Add notes about current ssh status

Signed-off-by: Kristoffer Dalby <kradalby@kradalby.no>
Add experimental flag to unit test
2025-08-18 07:47:57 +00:00 · 2022-11-26 09:34:37 +01:00 · 2022-11-25 14:49:00 +01:00 · 2022-11-25 14:49:00 +01:00 · 2022-11-25 14:49:00 +01:00 · 2022-11-25 14:49:00 +01:00
1 changed files with 9 additions and 12 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,20 +7,9 @@
 - Log level option `log_level` was moved to a distinct `log` config section and renamed to `level` [#768](https://github.com/juanfont/headscale/pull/768)
 - Removed Alpine Linux container image [#962](https://github.com/juanfont/headscale/pull/962)

-### Important Changes
-
- Added support for Tailscale TS2021 protocol [#738](https://github.com/juanfont/headscale/pull/738)
- Add experimental support for [SSH ACL](https://tailscale.com/kb/1018/acls/#tailscale-ssh) (see docs for limitations) [#847](https://github.com/juanfont/headscale/pull/847)
-  - Please note that this support should be considered _partially_ implemented
-  - SSH ACLs status:
-    - Support `accept` and `check` (SSH can be enabled and used for connecting and authentication)
-    - Rejecting connections **are not supported**, meaning that if you enable SSH, then assume that _all_ `ssh` connections **will be allowed**.
-    - If you decied to try this feature, please carefully managed permissions by blocking port `22` with regular ACLs or do _not_ set `--ssh` on your clients.
-    - We are currently improving our testing of the SSH ACLs, help us get an overview by testing and giving feedback.
-  - This feature should be considered dangerous and it is disabled by default. Enable by setting `HEADSCALE_EXPERIMENTAL_FEATURE_SSH=1`.
-
 ### Changes

+- Added support for Tailscale TS2021 protocol [#738](https://github.com/juanfont/headscale/pull/738)
 - Add ability to specify config location via env var `HEADSCALE_CONFIG` [#674](https://github.com/juanfont/headscale/issues/674)
 - Target Go 1.19 for Headscale [#778](https://github.com/juanfont/headscale/pull/778)
 - Target Tailscale v1.30.0 to build Headscale [#780](https://github.com/juanfont/headscale/pull/780)
@@ -40,6 +29,14 @@
 - Fix OIDC registration issues [#960](https://github.com/juanfont/headscale/pull/960) and [#971](https://github.com/juanfont/headscale/pull/971)
 - Add support for specifying NextDNS DNS-over-HTTPS resolver [#940](https://github.com/juanfont/headscale/pull/940)
 - Make more sslmode available for postgresql connection [#927](https://github.com/juanfont/headscale/pull/927)
+- Add experimental support for [SSH ACL](https://tailscale.com/kb/1018/acls/#tailscale-ssh) (see docs for limitations) [#847](https://github.com/juanfont/headscale/pull/847)
+  - Please note that this support should be considered _partially_ implemented
+  - SSH ACLs status:
+    - Support `accept` and `check` (SSH can be enabled and used for connecting and authentication)
+    - Rejecting connections **are not supported**, meaning that if you enable SSH, then assume that _all_ `ssh` connections **will be allowed**.
+    - If you decied to try this feature, please carefully managed permissions by blocking port `22` with regular ACLs or do _not_ set `--ssh` on your clients.
+    - We are currently improving our testing of the SSH ACLs, help us get an overview by testing and giving feedback.
+  - This feature should be considered dangerous and it is disabled by default. Enable by setting `HEADSCALE_EXPERIMENTAL_FEATURE_SSH=1`.

 ## 0.16.4 (2022-08-21)
Author	SHA1	Message	Date
Kristoffer Dalby	51fb014e58	Add notes about current ssh status Signed-off-by: Kristoffer Dalby <kradalby@kradalby.no>	2022-11-26 09:34:37 +01:00
Even Holthe	1acf5e5791	Add experimental flag to unit test	2022-11-25 14:49:00 +01:00
Even Holthe	fc00cb3aa4	Add SSH ACL to changelog	2022-11-25 14:49:00 +01:00
Kristoffer Dalby	b4c63a7e0a	Mark the flag properly experimental Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-25 14:49:00 +01:00
Kristoffer Dalby	1297616a65	Enable SSH for tests Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-25 14:49:00 +01:00
Kristoffer Dalby	5038761eca	Add feature flag for SSH, and warning Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-25 14:49:00 +01:00
Kristoffer Dalby	5b25c4c3d5	Allow WithEnv to be passed multiple times Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-25 14:49:00 +01:00
Kristoffer Dalby	f9ade5ea37	Mark all tests with Parallel Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-25 14:49:00 +01:00
Kristoffer Dalby	10feae2d4b	Do not retry on permission denied in ssh Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-25 14:49:00 +01:00
Kristoffer Dalby	1ecb3e4c2a	Strip newline from hostname Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-25 14:49:00 +01:00
Kristoffer Dalby	f72de09cd9	Add negative tests Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-25 14:49:00 +01:00
Even Holthe	794e57f1c2	SSH: add test between namespaces	2022-11-25 14:49:00 +01:00
Even Holthe	37bc8f364f	SSH: Lint and typos	2022-11-25 14:49:00 +01:00
Kristoffer Dalby	5e0ba8c70f	Make simple initial test case This commit makes the initial SSH test a bit simpler: - Use the same pattern/functions for all clients as other tests - Only test within _one_ namespace/user to confirm the base case - Use retry function, same as taildrop, there is some funky going on there... Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-25 14:49:00 +01:00
Kristoffer Dalby	d4a51b0d2a	Add method to expose container id Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-25 14:49:00 +01:00
Kristoffer Dalby	44e37e21c2	Ensure we have ssh in container Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>	2022-11-25 14:49:00 +01:00
Even Holthe	93d03029e4	SSH integration test setup	2022-11-25 14:49:00 +01:00
Even Holthe	cd6df097ad	Add SSH capability advertisement Advertises the SSH capability, and parses the SSH ACLs to pass to the tailscale client. Doesn’t support ‘autogroup’ ACL functionality. Co-authored-by: Daniel Brooks <db48x@headline.com>	2022-11-25 14:49:00 +01:00