{"slug":"tailscale-ssh-and-selinux","title":"Tailscale SSH and SELinux","tags":["tailscale"],"agent_summary":"Last validated: Jan 30, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Tailscale SSH and SELinux\r\n\r\nLast validated: Jan 30, 2026\r\n\r\nThis topic explains a message that might appear in the Tailscale client and the actions you can take to address it. For a list of currently documented messages in the Tailscale admin console and client, refer to the main [Messages](https://tailscale.com/docs/reference/messages) topic.\r\n\r\n## [Message displayed in the client](https://tailscale.com/docs/reference/messages/client/ssh-unavailable-selinux-enabled\\#message-displayed-in-the-client)\r\n\r\n> Tailscale SSH and SELinux\r\n>\r\n> SELinux is enabled; Tailscale SSH may not work.\r\n\r\n## [Message ID](https://tailscale.com/docs/reference/messages/client/ssh-unavailable-selinux-enabled\\#message-id)\r\n\r\n`ssh-unavailable-selinux-enabled`\r\n\r\n## [Why you're seeing this message](https://tailscale.com/docs/reference/messages/client/ssh-unavailable-selinux-enabled\\#why-youre-seeing-this-message)\r\n\r\nThis message appears on devices running Security-Enhanced Linux (SELinux). SELinux is a Linux security system that enforces strict rules about which programs can run and which resources they can access. Tailscale detects that its built-in SSH feature runs inside the [`tailscaled`](https://tailscale.com/docs/reference/tailscaled) process rather than the system's standard SSH daemon, and SELinux policies can restrict those SSH-related actions. Because of this, Tailscale warns that its SSH feature might not work as expected when SELinux is enforcing.\r\n\r\n## [What to do](https://tailscale.com/docs/reference/messages/client/ssh-unavailable-selinux-enabled\\#what-to-do)\r\n\r\nHere are some things you can try to resolve this issue:\r\n\r\n- To use [Tailscale SSH](https://tailscale.com/docs/features/tailscale-ssh) with SELinux, allow the `tailscaled` process to perform SSH-related actions. You can do this by running SELinux in permissive mode or creating custom SELinux policies that let `tailscaled` act as an SSH service.\r\n- If you don't need to use Tailscale SSH, ignore the warning. It does not interfere with Tailscale networking, which will continue to work as expected.\r\n- Use the standard OpenSSH server and connect to it over Tailscale instead of using Tailscale SSH.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>Tailscale SSH and SELinux</h1>\n<p>Last validated: Jan 30, 2026</p>\n<p>This topic explains a message that might appear in the Tailscale client and the actions you can take to address it. For a list of currently documented messages in the Tailscale admin console and client, refer to the main <a href=\"https://tailscale.com/docs/reference/messages\">Messages</a> topic.</p>\n<h2><a href=\"https://tailscale.com/docs/reference/messages/client/ssh-unavailable-selinux-enabled#message-displayed-in-the-client\">Message displayed in the client</a></h2>\n<blockquote>\n<p>Tailscale SSH and SELinux</p>\n<p>SELinux is enabled; Tailscale SSH may not work.</p>\n</blockquote>\n<h2><a href=\"https://tailscale.com/docs/reference/messages/client/ssh-unavailable-selinux-enabled#message-id\">Message ID</a></h2>\n<p><code>ssh-unavailable-selinux-enabled</code></p>\n<h2><a href=\"https://tailscale.com/docs/reference/messages/client/ssh-unavailable-selinux-enabled#why-youre-seeing-this-message\">Why you're seeing this message</a></h2>\n<p>This message appears on devices running Security-Enhanced Linux (SELinux). SELinux is a Linux security system that enforces strict rules about which programs can run and which resources they can access. Tailscale detects that its built-in SSH feature runs inside the <a href=\"https://tailscale.com/docs/reference/tailscaled\"><code>tailscaled</code></a> process rather than the system's standard SSH daemon, and SELinux policies can restrict those SSH-related actions. Because of this, Tailscale warns that its SSH feature might not work as expected when SELinux is enforcing.</p>\n<h2><a href=\"https://tailscale.com/docs/reference/messages/client/ssh-unavailable-selinux-enabled#what-to-do\">What to do</a></h2>\n<p>Here are some things you can try to resolve this issue:</p>\n<ul>\n<li>To use <a href=\"https://tailscale.com/docs/features/tailscale-ssh\">Tailscale SSH</a> with SELinux, allow the <code>tailscaled</code> process to perform SSH-related actions. You can do this by running SELinux in permissive mode or creating custom SELinux policies that let <code>tailscaled</code> act as an SSH service.</li>\n<li>If you don't need to use Tailscale SSH, ignore the warning. It does not interfere with Tailscale networking, which will continue to work as expected.</li>\n<li>Use the standard OpenSSH server and connect to it over Tailscale instead of using Tailscale SSH.</li>\n</ul>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}