The beta can restrict access to a particular service and time window without giving the user a database password. It requires a connector.
A contractor needs access to one database for a few hours. How do you grant it without sending over the database password? Tailscale introduced a PAM beta on August 27 for this kind of task. Tailscale connects devices and company resources in a private network; PAM adds controls for access to individual services. Tailscale’s announcement sets out the product.
An administrator selects the user, service and permitted time. Access requests can be approved in Slack. The beta supports SSH and RDP connections to servers, databases, Kubernetes and web applications. Session recording is also available, depending on the protocol.
What needs to be configured
The company must deploy a connector inside its network. This intermediary can reach the database and initiates an outbound connection to the PAM service. The database does not need to be exposed to the public internet.
The user signs in with their own Tailscale identity and continues to use their usual database client. The connector uses the database credentials, so the team does not have to distribute a shared password. The database’s own authentication remains in place. Tailscale’s database guide shows the flow.
Access to the beta is limited by a waitlist. The announcement does not give a public price; Tailscale directs interested teams to sales.