Conversation
…ute server The Mac Studio is the Phase 8 macOS backend. Its SSH port is the server's only channel to Lume, so no other tailnet node should be able to open it. ACL rules are allow-only, so the blanket admin rule is replaced by the same reach written out, with tag:macbackend:22 and the routed 192.168.1.15:22 carved out. Tagging the host is what makes that expressible: a user-owned device is reachable through autogroup:self, which cannot be narrowed per device. Applying this needs the device tagged first, otherwise tag:macbackend matches nothing and the carve-out is inert while the admin rule is already narrowed.
The host answers on en0 192.168.1.10 and en1 192.168.1.137, not the 192.168.1.15 the first draft assumed, so the routed-path SSH carve-out covered the wrong address.
Contributor
Author
|
Superseded by #22 at the owner’s direction. Studio remains a user device; the replacement adds only tag:agentcompute, its Studio TCP 22 access, and member HTTPS access. The invalid zero-based port ranges and macbackend retagging are not carried forward. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Reserves
tag:macbackend:22fortag:agentcompute, so the agentcomputeserver VM is the only tailnet node that can reach the Mac Studio over SSH.
tag:macbackend(the Mac Studio) andtag:agentcompute(theserver VM, not yet built).
*:*wildcard and is written out with the samereach minus
tag:macbackend:22. The host's routed LAN address(
192.168.1.15:22) is carved out of the home range the same way, since itis the same sshd.
:22and nothing else onthat host; an admin device keeps
:5900, other home hosts':22, and thecluster API, but loses
:22there by tag and by routed address; a sandboxhost still reaches nothing on it.
Do not merge yet — order matters
tailscale up --advertise-tags=tag:macbackendon thehost, approved in the admin console. This re-authenticates the node and
moves it out of user ownership, so run it when a brief tailnet drop on that
workstation is acceptable.
Merging first is not dangerous, just inert:
tag:macbackendwould match nodevice while the admin rule is already enumerated.
What this does not cover
A host on the same LAN reaches
192.168.1.15:22without Tailscale at all, sothis policy is not the boundary for local traffic. The path-independent
control is on the host: the
agentcomputeaccount hasForceCommand,AllowTcpForwarding local, andPermitOpen 127.0.0.1:7777in a root-ownedsshd_config.ddrop-in, so that key cannot get a shell or forward anythingelse from any network.