The --ssh flag runs Tailscale's own SSH server, so authorized tailnet users can connect with plain tailscale ssh and never handle keys or passwords. Access is governed by your tailnet's access control policy instead of sshd config. Traditional sshd on port 22 continues to work alongside it.
Looking for more? Search all 7,657 commands — works offline, in English or Spanish, and fixes typos.