⚡ Security
- No security fixes since previous release
- Oldest release with no known security issues:
v3.00.00(first public version)
💡 Highlights
This version has quite a lot of commits. This includes a standardization of satellite scripts configuration format and standard parameters, hence some configuration review might need to be done after upgrading (detailed in the specific upgrades instructions below).
The 3 main changes of this version are:
-
The
osh-encrypt-rsync.plscript functionalities have been extended to not only cover the encryption/rotation/exporting ofttyrecfiles, but now also each user's local access logs and sql logs, where applicable. Previously, these logs where handled by thecompress-old-logs.shscript, which was just compressing these files in-place. The latter script has now been removed in favor of the new features ofosh-encrypt-rsync.pl, which not only handles compression/encryption, but also export of these files to the same remote escrow filer than you may have configured for yourttyrecfiles. -
The NRPE probes we use to monitor our bastion clusters have been added to the
contrib/folder, if you're using Nagios, Icinga or any other NRPE-compatible monitoring system, you might want to have a look to said folder. -
Ubuntu 22.04 LTS is now supported and part of the automated tests. CentOS 8 has been removed, as this distribution has been EOL for some time. The software might still work for the meantime, but any potential future incompatibility might go undetected, and is not guaranteed to be fixed. Note that however, RockyLinux 8 is supported and tested.
As a side note, an overhaul of the left menu of the documentation has been done, in an effort to enhance documentation navigation as the documentation book thickens.
A more complete list of changes can be found below, for an exhaustive (and boring) list, please refer to the commit log.
📌 Changes
- feat:
osh-encrypt-rsync.pl: handle sqlite and user logs along with ttyrec files - remove:
compress-old-logs.shscript, asosh-encrypt-rsync.pldoes the job now - remove: delete CentOS 8 from tests (EOL)
- feat: add
osh-cleanup-guest-key-access.plscript - feat: add NRPE probes in
contrib/ - enh: standardize snake_case for all system scripts json config files
- enh: cron scripts: factorize common code and standardize logging & config
- enh:
osh-lingering-sessions-reaper.pl: make it configurable - enh:
osh-piv-grace-reaper.pl: run only on master, standardize config reading - enh: add more info in syslog warnings for
accountDelete - enh: tests: faster perl-check script
- fix: accountInfo wasn't showing TTL account expiration #329
- fix:
ping: force a deadline, and restore default sighandlers - fix:
accountInfo: missing creation date on non-json output - fix:
osh-remove-empty-folders.pl: fix folders counting (logging only) - fix:
osh-encrypt-rsync.pl: delete +a source files properly - fix:
osh-encrypt-rsync.pl: ensure $verbose is always set & make it configurable - fix:
install: ensure that the healthcheck user can always connect from 127.0.0.1 - fix:
install: avoid cases of sigpipe ontr - fix: don't emit a membership log when nothing changed
- fix:
{group,account}Delete: move() would sometimes fail, replace by mv - fix: workaround for undocumented caching in
getpw/getgrfuncs - doc: better menu organization and more complete config files reference