⚡ Security

• No security fixes since previous release
• Oldest release with no known security issue is v3.22.00 (2025-09-17)

💡 Highlights

We now support (and automatically test) Rocky Linux 10, Ubuntu 26.04 and OpenSUSE Leap 16.0. We dropped
Ubuntu 20.04 and OpenSUSE Leap 15.x, which are EOL. FreeBSD 15.0 has been dropped from the tests, as it can
no longer be tested reliably now that its packages are built for 15.1. The HTTPS Proxy and the jumphost features
are now part of the FreeBSD test suite.

On the HTTPS Proxy side, redirects sent by the remote devices are no longer followed by default.
The new allow_redirects option defaults to same-host: the proxy follows a redirect only if it points to the
same scheme, host and port, and always sends it to the IP that was checked. You can also set none to never follow
redirects, or any to follow them regardless of their target host and port (which is strongly discouraged).
When the proxy doesn't follow a redirect, it relays the 3xx answer to the client, with the target in the
X-Bastion-Remote-Location header. The proxy also gains the egress_ciphers option to set the TLS cipher list
on the egress side, and the allow_downgrade and downgraded_egress_ciphers options to control the egress
TLS downgrade that clients can request.

New headers are now returned to the client: X-Bastion-Remote-Client-SSL-Version and
X-Bastion-Remote-Client-SSL-Cert-Issuer. We also add a X-Bastion-Remote-Client-SSL-Cert-Verify header,
either OK or FAILED followed by the reason (e.g. FAILED (self-signed certificate)). This header is also
present even if you're running under "insecure": true, so that you can detect beforehand which devices would be
refused with "insecure": false. The same information is also logged to syslog, as one http-proxy-tls line
per egress TLS connection, along with the TLS version and cipher used: this way, you can easily list all the
non-compliant devices from your logs, and get TLS compliance statistics.
The new egress_ca_file option can be used to verify the devices' certificates against your own CA
instead of the system's default CA store. Also, the certificate of a device is now verified against the name the
client used to reach it (and this name is sent through SNI), instead of against its resolved IP.

The install script now generates the ssh_config and sshd_config files at runtime from a single
template for each. It checks the local OpenSSH version and asks the local ssh/sshd binaries which
configuration parameters they support. This means the generated files work on any distro, including unsupported ones.
The pam.d/sshd templates have been cleaned up too: there's one per distro family now (Debian, RHEL-like, SUSE-like).
This requires the Text::Template Perl module, which is now part of packages-check.sh.

This release carries the usual round of fixes and test suite improvements, listed below.
For an exhaustive (and boring) list, please refer to the commit log.

📌 Changes

• chg: support: add Rocky Linux 10, Ubuntu 26.04 and OpenSUSE Leap 16.0, remove Ubuntu 20.04 and OpenSUSE Leap 15.x
• enh: http proxy: deny non-same-host redirects by default (configurable with the allow_redirects option)
• enh: http proxy: support specifying an egress cipher list and disabling downgrade
• enh: http proxy: also return the egress TLS version and certificate issuer to the client
• enh: http proxy: verify the egress certificate even when insecure, and report the result to the client
• enh: http proxy: add the egress_ca_file option
• enh: http proxy: log the TLS compliance of each egress connection to syslog
• enh: make scp and rsync more robust and add tests
• enh: realm: more robust parsing of LC_BASTION_DETAILS for cross-realm connections
• enh: realm: deny non-PIV connections on LC_BASTION_DETAILS unmarshal failure
• enh: install: tailored ssh(d)_config files at runtime, update pam.d templates
• enh: sudoers: add basepath templating to account for non-/opt/bastion installs
• enh: setup-first-admin-account.sh: check that the install script has run before (#346)
• fix: groupListGuestAccesses: check caller gatekeepership
• fix: http proxy: ignore Client-* headers sent by the remote device
• fix: http proxy: verify the egress certificate against the name used by the client, and send it through SNI
• fix: http proxy: duplicate response sometimes sent on error
• fix: http proxy: a response header sent twice by the remote device made the request fail
• fix: http proxy: up max number of workers from 512 to 8192
• fix: accountDelete: race condition where JSON output could be swallowed
• fix: accountList: bad JSON return code when the no-longer supported option --realm-only was specified
• fix: interactive: last autocompletion rule was never applied
• fix: perl-tidy: don't leave .tdy/.ERR files behind
• doc: add a note about /home being a separate partition
• doc: fix the CVE-2025-59339 timeline dates
• chore: tests: add missing functional tests for some plugins, systematically validate that tests return JSON
• chore: tests: enable FreeBSD tests for HTTP Proxy and jumphost, drop FreeBSD 15.0

⏩ Upgrading

• General upgrade instructions
• Specific upgrade instructions for v3.25.00