Skip to content

Crow 0.8.0

Choose a tag to compare

View all tags
@the-nelson the-nelson released this 09 Oct 23:32
· 64 commits to main since this release
v0.8.0
0225775

Crow 0.8.0: security fixes you can apply, people and certificates across the fleet, checks, incidents, disaster recovery, and team roles. Every new page is a tab in Fleet Setup.

Binaries: Linux x86_64 (install.sh puts Crow and its icon under ~/.local) and macOS Apple Silicon (an ad-hoc signed Crow.app: the first launch needs right-click → Open).

Verify a download with slsa-verifier, or against SHA256SUMS:

slsa-verifier verify-artifact crow-linux-x86_64.tar.gz \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/errorware/crow --source-tag v0.8.0

Hardening

Fleet Setup → HARDENING.

  • Each finding comes with a fix: root login over SSH, password login, no firewall.
  • Fixes are guarded: Crow checks that a fresh login still works, validates the config with sshd -t, and keeps an undo.
  • Accept a risk on purpose. It stops counting against the server, and stays listed as accepted.
  • EXPORT writes a posture report (Markdown).

Certificates

Fleet Setup → CERTIFICATES.

  • Every certbot certificate on the fleet, with its expiry date.
  • Broken auto-renewal is flagged: no timer, or a failed last run. It raises an alert.
  • RENEW runs a dry run first, then renews, then checks and reloads nginx or Apache.

People

Fleet Setup → PEOPLE.

  • Who has access where: accounts and SSH keys, one matrix for the whole fleet.
  • Offboarding: revokes the person's keys first, then locks or deletes their accounts, on every server at once.
  • Onboarding: an account and a key on a group's servers.
  • Crow's own user and key, and root, are never touched.

Log search

Fleet Setup → LOG SEARCH.

  • Search the journal of every server in a group at once, merged into one timeline.
  • Saved searches can alert when they match.

Checks

Fleet Setup → CHECKS.

  • HTTP, TCP and DNS checks, run from Crow, so from outside the server.
  • Uptime per check.
  • After 2 failures in a row, a check raises a critical alert. Email mails it.

Incidents

Fleet Setup → INCIDENTS: one timeline for a time window. It shows alerts, changes made by Crow, and journal errors from the servers involved. Export it as Markdown.

Disaster recovery

Fleet Setup → DR PLANS.

  • A plan holds: what matters on a server, where its backups go, the RTO and RPO, and a runbook.
  • CHECK AGAINST THE SERVERS:
    • backups are newer than the RPO;
    • their timer runs;
    • the paths exist;
    • the config files have baselines;
    • snapshots are available.
  • Drills: run one and Crow times it against the RTO.
  • EXPORT the plan, to keep a copy you can read while Crow is down.

Team

Fleet Setup → TEAM. This is local team mode: members live in this machine's vault. Syncing them between machines comes with Crow accounts.

  • Members, roles and scopes:
    • Roles: Viewer, Operator, Admin, or a custom set of permissions.
    • A scope limits a member to some groups or environments.
  • Signing in: with a team, Crow asks who's at the keyboard when it starts. Each member signs in with their own passphrase.
  • Roles are enforced on every action that changes a server, and on keys and settings. Fleet runs skip servers outside the member's scope.
  • Signed changes: each change record carries the member's name, shown in the audit log.
  • Optional: fleet runs need a second member's passphrase.
Assets 6
Loading