ssh is never left without a rule #24

2026-09-14T15:16:23Z

jschoubben commented

2026-09-14 15:16:23 +00:00

The ssh floor allowed it from the mesh's addresses, and from everywhere on a machine that faces outward. On a machine the mesh knows no addresses for, it emitted neither — so the chain dropped by default and ssh was simply shut.

That is the first machine anybody adopts: reached over the network, with the port needed to fix it closed by the act of adopting it. The narrower rule is worth less than never leaving the chain without one.

Found by reading the rules off a running machine rather than trusting the generator I had just written — the unit tests passed, because they all supplied mesh addresses.

Verified on a live mesh afterwards: the rule is present on the machine and the mesh reports it as doing what it was told.

The ssh floor allowed it from the mesh's addresses, and from everywhere on a machine that faces outward. On a machine the mesh knows no addresses for, it emitted neither — so the chain dropped by default and ssh was simply shut. That is the first machine anybody adopts: reached over the network, with the port needed to fix it closed by the act of adopting it. The narrower rule is worth less than never leaving the chain without one. Found by reading the rules off a running machine rather than trusting the generator I had just written — the unit tests passed, because they all supplied mesh addresses. Verified on a live mesh afterwards: the rule is present on the machine and the mesh reports it as doing what it was told.

jschoubben added 1 commit 2026-09-14 15:16:23 +00:00

ssh is never left without a rule 55d468798d

The floor allowed ssh from the mesh's addresses, and from everywhere on a
machine that faces outward. On a machine the mesh knows no addresses for it
emitted neither — so the chain dropped by default and ssh was simply shut.

That is the first machine anybody adopts: reached over the network, with the
port needed to fix it closed by the act of adopting it. Found by reading the
rules off a live machine rather than trusting the generator.

jschoubben merged commit 68e9a16c57 into main

2026-09-14 15:16:31 +00:00

jschoubben referenced this pull request

2026-09-23 22:02:09 +00:00

Adopt the predecessor's tunnel in place: its range, its address, its peers (hq ADR 0105) #49

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-controller#24