wangwanjie/gately v0.6.6.4

on GitHub

中文

管理后台登录安全

• 密码规则：新密码 10～72 字节，拒绝常见弱口令（含常见变形）、包含 gately 或用户名、连续或重复字符、字符种类过少的密码（16 位以上放宽），输入时实时显示强度。
• 强制修改：使用默认密码或弱密码登录后弹出无法关闭的改密对话框，改好之前服务端拒绝其他写操作；已有的弱密码在下一次密码登录时识别。
• 递增锁定：同一来源反复被锁定时，锁定时长每次翻倍，最长 24 小时。
• 陌生来源失败预算：从未登录成功过的地址 10 分钟内的密码登录失败总数达到上限（默认 20，可调整或关闭）后，陌生地址的密码登录暂时返回 429 并发出通知；常用地址与 Passkey 登录不受影响。
• 关闭密码登录：已注册 Passkey 后可以关闭密码登录；gately reset-password 会重新开启。
• 安全评分：「系统设置 → 账号与安全」顶部显示管理端安全评分，七项检查各自给出得分与修改入口。

优先拒绝名单（#95）

IP 访问控制新增「优先拒绝名单」（手填地址与网段，或引用订阅的 IP 列表）：命中的来源一律拒绝，先于白名单、黑名单判断，与访问控制模式无关，路径规则也不能覆盖。Web 站点、端口转发、协议分流、STUN 内置转发与 frps 实例都可使用；订阅列表刷新后立即生效，被引用的列表不能删除。

Web 服务

• 敲门准入与登录后放行：站点可以要求来源持有某条端口敲门规则的有效授权才能访问；也可以作为放行入口，访客通过站点认证后为其来源 IP（IPv6 默认按 /64）登记授权，引用该规则的站点、端口转发与系统防火墙随即放行。入口页 /__gately_knock 可查看与撤销放行，支持双栈探测；退出登录、用户被删除或改密码时自动撤销。敲门规则不开防火墙拦截时端口可以留空，只用于网页登录放行。
• 后台登录免认证：已登录 Gately 管理后台的管理员访问开启该选项的站点时不再需要站点认证；同一父域经单点登录域生效，跨父域时经「后台入口地址」一次性票据握手。凭据绑定后台会话，登出、退出所有设备或改密码后立即失效，不会转发给后端。
• 共享用户 Passkey 登录：共享用户可在站点的 /__gately_auth/passkey 页面注册 Passkey，之后一键登录，免输入密码和动态验证码；只在站点的精确域名与 OIDC 签发者域名上提供，管理员修改用户的密码或 TOTP 密钥后该用户的 Passkey 一并删除。
• 明文 HTTP/2 后端：站点选项「http:// 后端使用明文 HTTP/2（h2c）」用于只监听明文端口的 gRPC 服务（如 NetBird 管理/信令），同一端口上的 WebSocket 请求自动改用 HTTP/1.1。

入侵防护

内核层的诱饵端口与端口扫描检测封禁时，封禁原因、日志与通知带上命中的端口；内核或 nftables 不支持时自动跳过，其余规则照常生效。

其他

• 打开对话框、确认框或抽屉时滚动不再带动下方页面，终端与编辑器在弹出层中仍可正常滚动。
• 卡片与分组列表、排序栏、标签页之间的间距统一。

升级提示

• 管理员密码过弱时，升级后下一次用密码登录会要求修改密码。
• 陌生来源失败预算默认开启（20 次 / 10 分钟），只影响从未登录成功过的地址。

更新说明：https://gately.cn/news/v0.6.6.4

English

Admin sign-in security

• Password rules: new passwords are 10 to 72 bytes and may not be common weak passwords (including common variations), contain gately or the username, consist of sequences or repeats, or use too few character kinds (relaxed from 16 characters); strength is shown as you type.
• Forced change: signing in with the default or a weak password opens a password change dialog that cannot be closed, and the server refuses other write operations until the password is changed; existing weak passwords are detected at the next password sign-in.
• Escalating lockout: a source that is locked again and again gets twice the lock time each time, up to 24 hours.
• Unknown-source failure budget: once password sign-in failures from addresses that never signed in successfully reach the limit within 10 minutes (20 by default, adjustable or off), password sign-ins from unknown addresses return 429 for a while and a notification is sent; known addresses and Passkey sign-ins are not affected.
• Turn off password sign-in: once a Passkey is registered, password sign-in can be turned off; gately reset-password turns it back on.
• Security score: the top of "Settings → Account & security" shows the admin security score with seven checks, each with its points and a link to fix it.

Always-deny list (#95)

IP access control adds an "always-deny list" (addresses and ranges, or subscribed IP lists): matching sources are always rejected, before the allowlist or blocklist, regardless of the access mode, and path rules cannot override it. It is available for web sites, port forwarding, protocol routing, STUN forwarding and frps instances; subscribed lists apply as soon as they refresh, and lists in use cannot be deleted.

Web service

• Knock admission and login release: a site can require a valid grant of a port knocking rule before any access, or act as a release entry: visitors who pass the site's authentication get their source IP (IPv6 /64 by default) granted, and sites, port forwards and the system firewall that use the rule let it in. The /__gately_knock page shows and revokes grants and probes the other address family; signing out, deleting a user or changing their password revokes them. Knock rules without firewall blocking may leave ports empty and serve web login release only.
• Admin sign-in bypass: administrators signed in to the Gately admin skip the authentication of sites with this option, through the single sign-on domain under the same parent domain, or through a one-time ticket handshake with the "admin entry URL" across parent domains. The credential is bound to the admin session, stops working on sign-out, sign-out of all devices or password change, and is never forwarded to backends.
• Shared user Passkey sign-in: shared users register Passkeys on the site's /__gately_auth/passkey page and then sign in with one tap, without password or one-time code; offered only on a site's exact domains and the OIDC issuer domain, and an administrator changing a user's password or TOTP secret deletes that user's Passkeys.
• Cleartext HTTP/2 backends: the site option "Use cleartext HTTP/2 (h2c) for http:// backends" serves gRPC services that only listen on a plain port (such as the NetBird management and signal services); WebSocket requests on the same port automatically use HTTP/1.1.

Intrusion prevention

Kernel-level trap port and port scan bans now include the ports that were hit in the ban reason, logs and notifications; when the kernel or nftables cannot record ports, this is skipped and the other rules work as before.

Other

• Scrolling inside dialogs, message boxes and drawers no longer moves the page behind them, while terminals and editors in them still scroll.
• Consistent spacing between cards and grouped lists, sort bars and tabs.

Upgrade notes

• If the admin password is weak, the next password sign-in after upgrading asks you to change it.
• The unknown-source failure budget is on by default (20 per 10 minutes) and only affects addresses that never signed in successfully.

Release notes: https://gately.cn/en/news/v0.6.6.4