juanfont / headscale

An open source, self-hosted implementation of the Tailscale control server
BSD 3-Clause "New" or "Revised" License
22.1k stars 1.23k forks source link

Some Permission denied by ACL when same tags on a couple of clients #1838

Open masterwishx opened 5 months ago

masterwishx commented 5 months ago

in Docker by Nginx Proxy Manager on Oracle VPS in Ubuntu using lasted version v0.23.0-alpha5

For webUI https://github.com/goodieshq/headscale-admin

When using same tag for couple of client ,then some clients not working as in ACLs . i tryed soem other tag but the same behavior :

tgas to client added from

  1. vps - tag:cloud-server
  2. vps - tag:cloud-server
  3. vps - tag:cloud-server
  4. unraid server - tag:home-server
  5. win11 - tag:home-pc
  6. vm - tag:home-server

i run tailscale ssh enabled on 3 vps , but vps 3 cant ssh to vps 2, but can to vps 1 other vps working fine . also from unraid cant ssh to all vps ,only after changed tag on vm to test so unraid have unique tag then its working ...

Befor used other tags - like cloud,server ... Tags added by headscale-admin

my ACL for now :

{
  "groups": {
    "group:admin": ["user1"]
  },

  "tagOwners": {
    "tag:cloud-server:*": ["group:admin"],
    "tag:home-pc:*": ["group:admin"],
    "tag:home-server:*": ["group:admin"],
    "tag:home-vm:*": ["group:admin"],
    "tag:mobile:*": ["group:admin"]
  },

  "acls": [
    {
      "action": "accept",
      "src": ["group:admin"],
      "dst": ["*:*"]
    }
  ],

  "ssh": [
    {
      "action": "accept",
      "src": ["tag:cloud-server", "tag:home-server", "tag:home-pc"],
      "dst": ["tag:cloud-server"],
      "users": ["root", "ubuntu"]
    }
  ]
}
masterwishx commented 5 months ago

from debug on client 3 : (no client 3 in list )

image

image

github-actions[bot] commented 1 month ago

This issue is stale because it has been open for 90 days with no activity.

almereyda commented 1 month ago

This was reproduced here.