Skip to content

v1.0.0

Choose a tag to compare

View all tags
@inureyes inureyes released this 24 Oct 01:52
· 247 commits to main since this release
v1.0.0
8e6d60d

New Features

Comprehensive SSH Configuration Support - Added ~71 SSH configuration options (~69% coverage of OpenSSH's 103 options):

  • Certificate Authentication Options

    • CertificateFile - Specify SSH certificate files for PKI authentication (maximum 100 certificates)
    • CASignatureAlgorithms - Define CA signature algorithms for certificate validation (maximum 50 algorithms)
    • HostbasedAuthentication - Enable/disable host-based authentication
    • HostbasedAcceptedAlgorithms - Specify accepted algorithms for host-based authentication (maximum 50 algorithms)

  • Advanced Port Forwarding Control

    • GatewayPorts - Control remote port forwarding access (yes/no/clientspecified)
    • ExitOnForwardFailure - Terminate connection when port forwarding fails
    • PermitRemoteOpen - Specify allowed destinations for remote TCP port forwarding (maximum 1000 entries)

  • Command Execution and Automation Options

    • PermitLocalCommand - Allow execution of local commands after successful SSH connection
    • LocalCommand - Execute local command after connection with token substitution support (%h, %H, %n, %p, %r, %u, %%)
    • RemoteCommand - Execute command on remote host instead of starting interactive shell
    • KnownHostsCommand - Execute command to obtain host keys dynamically (supports token substitution)
    • ForkAfterAuthentication - Fork SSH process to background after successful authentication
    • SessionType - Specify session type: none (port forwarding only), subsystem (e.g., SFTP), or default (shell)
    • StdinNull - Redirect stdin from /dev/null for background operations and scripting

  • Host Key Verification & Security Options

    • NoHostAuthenticationForLocalhost - Skip host key verification for localhost connections (convenient for local development)
    • HashKnownHosts - Hash hostnames in known_hosts file to prevent hostname disclosure if compromised
    • CheckHostIP - Check host IP address in known_hosts for DNS spoofing detection (deprecated in OpenSSH 8.5+, retained for legacy compatibility)
    • VisualHostKey - Display ASCII art of host key fingerprint for visual verification
    • HostKeyAlias - Specify alias for host key lookup in known_hosts (useful for load-balanced services)
    • VerifyHostKeyDNS - Verify host keys using DNS SSHFP records (yes/no/ask)
    • UpdateHostKeys - Accept updated host keys from server automatically (yes/no/ask)

  • Additional Authentication Options

    • NumberOfPasswordPrompts - Control password authentication retry attempts (valid range: 1-10)
    • EnableSSHKeysign - Enable ssh-keysign for host-based authentication

  • Network & Connection Options

    • BindInterface - Bind SSH connection to specific network interface (alternative to BindAddress for multi-homed hosts)
    • IPQoS - Set IP type-of-service/DSCP values for interactive and bulk traffic
    • RekeyLimit - Control SSH session key renegotiation frequency (format: "data [time]")

  • X11 Forwarding Options

    • ForwardX11Timeout - Set timeout for untrusted X11 forwarding connections
    • ForwardX11Trusted - Enable trusted X11 forwarding with full display access

  • Authentication and Security Management Options

    • IdentitiesOnly - Only use identity files explicitly configured in SSH config (prevents authentication conflicts)
    • AddKeysToAgent - Automatically add keys to SSH agent after successful authentication (yes/no/ask/confirm)
    • IdentityAgent - Specify custom SSH agent socket path (enables integration with 1Password, gpg-agent, etc.)
    • PubkeyAcceptedAlgorithms - Restrict allowed public key algorithms (maximum 50 entries)
    • RequiredRSASize - Minimum RSA key size in bits (1024-16384, warns <2048)
    • FingerprintHash - Fingerprint hash algorithm (md5/sha256)

  • Configuration Structure

    • Include directive support for flexible configuration management
    • Match directive support for conditional configuration
    • Support for both "Option Value" and "Option=Value" syntax

Improvements

  • Modular SSH Config Parser: Refactored oversized parser.rs (1706 lines) into category-based modules (~200-350 lines each) for better maintainability and code organization

  • Enhanced Security: Comprehensive security hardening for SSH configuration

    • Path validation to prevent usage of sensitive system files (e.g., /etc/passwd, /etc/shadow)
    • Memory exhaustion prevention with entry limits for certificates and forwarding rules
    • Algorithm list validation with maximum entry limits
    • Deduplication for certificate files and remote forwarding destinations
    • Command injection prevention for LocalCommand and KnownHostsCommand
    • Token validation to prevent invalid substitution patterns
    • Dangerous character detection in command strings (semicolons, backticks, pipes, etc.)

  • Terminology Cleanup: Removed phase terminology from codebase and documentation for better clarity and maintainability

Bug Fixes

  • Fixed critical security vulnerabilities in SSH config parser (Priority: CRITICAL/HIGH)
  • Enhanced input validation and error handling for SSH configuration options

CI/CD Improvements

None

Technical Details

  • Enhanced SSH Configuration Merging: Proper priority handling with scalar option override and vector option accumulation with deduplication
  • Comprehensive Test Coverage: 278 tests including parser, resolver, integration, and security tests
  • Improved Code Organization: Modular structure with category-based modules for better maintainability
  • Configuration Coverage: ~71 options (~69% of OpenSSH's 103 options)
    • Basic options + Include + Match directives (structural)
    • Certificate authentication and port forwarding (7 options)
    • Command execution and automation (7 options)
    • Host key verification, authentication, network, and X11 options (15 options)
  • Validation Features: NumberOfPasswordPrompts range checking (1-10), CheckHostIP deprecation warnings

Dependencies

None

Breaking Changes

None

Known Issues

None

What's Changed

  • refactor: centralize SSH authentication logic into dedicated auth module by @inureyes in #47
  • refactor: split oversized modules into focused components by @inureyes in #48
  • feat: Support Option=Value syntax in SSH config parser by @inureyes in #49
  • feat: Add Include and Match directive support to SSH config parser by @inureyes in #50
  • refactor: Split oversized SSH config modules into smaller submodules by @inureyes in #51
  • feat: Add certificate authentication and advanced port forwarding options by @inureyes in #52
  • docs: Add documentation for Phase 2 SSH config options by @inureyes in #53
  • feat: implement Phase 3 SSH config command execution options by @inureyes in #54
  • [Phase 4] Add remaining useful SSH config options by @inureyes in #55

Full Changelog: v0.9.1...v1.0.0

Contributors

inureyes
Assets 18
Loading