From 1a48b276ef37c4c9497aa3c6d7c48523e1c6c7fe Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Thu, 29 Oct 2026 11:03:44 +0000 Subject: [PATCH] docs: explain how to disable SSH forwarding --- CHANGELOG.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 99a61c359..c52d7e582 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -161,10 +161,10 @@ nodes; upgrading Headscale alone does not apply them. See Tailscale's [security bulletins](https://tailscale.com/security-bulletins#ts-2026-014) and [Tailscale SSH: Findings and fixes](https://tailscale.com/blog/tailscale-ssh-findings-fixes). -Headscale follows Tailscale's SSH policy behavior: forwarding is allowed by default, -with no per-rule forwarding controls. As an interim mitigation for SSH forwarding -vulnerabilities, set `TS_SSH_DISABLE_FORWARDING=1` in the destination `tailscaled` -service environment and restart the service, as described in the security bulletin. +To disable SSH agent and port forwarding on a node, set +`TS_SSH_DISABLE_FORWARDING=1` in the `tailscaled` service environment and restart +the service. This setting applies to all Tailscale SSH sessions on that node and +is also available in older clients. ## 0.29.6 (2026-10-24)