See everything you missed at TailscaleUp.Read the recap →

Get started with Tailscale PAM

Last validated:
Tailscale PAM is currently in beta.

This guide walks you through enabling Tailscale PAM so you can begin to provide privileged access for your Tailscale network (known as a tailnet). To learn more about what Tailscale PAM does before you start, refer to What is Tailscale PAM?.

The following related video provides additional context and examples.

What happens when you enable Tailscale PAM

When you enable Tailscale PAM from the PAM page in the Tailscale admin console, Tailscale automatically configures your tailnet with everything needed to start using PAM. This lets you get started without manually configuring tags, service approvals, credentials, or initial access rules.

Tailscale automatically:

  • Creates the tag:border0-managed tag. PAM-managed resources, including connectors and services, use this tag. The tag is owned by autogroup:admin.
  • Adds an autoApprovers rule. Connectors tagged with tag:border0-managed can automatically approve PAM services using the same tag. This means you don't need to manually approve each PAM service advertisement.
  • Adds an initial PAM application grant. Members of autogroup:admin are granted access to PAM services tagged with tag:border0-managed, giving administrators initial access to supported PAM services such as SSH, databases, Kubernetes, RDP, and HTTP.
  • Creates a trust credential for Tailscale PAM. This OpenID Connect (OIDC) trust credential is used for the integration between your tailnet and the Tailscale PAM API service. You can view it in the Trust credentials page. The automatically created credential is tagged with tag:border0-managed.

These settings are created automatically so PAM works out of the box. Avoid removing or modifying the automatically created tag, autoApprovers rule, or trust credential unless you intend to replace that configuration, as doing so can prevent parts of the PAM integration from working correctly.

You can customize the automatically created PAM grant as needed to control which users can access your PAM services and what they are allowed to do.

Prerequisites

Before you begin, confirm you have the following:

  • A tailnet. If you do not have a tailnet, sign up.

  • Tailscale PAM integration is enabled for your tailnet. If you want to try Tailscale PAM for free, join the waitlist. To learn more about Tailscale PAM for your organization, contact Tailscale Sales.

  • A Tailscale account with Owner, Admin, or IT admin permissions, so you can use the Tailscale admin console to enable Tailscale PAM for your tailnet.

  • A device to use as a Tailscale PAM connector. This topic will show you how to configure this device as a Tailscale PAM connector. The device must satisfy one of the following options:

    • Linux
    • AWS EC2
    • Docker
    • Kubernetes

  • A device with a browser OR a device with the Tailscale client installed. This will be used to access the PAM service.

Step 1: Enable the Tailscale PAM integration for your tailnet

Open the PAM settings page of the Tailscale admin console and select Enable.

Step 2: Create a Tailscale PAM connector

  1. Open the Connectors page of the admin console.
  2. Select Add connector.
  3. Select the platform that you want to use for the connector.
  4. In the Launch new connector section, follow the instructions and apply them to the device that you want to use as your connector.

The PAM connector has Tailscale capability built into it and will automatically join your tailnet. For more information about Tailscale PAM connector installation, refer to Installing a Tailscale PAM connector.

Step 3: Define a PAM service

You can now use Tailscale PAM to create secure access to resources in your networks. The resources that you secure are referred to as PAM services. Tailscale PAM uses the PAM connector to securely proxy sessions to PAM services.

For an example, use Tailscale's sandbox server. In this example, you can use Secure Shell (SSH):

  1. Open the Services page of the Tailscale admin console.
  2. Select Add service.
  3. Select PAM service.
  4. Select Secure Shell - Standard Shell.
  5. On the right, select Use Tailscale sandbox server.
  6. Select the PAM connector that you created.
  7. Select Continue.
  8. Select Save, as the username and password are already filled in.

Step 4: Access a service

Once you create a service, members of your tailnet have two ways to access the service:

  • They can download the Tailscale client and join their device to your tailnet.
  • They can use a browser by accessing my.tailscale.com. This is the web-based client for PAM service access and does not require any downloads. When prompted, members of your tailnet can log in with the same account they use for Tailscale.

Once logged in to either the Tailscale desktop client or the browser client, members of your tailnet can access the services that you configured for them.

Next steps

Explore the following resources on the Tailscale PAM site.

Configure your own PAM Services:

Learn more about Tailscale PAM: