Kervan v0.7.0

Added

• Per-user sign-in restrictions. Each user can have an expiry time,
  allowed IP/CIDR ranges, allowed protocols (ftp, ftps, sftp, scp,
  webui) and a cap on concurrent FTP/SFTP/SCP sessions. Set them from the
  Users page, the users API, or the new kervan user access command. They
  apply on every protocol and to existing WebUI/API sessions. Every 30 s,
  open FTP/SFTP/SCP connections of expired, disabled or deleted accounts,
  or from addresses no longer allowed, are ended and audited as
  session.revoked.

• Per-address connection limit. security.max_connections_per_ip
  caps concurrent FTP and SSH connections from one address, counted across
  both protocols.

• Wider audit coverage. Sign-ins through the WebUI and OIDC (both
  success and failure), password changes, user, group and API-key
  management, config updates and reloads, session kills, and file
  operations in the WebUI file browser are now audited. Directory
  create/delete and renames are audited over FTP and SFTP too, and renames
  record the destination in meta.to. Admin events name the affected
  account in meta.target_user; passwords are never logged.

• FTP commands. New: ABOR (including during a transfer, Telnet- or
  urgent-data-framed), STOU, MFMT, SITE CHMOD/SITE HELP, STAT,
  HELP, MODE, STRU, ALLO, and the X* legacy aliases. FTP
  upload/download audit events now include meta.bytes, and failed or
  aborted transfers are audited.

• SFTP extensions. posix-rename, statvfs/fstatvfs (df shows the
  quota), fsync and limits (OpenSSH clients switch to 255 KiB
  requests). Local storage now reports real disk space.

Changed

• SFTP sessions are capped at 1024 open handles.
• One SFTP audit event per transfer. SFTP used to write a file.write
  event for every WRITE packet (thousands for one large upload). It now
  writes one file.write or file.read event when the handle closes, with
  the byte count in meta.bytes. A transfer cut off by a dropped
  connection is recorded with status incomplete.