Shellius vs. Tailscale SSH
These two are less competitors than different layers. Tailscale is a network that also authenticates SSH. Shellius is an SSH certificate authority that assumes you already have a network.
TL;DR
| Tailscale SSH | Shellius | |
|---|---|---|
| What it is | A feature of a WireGuard mesh VPN. The Tailscale daemon on the host accepts SSH connections and authenticates them by tailnet identity. | A certificate authority with policy, approvals and audit. Hosts run stock OpenSSH. |
| Network | Provides it. Every machine joins the tailnet. | Does not provide one. Something must already route to port 22. |
| Who decides access | Tailnet ACLs, written as policy. | Access policies plus, for production, a human approver per request. |
| Time-boxed access | Re-authentication ("check mode") for sensitive connections. | Every grant has an expiry; certificates carry a validity window. |
| Control plane | Hosted by Tailscale. | You host it. You hold the CA. |
| RDP | Reachability only — you still manage Windows credentials. | Browser RDP with the password injected, never shown. |
Where Tailscale SSH is clearly ahead
- It solves reachability. NAT, roaming laptops, multi-cloud — handled. This is the hard part Shellius leaves to you.
- Nothing to operate. No database, no backups, no CA key to guard.
- Setup time. Minutes.
Where Shellius is a better fit
- A person must approve production access. ACLs describe standing permission. Shellius models a request: who asked, why, who approved, for how long.
- The control plane must be yours. With Shellius, the CA your fleet trusts never leaves your infrastructure.
- Users without a client. A contractor can reach a host from a browser without installing anything or joining your network.
- You need Windows desktops too, without handing out the password.
Using both
They compose well. Run Shellius inside the tailnet: Tailscale provides the network path, including for the terminal client, and Shellius provides certificates, approvals, recording and the audit trail on top of stock OpenSSH.