marcpope/cortendesk v1.19.0

CortenDesk 1.19.0

on GitHub

New

• How each session connected. The connection log has a Path column and filter: LAN, direct, direct over WebRTC, or relay. A relayed session also shows how much the relay carried. The device page shows the same, and the dashboard has a bar of how sessions connected. It needs RustDesk 1.5 on the device and the bundled CortenDesk Server 1.3.0. Older devices and older servers show a dash. (#130)
• Desktop clients over port 443. RustDesk 1.4.9 and newer can run entirely over WebSocket, through the same /ws/id and /ws/relay paths the web client uses. Set the client's ID server to the console's hostname (no port), its API server to https://<that host>, and turn on allow-websocket. Those sessions always go through the relay. Server side by @vk2amv (cortendesk-server #1).
• Web client signs in with address-book passwords. When a device's password is kept in an address book the user can read, the web client uses it, as the desktop client does. Connect from the device list then opens the session without a prompt. The browser only gets a hash bound to that device's login challenge, never the password, and each use is in the console audit log. CORTENDESK_WEBCLIENT_AB_PASSWORDS=false turns it off. By @alee-ibrahim (#134).
• Audit log stream. CORTENDESK_AUDIT_LOG=true also writes every audit record (console actions, sign-ins, sessions, file transfers, alarms, admin-API token use) as one JSON line to the container log, for Loki, Elastic, Graylog or a SIEM. Lines start with {"cortendesk_audit":1,. CORTENDESK_AUDIT_LOG_STREAM sends them to a file instead. By @alee-ibrahim (#135).
• Relay bandwidth limits. Settings → Server sets per-session and total caps for the bundled relay, and slows down long sessions. Changes apply live. (#128)

Fixes

• A host folder works as the /data mount. The container now takes ownership of /data and the database files on every start; before, a root-owned folder made every sign-in fail with a 500. (#131)
• iOS devices no longer offer Connect, Terminal or Web client. RustDesk on iOS only starts sessions; they now say "Outgoing only". (#133)
• Accounts created through single sign-on see that their identity provider handles the second factor, instead of a warning to turn on 2FA. One that already turned 2FA on can turn it off without a password. (#129)
• Search boxes no longer set off iCloud Passwords, and the search icon lines up with the box. (#125)
• Wrong 2FA, recovery and email codes are now limited to 10 per account in 15 minutes from any address, shared by the console and the RustDesk client. Before, the limit was per address.

Notes

• One migration (relay_sessions, plus two columns on the connection log). It runs on start.
• Bundles CortenDesk Server 1.3.0. hbbs and hbbr now take a WebSocket client's address from X-Forwarded-For only from a trusted proxy. The image trusts its own nginx. If your proxy sends /ws/id and /ws/relay straight to published ports 21118/21119 instead of through port 8080, add its address as the container sees it: CORTENDESK_WS_TRUSTED_PROXIES=127.0.0.1/32,172.16.0.0/12.
• Running hbbs/hbbr yourself? Update to CortenDesk Server 1.3.0 for connection paths and WebSocket desktop clients.

docker pull marcpope/cortendesk:1.19.0
docker pull ghcr.io/marcpope/cortendesk:1.19.0

Feeling generous? Sponsor this project: https://github.com/sponsors/marcpope/