This patch release updates Echo for two WebSocket advisories, lets SSH accept the PROXY header from a load balancer again, and adds SHELLHUB_PUBLIC_URL for deployments behind a proxy that ends TLS. It also covers v0.27.1, which shipped without an agent image.
On v0.27.1? Upgrade to v0.27.2. No
shellhubio/agent:v0.27.1image exists, so on a v0.27.1 server the install script and the agent's self-update look for an agent version that was never published.
Echo 5.4.1
Echo 5.4.1 fixes GHSA-cxf3-9h37-7rr8, where a rejected WebSocket upgrade could bypass route-level access controls, and GHSA-9969-6676-49h5, where the WebSocket proxy could keep connections and handlers after the client disconnected. The server and the agent both carry the update (#7679).
SSH behind a Layer 4 load balancer
Since GHSA-c5cf-fr53-8wq4, the SSH listener accepts a PROXY header only from loopback. A Layer 4 load balancer, or an ingress that passes TCP through, sends the header from another address, so v0.27.0 closed every SSH connection that came through one.
SHELLHUB_SSH_PROXY_TRUSTED_IPS lists the extra ranges SSH trusts, space-separated like SHELLHUB_PROXY_TRUSTED_IPS on the gateway. Left empty, SSH trusts loopback only (#7674).
Listing a pod or bridge network? Any peer in a listed range can declare a client address. Restrict who reaches port 2222, for example with a NetworkPolicy that admits only the ingress pods. On Compose, do not list the Docker bridge range. Docker's userland proxy makes every external client appear to come from it.
Set the public URL with SHELLHUB_PUBLIC_URL
ShellHub built its public URL with https only when SHELLHUB_AUTO_SSL was true. Behind a proxy that ends TLS, SHELLHUB_AUTO_SSL stays off, because on the gateway it also requests Let's Encrypt certificates. The SSH approval links and the token issuer then pointed at http://.
SHELLHUB_PUBLIC_URL now sets the public URL, for example https://shellhub.example.com. It accepts an http or https origin with no path. Left unset, ShellHub derives the URL as before (#7673).
Also in this release
- Concurrent setup calls on a fresh instance no longer each create an administrator (#7682)
Enterprise
- SAML uses
SHELLHUB_PUBLIC_URLfor the service provider URL - After a SAML sign-in, the redirect stays on the assertion URL's origin and scheme. Behind an HTTP ingress, it could send the user to
http://with the session token in the query
Full Changelog: v0.27.0...v0.27.2