preservatorError when connecting over Tailscale and using Tailscale SSH for auth

[sumitgouthaman]

Fantastic app! Running into a minor issue when connecting using Tailscale SSH (fails on first try, works on immediate retry).

My environment:

• Connecting to a Linux host from iPad/iPhone.
• Both devices are in the same Tailscale tailnet.
• Using Tailscale SSH feature.
  • With this feature, whenever I try to SSH into another device in my tailnet, the Tailscale app on my iPhone/iPad will show a puch notification.
  • Clicking on the push notification will switch me to the Tailscale app where I can re-login and approve the connection.
  • Once I approve, the SSH connection will continue.

What I expect to happen:

• LaTerminal should connect successfully after I switch back to it from the Tailscale app.

What happens:

• LaTerminal runs into "preservatorError" (see attached screenshots).
• However if I close the connection and try to connect again, it connects successfully.
  • The second time around Tailscale does not generate a notification to login, because the previous one was approved recently.
  • So it probably connects correctly because we don't have to switch apps in the middle of connecting.

Steps to reproduce:

• Have an iPad and another server in the same Tailscale tailnet.
• Enable Tailscale SSH.
• Activate Tailscale on the iPad.
• From the iPad try to SSH into the server.
• Click on the push notification that appears. Once the Tailscale app/website opens, login.
  • This will then drop you back to the tailscale console.
• Switch back to the LaTerminal app.

[bradfitz]

I'm one of the Tailscale SSH developers (along with @maisem, @mihaip). We run a public SSH test server that simulates Tailscale SSH's auth type ("none") for SSH client authors to hit to test their SSH code against:

Observe OpenSSH works:

$ ssh -v -p  2222 188.166.70.128
....
debug1: Authentication succeeded (none).

Then compare your SSH client against that 188.166.70.128 (on port 2222).

[migueldeicaza]

@sumitgouthaman thanks for the bug report. One quick work-around is to change your session preservation for the host from "native" to "tmux". It is not ideal, but it will do for now. I'll look into setting up a Tailscale SSH server locally.

@bradfitz Does the tailscale server support SFTP? At least the public server does not seem to support it, which is what is preventing the preservator from running:

[migueldeicaza]

I believe I have a workaround for a gap in the tailscale SSH server, would you like to try it out?

If so, you can try the build with Testflight here:

https://testflight.apple.com/join/cpPS8YnX

[sumitgouthaman]

I don't have my ipad with me to reproduce on the same device as comment #1. But on the iPhone with the testflight version, it does run into an error.

[migueldeicaza]

Thanks for sharing, I can reproduce this issue, sadly, it is not the fundamental problem, which is that it seems like the tailscale server sometimes does not accept SFTP connections. I am trying to find out what is going on here.

[migueldeicaza]

Thanks to @bradfitz I know why you are getting the error above: what happens is that your tailscale is not authenticated, and that is why the SFTP connection hangs, it is waiting for the re-authentication to take place. I could not see it, because I had some sort of do-not-disturb enabled (I was trying the iOS feature where it automatically guesses what notifications to let through, once I turned it off, I got the notification).

That said, I am working to detect the login request, and direct the user to that.

[migueldeicaza]

There is a patch in the AppStore, and the new update makes this even more reliable.