Ephemeral Tailscale SSH Client

A portable tool for establishing temporary SSH access to remote hosts over a private Tailscale network without requiring permanent Tailscale installation or admin privileges on client machines. Also bundles a file sharing server (copyparty) for convenient file transfers.

How It Works

• Creates an ephemeral tsnet node that joins your Tailscale network
• Opens a local TCP proxy for SSH traffic through the Tailscale network
• Automatically starts a copyparty file sharing server on port 9001
• Uses native SSH client with all its features (keys, config, port forwarding)
• Removes all state on exit, leaving no traces of the connection
• No system-wide Tailscale installation required

Features

• Zero persistent state - All credentials and connection data removed on exit
• No elevation required - Runs as regular user
• Ephemeral tailnet nodes - Automatically removed from your network
• Built-in file sharing - Copyparty web server on port 9001 for easy file transfers
• Graceful cleanup - Handles Ctrl+C (SIGINT) for clean teardown
• Cross-platform - Tested on Windows & Linux
• Native SSH - Uses your existing SSH client and configuration

Installation

Prerequisites:

• Go 1.22 or later (only for building from source)
• Valid Tailscale account with auth key generation access
• SSH access enabled on the remote host

From Releases (Recommended):

Download the latest pre-built binary for your platform from the Releases page.

Linux/macOS:

# Make it executable
chmod +x <binary path>

Windows:

# Download the exe from releases
# Run directly or move to a directory in your PATH

Build from source:

Place copyparty-sfx.py in src/ before building (may be a blank placeholder; download the real one from copyparty releases to enable the file sharing feature):

git clone https://github.com/dhr412/ephemeral-tailscale
cd ephemeral-tailscale
curl -fsSL https://github.com/9001/copyparty/releases/latest/download/copyparty-sfx.py -o src/copyparty-sfx.py
go build -o tssh ./src/

Usage

./tssh [--disable-cp]

When prompted, provide:

• Tailscale ephemeral auth key
• Host Tailscale address (e.g., 100.64.1.5 or hostname.tailnet.ts.net)
• Local proxy port (default: 22122)

A copyparty file sharing server starts automatically on port 9001. Use --disable-cp to skip it.

Then connect using your SSH client:

ssh username@localhost -p 2222

Help:

./tssh help

License

This project is licensed under the MIT license.