Skip to content

v2.0.0

Choose a tag to compare

View all tags
@inureyes inureyes released this 13 Apr 06:34
· 127 commits to main since this release
v2.0.0
41a0c61

bssh v2.0.0

Major release. Highlights since v1.7.0:

New Features

  • bssh-server SSH Server — a lightweight SSH server designed for container environments
    • Full SSH, SFTP, and SCP protocol support
    • PTY / shell session support with terminal handling
    • Password and public-key authentication
    • YAML-based comprehensive configuration system
    • Command execution handler with security controls
  • Audit Logging Infrastructure
    • File-based audit exporter (JSON Lines)
    • OpenTelemetry audit exporter for observability platforms
    • Logstash audit exporter for ELK-stack integration
    • Configurable audit event types and logging levels
  • Security Features
    • IP-based access control (allow/deny lists)
    • Authentication rate limiting (fail2ban-like protection)
    • Session management and connection limits
    • Path-traversal prevention in the SFTP handler
  • File Transfer Filtering
    • Path-based and pattern-based (glob) filter rules
    • Configurable filter actions (allow/deny)
  • bssh-keygen — SSH key pair generation utility (RSA, Ed25519, ECDSA)
  • Server Configuration Enhancements
    • Per-jump-host SSH private key configuration
    • SSH config Host alias reference in jump_host configuration
    • SSH keepalive settings in interactive mode
  • Separate Packaging — bssh and bssh-server are now distributed as independent Debian packages and Homebrew formulas

Improvements

  • Added comprehensive server configuration manual and manpages
  • Shared module structure for client/server code reuse
  • Help examples and man pages now correctly show -C (uppercase) for the cluster flag — running the old -c examples would fail with clap's "unexpected argument" error

Bug Fixes

  • SSH idle disconnects: interactive sessions could disconnect inconsistently after idle time — sometimes within minutes, sometimes at the ~10-minute mark. Three underlying issues were addressed:
    • russh::Config::inactivity_timeout (10-minute client-side ceiling) is now explicitly set to None when keepalive is enabled, so the keepalive mechanism alone decides peer liveness
    • TCP-level SO_KEEPALIVE (via socket2::TcpKeepalive) is now applied to every SSH socket, so the kernel can detect broken paths even when SSH keepalive replies are dropped by middleboxes
    • The exec-mode code path previously dropped the user-configured SshConnectionConfig at the ConnectionConfig boundary; it now flows through connect_direct / connect_via_jump_hosts / the jump chain, so server_alive_interval actually takes effect in non-interactive runs
  • bssh-server: Use consistent source package name in the Debian control file so dual-package builds resolve correctly
  • bssh-server: Use type inference for ioctl to support both glibc and musl builds

CI/CD Improvements

  • Updated release workflow for dual-package distribution
  • Separate Debian packages and Homebrew formulas for client and server
  • Added Teams release notification
  • Updated non-LTS Ubuntu target from 25.04 plucky to 25.10 questing

Technical Details

  • russh-based SSH server handler implementation
  • Modular audit-exporter architecture with trait-based design
  • SshConnectionConfig::to_russh_config() now sets inactivity_timeout explicitly based on keepalive state; to_tcp_keepalive() derives kernel TCP keepalive params from the same settings
  • Client::connect_with_config was rewritten around russh::client::connect_stream, building the TcpStream manually so SO_KEEPALIVE can be applied before the SSH handshake
  • Key-generation call sites now pass &mut rand::rng() (rand 0.10's thread RNG implements the new rand_core 0.10 CryptoRng trait directly), dropping the previous ssh_key::rand_core::OsRng workaround

Dependencies

  • Synced bssh-russh fork with upstream warp-tech/russh v0.60.0, pulling in the RustCrypto migration:
    • rand 0.8 → 0.10 stable (via rand_core 0.10.0)
    • signature 3.0.0-rc.10, ed25519-dalek 3.0.0-pre.6, elliptic-curve 0.14.0-rc.28, p256/p384/p521 0.14.0-rc.7, ecdsa 0.17.0-rc.16, curve25519-dalek 5.0.0-pre.6
    • der 0.8, sec1 0.8, pkcs8 0.11.0-rc.11, pkcs5 0.8.0-rc.13, spki 0.8.0-rc.4
    • ml-kem 0.3.0-rc.1 (adds module-lattice 0.2)
    • ssh-key 0.6.18 (via internal-russh-forked-ssh-key)
  • tokio 1.50.0 → 1.51.1, socket2 0.6.1 → 0.6.3, signal-hook 0.4.3 → 0.4.4, fastrand 2.3.0 → 2.4.1, async-compression 0.4.37 → 0.4.41, bytes 1.11.0 → 1.11.1
  • Added direct dep on socket2 = "0.6" for TCP keepalive configuration

Breaking Changes

  • Package split: bssh-server is no longer bundled with bssh — it must be installed as a separate package. Debian users: apt install bssh-server. Homebrew users: brew install lablup/tap/bssh-server.

Known Issues

None

What's Changed

  • feat: Create shared module structure for client/server code reuse by @inureyes in #145
  • feat: Implement basic SSH server handler with russh by @inureyes in #146
  • feat: Implement public key authentication for server by @inureyes in #147
  • feat: Implement command execution handler for server by @inureyes in #148
  • feat: Add comprehensive YAML-based configuration system for bssh-server (#130) by @inureyes in #149
  • feat: Implement server CLI interface (bssh-server binary) (#131) by @inureyes in #150
  • feat: Implement SFTP server handler with path traversal prevention (#132) by @inureyes in #151
  • feat: Implement password authentication for server (#127) by @inureyes in #152
  • feat: Implement PTY/shell session support for server (#129) by @inureyes in #153
  • feat: Fix PTY shell output and publish bssh-russh crate by @inureyes in #154
  • feat: Implement authentication rate limiting (fail2ban-like) by @inureyes in #155
  • feat: Implement IP-based access control by @inureyes in #157
  • feat: Implement audit event types and logging infrastructure (#134) by @inureyes in #158
  • feat: Implement file-based audit exporter (JSON Lines) #135 by @inureyes in #160
  • feat: Implement OpenTelemetry audit exporter (#136) by @inureyes in #161
  • feat: Implement Logstash audit exporter by @inureyes in #162
  • feat: Implement SCP server protocol by @inureyes in #156
  • feat: Implement session management and limits (#142) by @inureyes in #159
  • feat: Implement bssh-keygen tool by @inureyes in #163
  • feat: Implement file transfer filtering infrastructure by @inureyes in #164
  • docs: Add server configuration manual and manpages by @inureyes in #166
  • feat: Implement path-based and pattern-based filter rules by @inureyes in #165
  • feat: Support per-jump-host SSH private key configuration by @inureyes in #169
  • feat: Support SSH config Host alias reference in jump_host configuration by @inureyes in #171
  • feat: Support SSH keepalive settings in interactive mode by @inureyes in #172
  • update: Upgrade all dependencies to latest versions by @inureyes in #173
  • fix: Correct cluster flag short form in help examples by @inureyes in #174
  • fix: Prevent SSH idle disconnects via proper keepalive wiring by @inureyes in #175
  • update: Upgrade Cargo dependencies to latest compatible versions by @inureyes in #176
  • update: Bump rand 0.8 -> 0.9 by @inureyes in #177
  • update: Sync bssh-russh fork with upstream russh 0.60.0 by @inureyes in #178

Full Changelog: v1.7.0...v2.0.0

Contributors

inureyes
Assets 44
Loading