TS-2024-013

Description: Potential for Tailscale SSH recording failures What happened? Tailscale SSH recording deployments that enforce SSH recording using enforceRecorder could fail to record session activity in several situations. Failure to write to the storage backend If tsrecorder instances were unable to write to their configured storage, SSH sessions would be allowed to execute for a few seconds (typically under one or two) while the first output bytes failed to write. A tsrecorder instance can fail to write to its configured storage for many reasons, including: Misconfigured IAM permissions when using S3 for storage. Misconfigured file permissions when using the local filesystem for storage. Insufficient free space when using the local filesystem for storage. tsrecorder now exercises the full set of required storage actions on startup. Unreachable tsrecorder after a session is established If tsrecorder instances became unreachable after a session had started, the SSH session would take several minutes to terminate. This could happen when tsrecorder went offline or when ACLs were updated to restrict access to tsrecorder nodes. The Tailscale client now detects tsrecorder unreachability within 30 seconds and terminates the connection. Who was affected? Users of Tailscale SSH recording with enforceRecorder option and with tsrecorder and Tailscale client versions prior to 1.78.0. What was the impact? Users connecting over Tailscale SSH to nodes that enforce session recording via enforceRecorder ACL flags would have been able to execute commands briefly before having their access terminated due to recording failures. What do I need to do? Update tsrecorder instances and Tailscale clients to version 1.78.0 or later.