TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-12-23 09:06:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

all: use a consistent capitalisation for "Tailnet Lock"

Browse Source 
Updates https://github.com/tailscale/corp/issues/13108

Signed-off-by: Alex Chan <alexc@tailscale.com>
This commit is contained in:
Alex Chan
2025-10-16 11:13:41 +01:00
committed by Alex Chan
parent 419fba40e0
commit 0ce88aa343
4 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
cmd/tailscale/cli/network-lock.go
View File

@@ -225,18 +225,18 @@ func runNetworkLockStatus(ctx context.Context, args []string) error {
}
if st.Enabled {
fmt.Println("Tailnet lock is ENABLED.")
fmt.Println("Tailnet Lock is ENABLED.")
} else {
fmt.Println("Tailnet lock is NOT enabled.")
fmt.Println("Tailnet Lock is NOT enabled.")
}
fmt.Println()
if st.Enabled && st.NodeKey != nil && !st.PublicKey.IsZero() {
if st.NodeKeySigned {
fmt.Println("This node is accessible under tailnet lock. Node signature:")
fmt.Println("This node is accessible under Tailnet Lock. Node signature:")
fmt.Println(st.NodeKeySignature.String())
} else {
fmt.Println("This node is LOCKED OUT by tailnet-lock, and action is required to establish connectivity.")
fmt.Println("This node is LOCKED OUT by Tailnet Lock, and action is required to establish connectivity.")
fmt.Printf("Run the following command on a node with a trusted key:\n\ttailscale lock sign %v %s\n", st.NodeKey, st.PublicKey.CLIString())
}
fmt.Println()

2
docs/windows/policy/en-US/tailscale.adml
View File

@@ -61,7 +61,7 @@ Managing authentication keys via Group Policy and MDM solutions poses significan
While MDM solutions tend to offer better control over who can access the policy setting values, they can still be compromised. Additionally, with both Group Policy and MDM solutions, the auth key is always readable by all users who have access to the device where this policy setting applies, as well as by all applications running on the device. A compromised auth key can potentially be used by a malicious actor to gain or elevate access to the target network.
Only consider this option after carefully reviewing the organization's security posture. For example, ensure you configure the auth keys specifically for the tag of the device and that access control policies only grant necessary access between the tailnet and the tagged device. Additionally, consider using short-lived auth keys, one-time auth keys (with one GPO/MDM configuration per device), Device Approval, and/or Tailnet lock to minimize risk. If you suspect an auth key has been compromised, revoke the auth key immediately.
Only consider this option after carefully reviewing the organization's security posture. For example, ensure you configure the auth keys specifically for the tag of the device and that access control policies only grant necessary access between the tailnet and the tagged device. Additionally, consider using short-lived auth keys, one-time auth keys (with one GPO/MDM configuration per device), Device Approval, and/or Tailnet Lock to minimize risk. If you suspect an auth key has been compromised, revoke the auth key immediately.
If you enable this policy setting and specify an auth key, it will be used to authenticate the device unless the device is already logged in or an auth key is explicitly specified via the CLI.

2
ipn/localapi/localapi.go
View File

@@ -424,7 +424,7 @@ func (h *Handler) serveBugReport(w http.ResponseWriter, r *http.Request) {
// OS-specific details
h.logf.JSON(1, "UserBugReportOS", osdiag.SupportInfo(osdiag.LogSupportInfoReasonBugReport))
// Tailnet lock details
// Tailnet Lock details
st := h.b.NetworkLockStatus()
if st.Enabled {
h.logf.JSON(1, "UserBugReportTailnetLockStatus", st)

2
tka/sig_test.go
View File

@@ -507,7 +507,7 @@ func TestDecodeWrappedAuthkey(t *testing.T) {
}
func TestResignNKS(t *testing.T) {
// Tailnet lock keypair of a signing node.
// Tailnet Lock keypair of a signing node.
authPub, authPriv := testingKey25519(t, 1)
authKey := Key{Kind: Key25519, Public: authPub, Votes: 2}