Nexus v0.2.0

A big update: Nexus can now update itself, switch between vaults without restarting, unlock with a PIN, and has a new look throughout.

Before you install

• Install this one by hand. v0.1.4 and older can't update themselves, so download v0.2.0 from the downloads page once. From v0.2.0 on, Nexus checks for updates by itself.
• Vault sync over SFTP or FTP now uses the Remote Path you set (older versions ignored it and used the login folder). Update every machine that syncs the same vault at the same time, or an old version and a new one will sync to different places. The first sync after updating still finds a vault left in the login folder.

Features

• In-app updates. On Windows, Nexus downloads new versions in the background and offers "Restart to update". On macOS it tells you when a new version is out and opens the downloads page. You can turn the checks off in Settings. (#16)
• Switch vaults from the sidebar without restarting the app. (#17)
• Manage vaults from the vault picker: rename, show in folder, or delete a vault (deleted vaults go to the Recycle Bin / Trash). (#30)
• PIN unlock. Set a PIN in Settings → General → Security to unlock the open vault quickly. The PIN is kept in memory only, so after a restart you unlock with your master password (or hardware key) again; five wrong PINs turn it off. (#31)
• New design across the app: a new app shell with a collapsible sidebar, and redesigned lock screen, hosts view, host and group forms, settings, vault sync, keychain, SFTP browser and snippets. (#19, #20, #21, #22, #23, #26)
• New icons throughout the app. (#18)
• Better contrast: secondary text is now readable on every theme. (#29)

Fixes

• Vault sync over SFTP/FTP now stays in the configured Remote Path. (#14)
• Notification toasts now show up. (#15)
• Settings → Terminal (font, cursor, scrollback and so on) now applies to your terminal sessions. (#24)
• Copied private keys are cleared from the clipboard after the timeout, and the links in About now open. (#25)
• Snippets set to "Run on connect" now run when a terminal connects. (#27)
• Updated build tooling to clear security advisories in development dependencies. (#28)

Full Changelog: v0.1.4...v0.2.0

Nexus v0.1.4

A security update for vault sync over SFTP. Please install it.

Security

• Vault sync over SFTP now checks the server's identity. This is the follow-up promised in v0.1.3. Until now, syncing your vault over SFTP accepted any server key, so someone between you and your sync server could have posed as it, seen your SFTP login, or handed you a different vault file. Now:

  • Background syncs only connect to a server you've already trusted. If the server is unknown, or its key has changed, the sync stops with a clear message and never pops up a prompt out of nowhere.
  • To trust your sync server, open Settings → Vault Sync and click Test Connection. Check the fingerprint and choose Always Accept. If you already trusted the same server from a terminal connection, there's nothing to do.

  After installing: if you sync over SFTP, run Test Connection once, or syncing will pause. (#12)

Fixes

• Test Connection in Vault Sync now says why a connection failed (for example, a rejected or changed host key) instead of just "Connection failed". (#12)

Under the hood

• New automated tests for SFTP sync host-key checks, against a local test server, plus an end-to-end test of the Vault Sync settings. (#12)

Full Changelog: v0.1.3...v0.1.4

Nexus v0.1.3

An important security update. Please install it.

Security

• Nexus now checks a server's identity before connecting. Until now, terminal sessions, SFTP and "Test Connection" accepted any server key without asking, even if the key had changed. That means someone between you and the server could have posed as it and seen your password and session. Now:

  • The first time you connect to a server, Nexus shows its fingerprint and asks whether to trust it. Always Accept remembers it; Accept Once trusts it just this time.
  • Known servers connect without asking.
  • If a server's key changes, you get a clear warning, and nothing connects until you decide.

  Because no keys were saved before this update, every server asks once after you install it. (#10)

Under the hood

• New automated tests: a terminal session, an SFTP download, and the trust prompt, all against a local test server. (#9, #10)

Vault sync over SFTP gets the same protection in a follow-up release.

Full Changelog: v0.1.2...v0.1.3

Nexus v0.1.2

A security update.

Fixes

• The auto-lock and clipboard timeouts in Settings now work. Changing "Auto-lock after" or "Clear clipboard after" used to do nothing. The app kept the defaults. Both now apply straight away and again after an unlock. Setting the clipboard timeout to 0 now means "never auto-clear", the same as auto-lock. (#6)

Security

• Patched libraries the app ships with. The FTP library used by FTP vault sync had command-injection and denial-of-service holes, and a failed login could echo your password in the error. Also updated: the S3 sync client's XML parser, the updater's YAML parser, and the archive tools bundled with the encrypted database. No known advisories are left in anything the app ships. (#7)

Full Changelog: v0.1.1...v0.1.2

Nexus v0.1.1

A security and stability update.

Fixes

• Auto-lock now actually locks the screen. When the vault locks on its own (computer idle, sleep or OS screen lock), Nexus now hides your hosts and shows the lock screen. Before, your hosts stayed on screen after the lock. SFTP sessions are also closed on lock now, as SSH sessions already were. (#4)
• Pausing an SFTP transfer really pauses it. Pause now stops data moving, resume picks up where it left off, and cancelling a paused transfer frees its slot for the next one. (#2)
• The status bar and Settings → About now show the right version number. (#5)

Under the hood

• Upgraded to Electron 44 (from 33), with the latest Chromium and security patches. (#3)

Full Changelog: v0.1.0...v0.1.1

Nexus v0.1.0

What's Changed

• Onboard to Personal Apps: CI, release pipeline, tests and tooling fixes by @ShayPunter in #1

New Contributors

• @ShayPunter made their first contribution in #1

Full Changelog: https://github.com/PunterDigital/nexus-ssh/commits/v0.1.0