James Tucker 4777494982 ssh/tailssh: pin rejection-banner content to policy-derived facts ...

A policy rejection names the requested sshUser: that name is the
client's own request and reflects only tailnet policy (the client's
own ACL view), never a local-host fact, so naming it leaks nothing.
What a client-visible rejection must never depend on is server-side
local-user information: local-user lookup failures send one fixed
message for every failure cause, with the underlying error logged
server-side only, so the client cannot tell "no such local user"
from any other lookup failure and no banner is a
username-existence oracle.

Pin both properties in TestSSHAuthFlow: the user-mismatch cases,
including a rule whose "=" mapping forces a local lookup of a user
that does not exist, all name the requested user identically, and an
accept rule whose mapped local user fails lookup gets the fixed
lookup-failure banner.

Updates tailscale/corp#50380

Signed-off-by: James Tucker <james@tailscale.com>

2026-10-24 13:52:26 -07:00

..

testcontainers

ssh/tailssh: speed up SSH integration tests

2026-04-13 14:18:27 -07:00

accept_env_test.go

ssh/tailssh: extend dangerous env var denylist, re-check child-side

2026-10-24 12:41:58 -07:00

accept_env.go

ssh/tailssh: extend dangerous env var denylist, re-check child-side

2026-10-24 12:41:58 -07:00

auditd_linux_test.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

auditd_linux.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

c2n.go

ssh/tailssh: split the OS-specific parts of the server into their own files

2026-09-15 19:32:40 -07:00

hostkeys_test.go

ssh/tailssh: write private host keys with 0600 permissions

2026-10-24 13:30:41 -07:00

hostkeys.go

ssh/tailssh: write private host keys with 0600 permissions

2026-10-24 13:30:41 -07:00

incubator_linux.go

all: remove AUTHORS file and references to it

2026-01-23 15:49:45 -08:00

incubator_plan9.go

ssh/tailssh: extend dangerous env var denylist, re-check child-side

2026-10-24 12:41:58 -07:00

incubator_test.go

ssh/tailssh: extend dangerous env var denylist, re-check child-side

2026-10-24 12:41:58 -07:00

incubator.go

ssh/tailssh: extend dangerous env var denylist, re-check child-side

2026-10-24 12:41:58 -07:00

listen.go

feature: add TS_DISABLE_FEATURE to disable features at runtime

2026-09-15 08:37:47 -07:00

localstate_test.go

format using go fmt version 1.27.2 (#21838)

2026-10-21 23:17:21 -07:00

privs_test.go

tstest: add RequireRoot helper

2026-04-10 10:48:50 -07:00

process_unix.go

ssh/tailssh: split the OS-specific parts of the server into their own files

2026-09-15 19:32:40 -07:00

session.go

tsnet: add opt-in SSH support (Server.ListenSSH)

2026-05-30 14:17:50 -07:00

sftp.go

ssh/tailssh: split the OS-specific parts of the server into their own files

2026-09-15 19:32:40 -07:00

tailssh_exitcodes_test.go

ssh/tailssh: test exit-status frame ordering and stderr drain

2026-07-30 10:18:00 +02:00

tailssh_frameorder_test.go

ssh/tailssh: test exit-status frame ordering and stderr drain

2026-07-30 10:18:00 +02:00

tailssh_integration_exitcodes_test.go

ssh/tailssh: add exit-status test harness

2026-07-30 10:18:00 +02:00

tailssh_integration_test.go

ssh/tailssh: dup the pty master with F_DUPFD_CLOEXEC (#21342)

2026-10-16 17:45:34 -07:00

tailssh_test.go

ssh/tailssh: pin rejection-banner content to policy-derived facts

2026-10-24 13:52:26 -07:00

tailssh.go

ssh/tailssh: pin rejection-banner content to policy-derived facts

2026-10-24 13:52:26 -07:00

user_unix.go

ssh/tailssh: treat numerically-zero uids as root in isRootUser

2026-10-24 13:23:22 -07:00

user.go

ssh/tailssh: split the OS-specific parts of the server into their own files

2026-09-15 19:32:40 -07:00