbersome, but better than nothing. If you have trouble, experiment with adding cap_add: - SYS_MODULE, volumes: - /lib/modules:/lib/modules, and privileged: true as a last resort. I haven't figured out how to get it working with network_mode: host yet, but if that's possible then maybe we can merge the two TS networks on a single host.