Skip to content

Crow 0.6.0

Choose a tag to compare

View all tags
@the-nelson the-nelson released this 08 Oct 12:44
· 77 commits to main since this release
v0.6.0
958436d

Crow 0.6.0: bastions you designate, and an Add Server that's three steps instead of five.

Binaries: Linux x86_64 (install.sh puts Crow and its icon under ~/.local) and macOS Apple Silicon (an ad-hoc signed Crow.app: the first launch needs right-click → Open).

Verify a download with slsa-verifier, or against SHA256SUMS:

slsa-verifier verify-artifact crow-linux-x86_64.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/errorware/crow --source-tag v0.6.0

Bastions

You can now reach a server that's only reachable through another one.

  1. Open the bastion's server page and switch on bastion in its header.
  2. In Add Server, pick via for the servers behind it.

From then on, everything Crow does on those servers goes through the bastion: commands, files, the terminal, metrics, the first password login.

  • Each hop logs in with its own identity: the bastion's user, port, key and pinned host key. Before, ssh's -J dropped Crow's options on the jump connection and fell back to whatever ~/.ssh/config said.
  • Bastions can sit behind bastions. A loop, a bastion that's been removed, or a bastion that logs in with a password is refused, and the error names it.
  • Errors say which hop failed:
    • "bastion edge refused Crow's key"
    • "bastion edge can't reach 10.0.0.5: No route to host"
    • or the server's own host-key or login problem
  • Bastion rules:
    • A bastion can't be switched off while servers still go through it.
    • Servers already set up with a jump host count as bastions automatically.
    • The Fleet table shows "via ".

Add Server, rebuilt

The wizard had five steps (two of them nearly empty), a side panel full of empty warnings, and demo values filled in. It also showed a made-up SSH banner. It's now three steps, and it only shows what it has actually read:

  1. Connect:
    • Address, port and user on one row.
    • How to reach the server: directly, or through a bastion. A chain shows as a → b.
    • How to log in: a key in Crow, a password once (Crow installs its own key and forgets the password), or your SSH agent.
  2. Verify:
    • The probe, through the bastion if there is one.
    • The host key to compare and trust.
    • A login, and what it read: distro, kernel, memory, disk, firewall, open ports, config tools.
  3. Name: the name (defaults to the address), environment, group, tags, and the Bastion switch.
Assets 6
Loading