James Tucker 392c91bb86 ssh/tailssh: keep sessions when a prompt-free rule expires ...

Check mode grants recently approved users a prompt-free Accept rule
with a short RuleExpires. When that rule expired, the connection's
policy recheck matched the base HoldAndDelegate rule instead. The
recheck read that as a policy edit and closed the connection, killing
live sessions when the prompt-free window lapsed.

Remember the rule that matched at authentication. If it has expired and
a hold rule matches instead, keep the connection. Re-authentication is
required only for new connections.

A policy edit that swaps a still-valid accept rule for a hold rule still
closes the connection. Recorder, identity, and accept-env checks still
run on the fallback path.

Updates tailscale/corp#50380

Signed-off-by: James Tucker <james@tailscale.com>

2026-10-28 19:06:07 +00:00

..

tailssh

ssh/tailssh: keep sessions when a prompt-free rule expires

2026-10-28 19:06:07 +00:00