Tailscale PAM FAQ

Last validated: Jul 6, 2026View as Markdown

Tailscale PAM is currently in beta.

Are there sandbox servers I can use with Tailscale PAM?

Yes. If you want to experiment with Tailscale PAM without using your own servers, you can use various public sandbox servers as origin servers. Use these servers to test different Tailscale PAM service types and configurations before connecting your own infrastructure.

The sandbox servers are intended for testing only. Don't use them for sensitive or production data. They are periodically reset.

The sandbox includes services for SSH, HTTP, MySQL, PostgreSQL, VNC, RDP, and TCP. The following shows information about the available services, ports, and credentials.

Type	Server	Port	Credentials
SSH	`ssh.playground.border0.io`	`22`	Username: `border0` Password: `Border0<3Ssh`
HTTP	`http.playground.border0.io`	`80`	No authentication required
MySQL	`mysql.playground.border0.io`	`3306`	Username: `border0` Password: `Border0<3MySql`
PostgreSQL	`psql.playground.border0.io`	`5432`	Username: `border0` Password: `Border0<3Psql`
VNC	`vnc.playground.border0.io`	`5900`	Password: `Border0<3VNC`
TCP Echo	`tcp.playground.border0.io`	`9000`	No authentication required

Which database clients does the Tailscale client recognize?

When you select a database service in the Tailscale client, the client tries to detect well-known database applications installed on your device. If it finds one, Tailscale can launch the application with the connection configuration for the PAM service.

The following database clients are currently recognized:

mycli
pgcli
psql
CockroachDB SQL shell
DataGrip
DBeaver
MySQL
MySQL Workbench
pgAdmin
TablePlus

You aren't limited to these database clients. If your preferred client isn't in this list, the Tailscale client won't automatically detect and launch it for you, but you can still use it with Tailscale PAM.

Start your database client manually and configure it to connect to the Tailscale PAM service name. You can then authenticate using your Tailscale identity.

How do I make Tailscale PAM services highly available?

For high availability, deploy two or more Tailscale PAM connectors that can independently reach the same service. A PAM service can be linked to multiple connectors, so if one connector becomes unavailable, clients can use another available connector to reach the service.

For the best availability, deploy connectors across separate failure domains, such as different hosts, availability zones, or regions, and make sure each connector can independently reach the service.

When multiple connectors are available for a service, the Tailscale client selects the most stable connector. This is typically the connector that has maintained its peer connection for the longest time. Connector selection is based on connection stability rather than round-robin load balancing.

If the active connector becomes unavailable, new connections use another available connector. Existing TCP connections that pass through the failed connector are interrupted and need to reconnect.

For more information, refer to Tailscale PAM connector high availability.

How do I check or upgrade the Tailscale PAM connector version?

The Tailscale PAM connector binary is named tailzero.

To check the version of the connector you're running:

tailzero version check

To upgrade to the latest version:

sudo tailzero version upgrade
sudo systemctl restart tailzero

The tailzero version upgrade command downloads the latest connector binary and replaces the currently installed version. Restart the tailzero service after the upgrade for the new version to take effect.