starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Users that don't belong to any ACL can access the whole network #451

New Issue
Closed
opened 2025-12-29 01:29:33 +01:00 by adam · 5 comments
adam commented 2025-12-29 01:29:33 +01:00
Owner
Copy Link

Originally created by @reynico on GitHub (Mar 27, 2023).

Bug description
If a new user is enrolled into Headscale and it doesn't belong to any group, the user has access to the whole network.

To Reproduce
Describing an ACL as following:

{
    "groups": {
        "group:dev": [
            "john",
            "doe",
        ],
        "group:support": [
            "sandy",
            "joe",
        ],
    },
    "hosts": {
        "db": "10.10.11.7/32",
        "server1": "10.10.0.2/32",
        "server2": "100.100.100.100/32",
    },
    "acls": [
        {
            "action": "accept",
            "src": [
                "100.64.0.1",
            ],
            "dst": [
                "*:*",
            ],
        },
        {
            "action": "accept",
            "src": [
                "group:dev",
            ],
            "dst": [
                "db:5432",
                "server1:*",
                "server2:*",

                "100.64.0.1:0",
            ]
        },
        {
            "action": "accept",
            "src": [
                "group:support",
            ],
            "dst": [
                "db:5432",

                "100.64.0.1:0",
            ]
        }
    ]
}

permits the support team to access a PostgreSQL database, but prohibits access to the servers, while the developers have access to the database and servers.

if a new user marty is enrolled, marty has access to everything, bypassing the ACLs.

  • Version of headscale used: v0.20.0
  • Version of tailscale client: 1.38.2
  • OS (e.g. Linux, Mac, Cygwin, WSL, etc.) and version: macOS Ventura
Originally created by @reynico on GitHub (Mar 27, 2023). **Bug description** If a new user is enrolled into Headscale and it doesn't belong to any group, the user has access to the whole network. **To Reproduce** Describing an ACL as following: ```json { "groups": { "group:dev": [ "john", "doe", ], "group:support": [ "sandy", "joe", ], }, "hosts": { "db": "10.10.11.7/32", "server1": "10.10.0.2/32", "server2": "100.100.100.100/32", }, "acls": [ { "action": "accept", "src": [ "100.64.0.1", ], "dst": [ "*:*", ], }, { "action": "accept", "src": [ "group:dev", ], "dst": [ "db:5432", "server1:*", "server2:*", "100.64.0.1:0", ] }, { "action": "accept", "src": [ "group:support", ], "dst": [ "db:5432", "100.64.0.1:0", ] } ] } ``` permits the support team to access a PostgreSQL database, but prohibits access to the servers, while the developers have access to the database and servers. if a new user `marty` is enrolled, `marty` has access to everything, bypassing the ACLs. - Version of headscale used: `v0.20.0` - Version of tailscale client: `1.38.2` - OS (e.g. Linux, Mac, Cygwin, WSL, etc.) and version: macOS Ventura
adam added the stalebugpolicy 📝 labels 2025-12-29 01:29:33 +01:00
adam closed this issue 2025-12-29 01:29:33 +01:00
adam commented 2025-12-29 01:29:34 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Mar 28, 2023):

Is this a new bug, or has it always been like this? I will add it to #1069 (tracking my ACL improvement work).

@kradalby commented on GitHub (Mar 28, 2023): Is this a new bug, or has it always been like this? I will add it to #1069 (tracking my ACL improvement work).
adam commented 2025-12-29 01:29:34 +01:00
Author
Owner
Copy Link

@reynico commented on GitHub (Mar 28, 2023):

I have a gut feeling that it has always been like this.

@reynico commented on GitHub (Mar 28, 2023): I have a gut feeling that it has always been like this.
adam commented 2025-12-29 01:29:34 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Mar 30, 2023):

Noted, I will try to write a test case to "prove" it and then fix it for the #1069 work and hopefully get it resolve when I am sitting down with that work.

@kradalby commented on GitHub (Mar 30, 2023): Noted, I will try to write a test case to "prove" it and then fix it for the #1069 work and hopefully get it resolve when I am sitting down with that work.
adam commented 2025-12-29 01:29:35 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Feb 4, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Feb 4, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 01:29:35 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Feb 12, 2024):

This issue was closed because it has been inactive for 14 days since being marked as stale.

@github-actions[bot] commented on GitHub (Feb 12, 2024): This issue was closed because it has been inactive for 14 days since being marked as stale.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug policy 📝 stale
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#451
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?