Skip to content

WebSSH 2.1.0

Latest
Latest

Choose a tag to compare

View all tags
@bifrost0x bifrost0x released this 24 Aug 17:58
· 9 commits to main since this release
Immutable release. Only release title and notes can be modified.
v2.1.0
81ecfed
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

WebSSH 2.1.0

WebSSH 2.1.0 adds secure, opt-in SMB file sources to the existing file workspace and delivers a focused set of authentication, File Manager, interface, deployment, and documentation improvements since WebSSH 2.0.

Highlights

  • Added encrypted SMB 3.1.1 sources to the File Manager
  • Added uploads, downloads, editing, recursive operations, and SFTP ↔ SMB transfers
  • Added reusable per-user SMB share definitions without storing passwords
  • Improved File Manager lifecycle, Quick Connect, modal controls, themes, and mobile behavior
  • Fixed stale remember-cookie login loops
  • Added a comprehensive versioned Wiki with automatic publication

SMB File Sources

SMB support is disabled by default and must be enabled explicitly by the operator.

  • Requires an exact SMB_ALLOWED_TARGETS hostname/IP allowlist
  • Uses fixed TCP port 445 and requires SMB 3.1.1, signing, encryption, and secure negotiation
  • Stores only non-secret share metadata; SMB passwords are never persisted
  • Revalidates user ownership and source capabilities at operation boundaries
  • Confines paths to the selected share and rejects reparse traversal and share-root mutations
  • Uses atomic editor replacement and fails closed when a safe replacement is unavailable
  • Applies bounded quotas, cancellation, connection holds, and canonical lock ordering to transfers
  • Records credential-free host, share, operation, and result metadata in the audit log
  • Provides a responsive connection flow aligned with Quick Connect and SFTP

To enable SMB:

SMB_ENABLED=true
SMB_ALLOWED_TARGETS=nas.example,10.0.0.8

Restart WebSSH after changing the environment. Wildcards, ports, and paths are not accepted in SMB_ALLOWED_TARGETS.

Reliability and Interface Improvements

  • Fixed embedded SFTP restoration after closing the full File Manager
  • Corrected Escape handling so source dialogs close before the File Manager
  • Fixed Paper Ops text contrast and shared theme aliases
  • Removed the duplicate Quick Connect action and routed remaining launchers consistently
  • Restored Material Icons rendering for modal close controls
  • Fixed stale Flask-Login remember cookies that could cause repeated login redirects
  • Allowed fresh passkey-authenticated sessions to authorize initial TOTP enrollment
  • Streamlined Docker Compose configuration without changing resolved defaults

Documentation and Operations

  • Rebuilt the README with a current product tour, quick start, and security overview
  • Added a comprehensive versioned Wiki covering deployment, authentication, SSH/SFTP workflows, administration, backup/restore, and troubleshooting
  • Added current architecture and security diagrams
  • Added a hardened workflow that publishes the versioned documentation to the GitHub Wiki
  • Updated locked Python dependencies and dependency-policy checks

Security and Validation

The release candidate at 81ecfedc3c550eb3970ef43238bacceb06cc2851 passed:

  • 2,081 Python tests on Python 3.11 and Python 3.14
  • 306 JavaScript unit tests
  • 91 Playwright browser tests
  • Disposable encrypted SMB integration checks
  • 27 disposable OpenSSH / Paramiko integration tests
  • Redis 7 and Redis 8 rate-limiter tests
  • Dependency-lock and vendored-asset checks
  • CodeQL analysis for Python, JavaScript/TypeScript, and GitHub Actions
  • AMD64 and ARM64 container builds
  • SPDX SBOM generation and Trivy scans for fixable High/Critical findings

Upgrade

Existing WebSSH 2.0 installations can upgrade using the normal container update process. Persistent data formats remain compatible and SMB stays disabled unless explicitly configured.

Backing up the WebSSH data volume before upgrading is recommended.

Full Changelog: v2.0.0...v2.1.0

Assets 3
Loading