Join us in San Francisco for TailscaleUp!Grab your ticket ->

Get started with Tailscale PAM

Last validated:
Tailscale PAM is currently in beta.

This guide walks you through enabling Tailscale PAM so you can begin to provide privileged access for your Tailscale network (known as a tailnet). To learn more about what Tailscale PAM does before you start, refer to What is Tailscale PAM?.

Prerequisites

Before you begin, confirm you have the following:

  • A tailnet. If you do not have a tailnet, sign up.

  • Tailscale PAM integration is enabled for your tailnet. If you want to try Tailscale PAM for free, join the waitlist. To learn more about Tailscale PAM for your organization, contact Tailscale Sales.

  • A Tailscale account with Owner, Admin, or IT admin permissions, so you can use the Tailscale admin console to enable Tailscale PAM for your tailnet.

  • A device to use as a Tailscale PAM connector. This topic will show you how to configure this device as a Tailscale PAM connector. The device must satisfy one of the following options:

    • Linux
    • AWS EC2
    • Docker
    • Kubernetes

  • A device to use when you want to access a privileged resource. This device must satisfy one of the following options:

    • A device with Tailscale installed and running so that you can use the Tailscale PAM connector to get privileged access to the resources on your tailnet. For information about installing Tailscale, refer to Install Tailscale.
    • A device with a browser. This would let you access a resource protected by Tailscale PAM without installing the Tailscale client on the device.

Step 1: Enable the Tailscale PAM integration for your tailnet

  1. Open the General settings page of the Tailscale admin console.
  2. In the Feature previews section, enable Privileged Access Management by Tailscale PAM (Beta).

Step 2: Create a Tailscale PAM connector

  1. Open the Connectors page of the admin console.
  2. Select Add New Connector.
  3. Select the platform that you want to use for the connector.
  4. In the Launch New Connector section, follow the instructions and apply them to the device that you want to use as your connector.

The Tailscale PAM connector has Tailscale capability built into it and will automatically join your tailnet. For more information about Tailscale PAM connector installation, refer to Installing a Tailscale PAM connector.

Step 3: Secure a resource

You can now use Tailscale PAM to create secure access to resources in your tailnet. The resources that you secure are referred to as services in Tailscale PAM. Tailscale PAM treats services as the application-aware proxies that handle connections securely.

For examples, refer to the following guides.

Step 4: Grant network access in your tailnet policy

Tailscale PAM controls what a user can do once they connect to a resource at the protocol level, such as which commands they can run or which databases and queries they can access. Your tailnet policy file controls whether a user's device can reach that resource over the tailnet in the first place. Both layers apply, so after you secure a resource you must add a grant that permits network access to it. Enabling the integration alone is not enough.

When you secure a resource, Tailscale PAM exposes it as a Tailscale service (svc:<name>) tagged tag:border0-managed. You write the grant against that tag or service. This grant lets every member of your tailnet reach all Tailscale PAM resources:

// Allow everyone to access Tailscale PAM resources
{
    "src": ["autogroup:member"],
    "dst": ["tag:border0-managed"],
    "ip":  ["*"],
},

You do not have to allow everyone. Because Tailscale PAM already enforces fine-grained, per-protocol access, this grant only needs to be broad enough to reach the resources. You can scope src to a subset of users and dst to individual resources instead:

// Allow a subset of users to reach specific Tailscale PAM resources
{
    "src": ["group:db-admins"],
    "dst": ["svc:prod-postgres", "svc:staging-postgres"],
    "ip":  ["*"],
},

Step 5: Access a service

Once you create a service, members of your tailnet with the appropriate access have two ways to access the service.

  • They can download the Tailscale client and join their device to your tailnet.
  • They can use a browser by opening the Tailscale PAM web client. This is the web-based client for service access. When prompted, members of your tailnet can log in with the same account they use for Tailscale.

Once logged in to either the Tailscale client or the web-based client, members of your tailnet can access the services that you configured for them.

Next steps

Explore the following resources on the Tailscale PAM site.