Skip to content

Kervan v0.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Oct 09:49
· 140 commits to master since this release
v0.6.0
f822039

Added

  • File-count quota. quota.default_max_files is now enforced, with
    per-group and per-user max_files overrides (API, CLI
    --max-files, WebUI). Only regular files count, and overwriting a file
    does not.

  • Bandwidth limits. max_bandwidth can be set per user and per group,
    with bandwidth.default_user_rate as the default and
    bandwidth.max_total as a server-wide cap. Limits apply to FTP, SFTP,
    SCP and API transfers, are shared across a user's parallel connections,
    and reload at runtime. Measured at 1.0 MiB/s for a 1 MiB/s limit over FTP
    and SFTP.

  • Self-service account. A new WebUI My Account page and
    /api/v1/account endpoints show a user's effective policy, and let them
    change their password (local accounts) and manage their SSH public keys.
    Previously neither was possible without the server CLI.

  • Admin password reset and SSH key editing from the WebUI Users dialog
    and PUT /api/v1/users (password, authorized_keys).

Changed

  • quota.default_max_files now defaults to 0 (unlimited). Configs
    generated by older kervan init versions contain
    default_max_files: 100000, which had no effect before and now applies.
    Set it to 0 to keep the previous behavior.

Security

  • Session revocation: session tokens now carry iat, and a password
    change or reset revokes every WebUI/API session issued before it. An
    admin reset also ends the user's protocol sessions.
  • SSH keys: keys with authorized_keys options are rejected by the API,
    and skipped with a warning by kervan migrate ssh-keys. Kervan does not
    enforce the options, so a from= restriction would have been silently
    lost.

Fixed

  • quota: renaming a file onto an existing one now releases the
    replaced file's bytes. Before, they stayed counted against the user's
    quota.

  • WebUI: an expired or revoked session now returns to the sign-in screen
    with an explanation, instead of failing every request with "Session
    expired".

Container image: docker pull ghcr.io/kervanserver/kervan:0.6.0 (linux/amd64, linux/arm64).

Checksums are in checksums.txt. Verify with sha256sum -c --ignore-missing checksums.txt.

Assets 8
Loading