Skip to content

Crow 0.3.0

Choose a tag to compare

View all tags
@the-nelson the-nelson released this 07 Oct 16:29
· 99 commits to main since this release
v0.3.0
4af3225

Crow 0.3.0: a security release, plus more of the config files ops people edit, and verifiable downloads.

Binaries: Linux x86_64 (install.sh puts Crow and its icon under ~/.local) and macOS Apple Silicon (an ad-hoc signed Crow.app: the first launch needs right-click → Open).

Verify a download with slsa-verifier (SLSA Build Level 3 provenance), or against SHA256SUMS:

slsa-verifier verify-artifact crow-linux-x86_64.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/errorware/crow --source-tag v0.3.0

Security

A full audit of everything Crow does on a server as root. Update if you manage servers where other people have accounts.

  • authorized_keys are edited as their owner, never as root, so a user's own ~/.ssh can't redirect Crow's writes elsewhere.
  • Config saves as root refuse a folder another account can change (for example a pg_hba.conf inside postgres's data directory), and say why. Linked files, such as nginx's sites-enabled, are saved through to the file they point at instead of being replaced.
  • Host key rotation always puts the old keys back when the new ones fail sshd -t or the reload, and reloads sshd on systemd, OpenRC and SysV alike.
  • Lock-out guards: Crow won't delete the account it logs in as, or revoke its own key; the firewall's lock-out check covers a rule with no port; nginx saves keep the old file when nginx -t was already failing and the change makes it worse.
  • A user can no longer hide everyone's keys from the Users page, or the running-packages list from the Updates view.
  • SSH connection sockets live in a private folder per user. New private keys are created readable only by you. Key file names can't leave the keys folder. Local temp files have random names.

Config editors

  • Add keys from a section's heading: a + on each systemd section ([Service]), INI section ([mysqld]), fail2ban jail and nginx block (server, location) adds a line at the end of that section, with the keys that section usually takes, what each does, and a starting value.
  • fail2ban (jail.local, jail.d/*): values on several lines (logpath, ignoreip) are kept as written; checked with fail2ban-client -t before saving.
  • chrony (chrony.conf, checked with chronyd -p) and ntp (ntp.conf).
  • resolv.conf, with a warning when systemd-resolved, NetworkManager or resolvconf rewrites the file.

Interface

  • One small icon button for row and close actions everywhere: delete appears on hover, in red.

Releases

  • Every release carries its binaries, SHA256SUMS and SLSA provenance, attached by the release workflow itself.
Assets 6
Loading