v3.14.16

⚡ Security

• No security fixes since previous release
• Oldest release with no known security issue is v3.14.15 (2023-11-08)

💡 Highlights

This release introduces a new global configuration option, ttyrecStealthStdoutPattern, to handle corner-cases where recording stdout of some specific commands would take up gigabytes. If you use rsync through the bastion, and noticed that some ttyrec files take up a gigantic amount of space, this might help salvaging your hard-drives!

Another noteworthy change is for users using pre-v3.14.15 scp or sftp helpers: this release introduces a compatibility logic to avoid requiring them to upgrade their helpers when JIT MFA is not required for their use case. Of course, when JIT MFA is required by policy, the connection will still fail and the only way to go through is to use the new wrappers that can support properly asking MFA to the users.

Otherwise, this release is mainly a bugfix / tiny enhancements release.

A more complete list of changes can be found below, for an exhaustive (and boring) list, please refer to the commit log.

📌 Changes

• feat: add ttyrecStealthStdoutPattern config
• enh: osh-lingering-sessions-reaper.sh: handle dangling plugins
• enh: osh-orphaned-homedir.sh: also cleanup /run/faillock
• enh: plugins: better signal handling to avoid dangling children processes
• fix: scp/sftp: when using pre-v3.14.15 helpers, the JIT MFA logic now behaves as before, so that these old helpers still work when JIT MFA is not needed
• fix: accountInfo: return always_active=1 for globally-always-active accounts
• fix: ping: don't exit with fping when host is unreachable
• fix: osh-sync-watcher: default to a valid rshcmd (fixes #433)
• fix: install: generation of the MFA secret under FreeBSD

⏩ Upgrading

• General upgrade instructions
• Specific upgrade instructions for v3.14.16

v3.14.15

⚡ Security

• Fixed CVE-2023-45140 with severity 4.8 (CVSS 3.0)

💡 Highlights

This release fixes a security issue where JIT MFA on sftp and scp plugins was not honored. Please refer to CVE-2023-45140 for impact and mitigation details.
Upgrading to this version is sufficient to fix the issue, but please read through the specific upgrading instructions of this version.

A more complete list of changes can be found below, for an exhaustive (and boring) list, please refer to the commit log.

📌 Changes

• feat: support JIT MFA through plugins, including sftp and scp (fixes CVE-2023-45140)
• feat: add configuration option for plugins to override the global lock/kill timeout
• enh: setup-gpg.sh: allow importing multiple public keys at once
• enh: connect.pl: report empty ttyrec as ttyrec_empty instead of ttyrec_error
• enh: orphaned homedirs: adjust behavior on master instances
• fix: check_collisions: don't report orphan uids on slave, just use their name
• fix: scp: adapt wrapper and tests to new scp versions requiring -O
• meta: dev: add devenv docker, pre-commit info, and documentation on how to use them, along with how to write integration tests

⏩ Upgrading

• General upgrade instructions
• Specific upgrade instructions for v3.14.15

v3.14.00

⚡ Security

• No security fixes since previous release
• Oldest release with no known security issues: v3.00.00 (first public version)

💡 Highlights

This release fixes a possibly problematic behavior introduced in v3.13.00 when replacing sqlite logging of plugins output by ttyrec where the scp and sftp plugins, when downloading a file (from the remote server to the local machine through the bastion) would save the binary stream as part of the ttyrec file, possibly taking a lot of space when these plugins are often used.

Another, somehow niche, new feature is the support of so-called type8 and type9 hash types for egress passwords, mainly used by network devices. More information is available in the specific upgrade instructions link below.

📌 Changes

• feat: add type8 and type9 password hashes
• feat: add stealth_stderr/stdout ttyrec support, enable it for scp & sftp

⏩ Upgrading

• General upgrade instructions
• Specific upgrade instructions for v3.14.00

v3.13.01

⚡ Security

• No security fixes since previous release
• Oldest release with no known security issues: v3.00.00 (first public version)

💡 Highlights

This minor release has only a few changes, mainly on the documentation and setup sides. Two new important documentation sections have appeared:

• The JSON API section, detailing how to integrate The Bastion in your automated workflows, and
• The Multi-Factor Authentication (MFA) section, detailing several possible setups to harden your users accesses

The features documented above have been available since v3.00.00, so updating to this version is not required to use them.

A more complete list of changes can be found below, for an exhaustive (and boring) list, please refer to the commit log.

📌 Changes

• doc: add JSON API and MFA documentations
• fix: clush: restore default handlers for SIGHUP/PIPE
• enh: setup-gpg.sh: create additional backup signing config with --generate

Thanks to @toutoen and @docwalter for their contribution to this release.

⏩ Upgrading

• General upgrade instructions
• Specific upgrade instructions for v3.13.01

v3.13.00

⚡ Security

• No security fixes since previous release
• Oldest release with no known security issues: v3.00.00 (first public version)

💡 Highlights

The change from the previous version is:

• The plugins output is now recorded using ttyrec, as the egress connections are, instead of being stored in sqlite format
  within the home folder of the account. This helps avoiding the sqlite databases growing too much in size when
  accounts are using --osh commands very intensively.

A more complete list of changes can be found below, for an exhaustive (and boring) list, please refer to the commit log.

📌 Changes

• enh: use ttyrec instead of sqlite to record plugin output
• fix: selfMFASetupPassword: restore default sighandlers to avoid being zombified

⏩ Upgrading

• General upgrade instructions
• Specific upgrade instructions for v3.13.00

v3.12.00

⚡ Security

• No security fixes since previous release
• Oldest release with no known security issues: v3.00.00 (first public version)

💡 Highlights

Main changes from the previous version are:

• Debian "Stretch" 9 is no longer officially supported, as this version has been EOL upstream for a few months now. This doesn't mean that the future versions of The Bastion won't work under this distro, it means that this distro release is no longer part of the automated tests. As Debian Stretch is EOL, you should consider upgrading to a more recent version, as maintaining a secured underlying OS is paramount to the whole security of The Bastion (or of any other software).

