starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

Authenticating with auth-key does not set node expiry #624

New Issue
Open
opened 2025-12-29 02:21:17 +01:00 by adam · 4 comments
adam commented 2025-12-29 02:21:17 +01:00
Owner
Copy Link

Originally created by @dustinblackman on GitHub (Feb 2, 2024).

Bug description

Possibly related to https://github.com/juanfont/headscale/issues/1579

With adding new nodes using authentication keys, the expiry of the node is set to 0 on the authentication request, resulting in headscale nodes list outputting entries like this where expiry is 0001-01-01 00:00:00.

45 | machine-1                  | machine-1-qgg83fyw         | [RiUAc]    | [pDq5E] | machine-1                       | 100.64.0.4, fd7a:115c:a1e0::4   | false     | 2024-02-02 19:49:17 | 0001-01-01 00:00:00 | offline   | no

I'm unsure if there's logic somewhere else that handles this, but it doesn't quite feel right. I would have thought there to be some default expiry, such as when logging in with a GUI client and OIDC where it sets the expiry based on your OIDC config.

My "I have no idea what I'm doing" patch looks like this to resolve it for my preference.

ad745bee3f

Should there be a config and functionality to set a default expiry when an authentication request does not have one set?

Environment

  • Version of headscale used: v0.23.0-alpha2

  • Version of tailscale client: 1.58.2

  • OS (e.g. Linux, Mac, Cygwin, WSL, etc.) and version: Debian 11

  • Kernel version: Not relevant.

  • The relevant config parameters you used: Not relevant.

  • Log output: headscale nodes list output shown above.

  • Headscale is behind a (reverse) proxy - No

  • Headscale runs in a container - No

To Reproduce

  1. On your headscale machine, run the following to create a user, and a preauthkey.
headscale users create machine-1
headscale preauthkeys create -u machine-1 -e 1h --tags tag:myawesomemachine
  1. On your machine (dubbed machine-1), login.
sudo tailscale up --login-server https://my-headscale-server.xyz --accept-dns=false --auth-key KEY-FROM-STEP-1
  1. Back on your headscale machine, look at the node expiry.
headscale nodes list | grep machine-1
Originally created by @dustinblackman on GitHub (Feb 2, 2024). ## Bug description Possibly related to https://github.com/juanfont/headscale/issues/1579 With adding new nodes using authentication keys, the expiry of the node is set to `0` on the authentication request, resulting in `headscale nodes list` outputting entries like this where expiry is `0001-01-01 00:00:00`. ``` 45 | machine-1 | machine-1-qgg83fyw | [RiUAc] | [pDq5E] | machine-1 | 100.64.0.4, fd7a:115c:a1e0::4 | false | 2024-02-02 19:49:17 | 0001-01-01 00:00:00 | offline | no ``` I'm unsure if there's logic somewhere else that handles this, but it doesn't quite feel right. I would have thought there to be some default expiry, such as when logging in with a GUI client and OIDC where it sets the expiry based on your OIDC config. My _"I have no idea what I'm doing"_ patch looks like this to resolve it for my preference. https://github.com/dustinblackman/headscale/commit/ad745bee3f98d4f52590ca8374ffbb7cb450e51a Should there be a config and functionality to set a default expiry when an authentication request does not have one set? ## Environment - Version of headscale used: `v0.23.0-alpha2` - Version of tailscale client: `1.58.2` - OS (e.g. Linux, Mac, Cygwin, WSL, etc.) and version: Debian 11 - Kernel version: Not relevant. - The relevant config parameters you used: Not relevant. - Log output: `headscale nodes list` output shown above. - [ ] Headscale is behind a (reverse) proxy - No - [ ] Headscale runs in a container - No ## To Reproduce 1. On your headscale machine, run the following to create a user, and a preauthkey. ```bash headscale users create machine-1 headscale preauthkeys create -u machine-1 -e 1h --tags tag:myawesomemachine ``` 2. On your machine (dubbed `machine-1`), login. ```bash sudo tailscale up --login-server https://my-headscale-server.xyz --accept-dns=false --auth-key KEY-FROM-STEP-1 ``` 3. Back on your headscale machine, look at the node expiry. ```bash headscale nodes list | grep machine-1 ```
adam added the bugno-stale-bot labels 2025-12-29 02:21:17 +01:00
adam commented 2025-12-29 02:21:18 +01:00
Author
Owner
Copy Link

@sword-jin commented on GitHub (Apr 22, 2024):

Let me answer this question, the authkey's expiration has no relation with node's expiration.

The only way is use tailscale debug set-expire --in=1m to expire a node, just for debugging.

image

@sword-jin commented on GitHub (Apr 22, 2024): Let me answer this question, the authkey's expiration has no relation with node's expiration. The only way is use `tailscale debug set-expire --in=1m` to expire a node, just for debugging. ![image](https://github.com/juanfont/headscale/assets/11711621/529d17b5-4102-41a9-8296-61df78609bbd)
adam commented 2025-12-29 02:21:18 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Jul 22, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Jul 22, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 02:21:18 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Dec 28, 2024):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (Dec 28, 2024): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 02:21:19 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Jan 27, 2025):

At the moment, this is behaving as expected. We do not have a mechanism for setting expiry for pre-auth-key nodes.

We do have a oidc.expiry to set a default expiry for nodes logging in with oidc, I suppose this could be generalised, so users can set a default expiry assigned to all nodes.

Personally I find that I dont want expiry behaviour, and I do not see the need, but we could migrate that expiry to something more general if people desire it and leave the default as infinite.

@kradalby commented on GitHub (Jan 27, 2025): At the moment, this is behaving as expected. We do not have a mechanism for setting expiry for pre-auth-key nodes. We do have a [`oidc.expiry`](https://github.com/juanfont/headscale/blob/main/config-example.yaml#L341) to set a default expiry for nodes logging in with oidc, I suppose this could be generalised, so users can set a default expiry assigned to all nodes. Personally I find that I dont want expiry behaviour, and I do not see the need, but we could migrate that expiry to something more general if people desire it and leave the default as infinite.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label bug no-stale-bot
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#624
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?