Require reauthentication for sensitive SSH

An accept SSH rule connects immediately. A check rule adds one more step: the user must have logged in to the identity provider recently.

The threat here is not a broken policy. It is a correct policy plus an unlocked laptop on a café table. Whoever sits down at that keyboard holds a live tailnet identity and every grant that comes with it. Check mode makes that laptop worth much less.

How check mode works

Check mode asks the user to reauthenticate with the identity provider, then remembers that check for a configured period. The first connection opens a browser page. You log in, including any second factor your provider enforces, and the SSH session proceeds. Connections within the check period pass without friction.

Change action from accept to check and add a checkPeriod:

{
  "ssh": [
    {
      "action": "check",
      "checkPeriod": "12h",
      "src": ["[email protected]"],
      "dst": ["tag:server"],
      "users": ["ubuntu"]
    }
  ]
}

Twelve hours means roughly one browser reauthentication per working day. For the lab, use a short period, a few minutes, so you can see the prompt come back quickly.

Test it

Save the policy, then connect:

ssh ubuntu@lab-server

# Tailscale SSH requires an additional check.
# To authenticate, visit: https://login.tailscale.com/a/9e8f7a6b5c

Open the URL, complete the login, and the session opens. Now open a second SSH connection right away. No prompt this time, because the check is still fresh. Wait past the check period and connect again: the prompt is back.

What it does not do

Check mode reduces the value of an unattended unlocked device. It does not replace operating-system authorization, and it does not make the users list less important. That list still decides which accounts you can become, and what those accounts may do is still the OS’s business.

My advice: use accept for routine paths and check for anything you would call administrative. If typing sudo on that box would make you pause, the connection deserves a check. And document the check period next to the rule, so nobody wonders why the browser opens every twelve hours.