• Debian "Bookworm" 12 has been part of the automated tests for a while, but is now officially supported as this has been officially released upstream.

• Two new configuration parameters have been added to the selfAddPersonalAccess and accountAddPersonalAccess commands.

Side note: tagged releases are now signed. This was a prerequisite to the upcoming integrated and secure adminUpgrade command.

A more complete list of changes can be found below, for an exhaustive (and boring) list, please refer to the commit log.

📌 Changes

• feat: add 2 configurable knobs to (self|account)AddPersonalAccess
• feat: plugins: add loadConfig parameter & config validator support
• chg: drop support for Debian 9, add support for Debian 12
• fix: accountList: crash in some cases
• fix: add missing autocompletions, readonly flags and help category for some plugins
• chore: fix GitHub actions under FreeBSD

⏩ Upgrading

• General upgrade instructions
• Specific upgrade instructions for v3.12.00

v3.11.02

⚡ Security

• No security fixes since previous release
• Oldest release with no known security issues: v3.00.00 (first public version)

💡 Highlights

Main changes from the previous version are:

• A new script bin/admin/check_uid_gid_collisions.pl has been added, to ease procedures such as HA setup and backup restoration. The documentation has been updated accordingly to reference the proper usage of this script at the right steps.
• We now support RockyLinux 9, OpenSUSE Leap 15.4. Debian 12 is also now part of the test workflows to ensure we support it as soon as it's officially released in the next few months.

A more complete list of changes can be found below, for an exhaustive (and boring) list, please refer to the commit log.

📌 Changes

• feat: add uid/gid collisions checking script & document it for HA cluster setup and backup restore (#378)
• fix: groupAddServer: --force-key wasn't working properly (#259)
• fix: groupInfo: reintroduce group name in human-readable output (mistakenly removed in v3.11.00)
• chg: add Debian 12 to tests (not released yet, so not officially supported for now)
• chg: add RockyLinux 9 support
• chg: bump OpenSUSE Leap tests from 15.3 to 15.4
• chg: push sandbox and tester images from Debian 10 to Debian 11
• remove: get rid of decade-old Debian openssh-blacklist logic
• remove: get rid of deprecated UseRoaming option from ssh_config

⏩ Upgrading

• General upgrade instructions
• Specific upgrade instructions for v3.11.02

v3.11.01

⚡ Security

• No security fixes since previous release
• Oldest release with no known security issues: v3.00.00 (first public version)

💡 Highlights

This is a hotfix release, the only fixed issue is a display issue introduced in v3.11.00 in the groupInfo command, which would always display an empty list for the gatekeepers of a group, along with "?" instead of the number of accesses for each guest.
Note that the JSON output was correct, only the human-readable output of groupInfo was impacted.

⏩ Upgrading

• General upgrade instructions

v3.11.00

⚡ Security

• No security fixes since previous release
• Oldest release with no known security issues: v3.00.00 (first public version)

💡 Highlights

Main changes from the previous version are:

• SFTP passthrough is now supported, all the commands manipulating accesses have been modified accordingly, to add the --sftp option. More information can be found in the documentation.
• The groupInfo and accountInfo commands have been augmented with a new --all option, reserved for bastion auditors, to dump detailed data about all the groups or accounts, respectively. The amount of information to be dumped can be controlled with a series of --with-* and --without-* options, more information can be found in each command's own documentation (groupInfo and accountInfo. Prefer the use of accountInfo --all instead of accountList --audit, as the latter will be deprecated soon.

Another change that should be noted is the removal of the implicit --port-any and --user-any to the self(Add|Del)PersonalAccess and account(Add|Del)PersonalAccess commands, when either --user or --port are omitted, to be consistent with group(Add|Del)Server which never had this behaviour. This always emitted a deprecation warning since the first publicly released version, encouraging the explicit use of --user-any and/or --port-any when this was desired. Now, omitting these options will simply return an error, as this has always been the case with group(Add|Del)Server.

A more complete list of changes can be found below, for an exhaustive (and boring) list, please refer to the commit log.

📌 Changes

• feat: add sftp support
• feat: add the possibility to auditors of listing all groups with groupInfo and all accounts with accountInfo,
  using --all, along with filtering additional data with --with-* and without-* new options
• enh: setup-encryption.sh: don't require install to be called before us
• enh: remove implicit --(user|port)-any if omitted when using (self|account)(Add|Del)PersonalAccess commands
• fix: race condition when two parallel account creations used the --uid-auto option
• doc: add restore from backup howto
• doc: add PuTTY connection setup howto

⏩ Upgrading

• General upgrade instructions
• Specific upgrade instructions for v3.11.00

v3.10.00

⚡ Security

• No security fixes since previous release
• Oldest release with no known security issues: v3.00.00 (first public version)

💡 Highlights

Main changes from the previous version are:

• Two new restricted commands: accountFreeze and accountUnfreeze, to temporarily disable an account, in a reversible way.
• New options to the accountInfo commands: --no-password-info and --no-output, to get a speed boost when those informations are not needed by the caller

A more complete list of changes can be found below, for an exhaustive (and boring) list, please refer to the commit log.

📌 Changes

• feat: add accountFreeze/accountUnfreeze commands
• enh: accountInfo: add --no-password-info and --no-output options
• enh: more precise matching of ssh client error messages
• enh: osh.pl: add the account name on each error message
• fix: invalid suffixed account creation (#357)

⏩ Upgrading

• General upgrade instructions
• Specific upgrade instructions for v3.10.00