Skip to content

WebSSH v3.0.0

Latest
Latest

Choose a tag to compare

View all tags
@bifrost0x bifrost0x released this 08 Nov 12:34
· 11 commits to main since this release
Immutable release. Only release title and notes can be modified.
v3.0.0
c6ecb87
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

WebSSH 3.0.0

Version 3 introduces terminal-centered workspaces, integrated files, reusable
automation workflows and schedules, encrypted saved credentials, and a
per-account introductory tour.

Highlights

  • Status-first overview. Host readiness, open sessions, 14-day automation
    results, reachability and recent activity; an SSH route summary with the full
    topology map behind Open map. Each account arranges, resizes and hides the
    panels freely. Needs attention items can be dismissed and return when the
    situation changes.
  • Reachability checks per account: off, on demand (default) or automatic.
    One TCP connection to the SSH port under the SSH network policy, no login.
    The greeting the server sends by itself gives direct hosts an unverified
    platform hint until a connection detects the platform.
  • Service detection. Connected hosts report Docker, Podman, common system
    services and known container apps, read-only and at most once a week; the
    overview shows them on host cards and filters by them.
  • Find hosts. Manual discovery of SSH and SFTP servers in a network range
    the user names, paced to about three attempts per second, with a prefilled
    new-host form. Controlled by HOST_DISCOVERY_ENABLED (off in production).
  • Automation and saved passwords, administrator-controlled and disabled
    by default.
  • Security hardening: per-account limits for second factors and password
    changes, realtime connections bound to the WebSSH origin, no-store caching
    for dynamic responses, stricter GitHub auto-provisioning in production.
  • Every interface language complete: the built-in command library, the
    tour and the interface notifications are available in English, Vietnamese,
    German, French, Spanish and Chinese, with consistent terms in each language.

Changed defaults

  • TOTP_ENABLED now defaults to true; authenticator apps are offered unless
    disabled.
  • TMUX_ENABLED now defaults to true (every earlier Compose file already set
    it); new sessions still do not start in tmux unless a host asks for it.
  • The new overview is the default layout; the classic overview remains
    available under Settings → Preferences.
  • Existing accounts see the version 3 tour once after login.
  • With CORS_ORIGINS=*, realtime connections accept only pages served from the
    address used for WebSSH. Reverse proxies must pass the original Host header
    (see the upgrade notes); SOCKETIO_ALLOW_ANY_ORIGIN=true restores the old
    behaviour outside production.

See Version 3 overview for functionality, media and release gates.
See Configuration ownership
for existing Compose files, Admin controls and authoritative environment overrides.

Upgrade and recovery

Preserve the complete persistent data and recovery volumes before upgrading.
Keep the previous image pinned by version or digest. Existing themes, accounts
and saved settings are retained. Review effective deployment overrides in Settings.

Exported backups deliberately exclude saved remote passwords and SSH keys.
They do not replace a complete pre-upgrade recovery snapshot. For rollback, stop
the new instance and restore its matching pre-upgrade volumes with the previous
image; do not assume a newer database is supported by an older executable.

Changes from 2.7.0

Verified delivery

  • Tag commit: c6ecb87c23a1b9369b1534770f248df4a6994933.
  • Tag CI and native image publication passed: the full test suite, browser end-to-end, SSH and SMB integration, container upgrade and Redis rate-limiter tests.
  • Native Linux AMD64 and ARM64 images passed the fixable High/Critical vulnerability and hardened runtime gates. Both carry SPDX SBOM and SLSA provenance and the tag revision label, checked directly in GHCR.
  • Version tags: ghcr.io/bifrost0x/webssh:3.0.0 and :3.0; latest points to the same image.
  • Immutable image: ghcr.io/bifrost0x/webssh@sha256:126bfd4c2a35f9d1f7424060bced4b7ecf88bd701f33f7ec8398ffe66333b178.
  • A complete backup, verification and web restore, and HTTPS behind a TLS reverse proxy with an unchanged 2.7 Compose file, were exercised on builds of this version before tagging.

Deployment-specific identity-provider, native-device, upgrade and recovery acceptance is not inferred from automated CI. Follow the upgrade precautions above and validate your own configuration.

Assets 3
Loading