v1.5.1

Changelog

• c861dd3 Merge pull request #212 from mnestor/fix/210-rate-limit-static-assets
• 6f83ee1 Merge branch 'main' into fix/210-rate-limit-static-assets
• d24966e Merge pull request #213 from mnestor/chore/211-rename-ssoossh-nss
• 43d4d35 chore(nss): rename ssoosshd-nss to ssoossh-nss
• ab648c4 fix(server): skip the rate limiter for immutable frontend assets

pam_ssoossh

The PAM module is not built or released here. It ships from its own
repository, github.com/mnestor/ssoossh-pam,
on its own cadence, and its packages -- the -glibc-openssl3,
-glibc-openssl1.1 and -musl builds -- are attached to its releases,
not to this one.

• Packages: latest pam_ssoossh release
• All versions: ssoossh-pam releases
• Installing it: Installing pam_ssoossh

v1.5.0

Changelog

• df955f2 Merge pull request #209 from mnestor/feat/200-nss-directory
• 5e5cfc0 test(nssd): close each bad-input connection on its own cause, not the timer
• 856ffbb Merge branch 'fix/200-pr-ci' into feat/200-nss-directory
• 3412b7b test(nss): refuse a foreign redirect_uri in the e2e OIDC provider
• 69428e6 test(bootstrap): cover the NSS wiring the directory branch added
• feb2346 docs(nss): make the public CA section an h3 under Configure
• 27bd9fa test(nssd): run the config file checks as root too
• f1ef00f style(frontend): block-form resolve() disables on the NSS links
• 07ca191 test(config): record the squashed http.tls keys in the no-schema golden
• 965b55d Merge branch 'main' into feat/200-nss-directory
• 06b596f SSOOSSH.md: directory narrows roles; daemon TLS trust named explicitly
• b03a138 Merge branch 'feat/200-drop-srv' into feat/200-nss-directory
• b49119d nssd: drop SRV server discovery; server is required
• 9bbea0f Merge branch 'feat/200-nss-keys-followups' into feat/200-nss-directory
• d96a487 docs(product): add the approval mail and the NSS admin pages to SSOOSSH.md
• a07a2a8 docs(nss): fleet key admins on All NSS keys, id search, rail label
• a2fdd45 fix(nss): carry the way back through the rotation report
• 895915e feat(nss): open All NSS keys to fleet key admins
• e284a01 feat(nss): find a fleet key by its id on All NSS keys
• cac10d5 Merge branch 'feat/200-ldap-authoritative-roles' into feat/200-nss-directory
• f2c7d7c docs: document authoritative role groups and the narrowing exception
• 83451c9 feat(ldap): let the directory take role groups away between logins
• fc05819 Merge branch 'feat/200-nss-admin-keys' into feat/200-nss-directory
• be6d447 docs(nss): describe All NSS keys and the narrowed NSS keys list
• cebb2a3 fix(nssd): discover only from a named domain unless a key pin is set
• 51a8cb7 feat(nss): list only the keys a viewer's groups manage on /nss-keys
• 6831c5d feat(frontend): add the All NSS keys page for auditors and above
• 76e7eb3 fix(api): refuse an SRV target outside the discovery domain
• 0f2a3c2 Merge branch 'feat/200-nssd-system-trust' into feat/200-nss-directory
• 3674561 docs(nss): tls_ca_file: system for the host's trust store
• 45b3990 feat(nssd): tls_ca_file: system trusts the host's system store
• 32fb1fc feat(api): pinned mode with the system trust store as its root
• 36747b6 Merge branch 'feat/200-nss-approval-mail' into feat/200-nss-directory
• 01474ec feat(nss): mail every admin when a uid or gid change waits for approval
• b4828b1 feat(notify): add the admin mail kinds for pending NSS id changes
• 10f1b48 feat(nss): list every fleet key for auditors and above
• b795054 feat(nss): store each fleet key use's address as a searchable key
• fcacf96 docs(nss): trusting a public CA's roots instead of pinning its key
• ba5d28c docs(product): record the NSS directory in SSOOSSH.md
• da200cf Merge branch 'fix/200-nss-keys-ux-audit' into feat/200-nss-directory
• c310b64 fix(frontend): say what a refused NSS key does to a host's lookups
• a85a98e docs(frontend): describe ConfirmModal confirmDisabled and the secret panel changes
• 18057a0 fix(frontend): keep NSS key list filters and tidy the create form
• 91fcc14 fix(frontend): name the key on its rotation report and let it refresh
• 2b17060 fix(frontend): say what a rotation does to an NSS key's expiry
• 6ff156c fix(frontend): name the one-time secret panel and stop a stale leave prompt
• 5c2ec8e fix(frontend): keep the caret in place on the NSS key detail page
• 4508385 Merge pull request #203 from mnestor/dependabot/npm_and_yarn/frontend/frontend-b322922770
• 52550b4 fix(frontend): suppress no-navigation-without-resolve on non-route links
• 1db2c12 fix(nssd): report a refused admin call the same way whichever side closed first
• df3ec42 Merge branch 'main' into dependabot/npm_and_yarn/frontend/frontend-b322922770
• 63ddc7f Merge branch 'chore/200-nss-coverage-gaps' into feat/200-nss-directory
• d91aaab test(nssd): cover the NSS directory's error and shutdown paths
• 501fca4 Merge pull request #204 from mnestor/dependabot/github_actions/actions-c673fd7efc
• 0e30971 Merge branch 'main' into dependabot/github_actions/actions-c673fd7efc
• a43e1a4 Merge pull request #201 from mnestor/dependabot/go_modules/go-d776d91269
• 7eb88e0 Merge branch 'main' into dependabot/go_modules/go-d776d91269
• 1326f0d Merge pull request #202 from mnestor/dependabot/npm_and_yarn/user-docs/user-docs-ddab9eb68a
• f3b8374 Merge branch 'main' into dependabot/github_actions/actions-c673fd7efc
• d8f6da3 Merge branch 'main' into dependabot/npm_and_yarn/frontend/frontend-b322922770
• 640515c Merge branch 'main' into dependabot/npm_and_yarn/user-docs/user-docs-ddab9eb68a
• aa88834 Merge branch 'main' into dependabot/go_modules/go-d776d91269
• ecfec1b test(nssd): keep the per-call read timeout out of the idle budget test
• eb9c938 Merge branch 'fix/200-nssd-membership-contradiction' into feat/200-nss-directory
• 424dfba fix(nssd): weigh every served membership against cached group lists
• e303851 Merge branch 'feat/200-nss-membership-added-at' into feat/200-nss-directory
• 20407ca feat(nss): date stored memberships and drop additions from the history
• 24552e3 Merge pull request #208 from mnestor/fix/207-tls-squash
• 0d9d57c Merge branch 'fix/200-nssd-membership-coherence' into feat/200-nss-directory
• e93d333 fix(nssd): mark contradicted user and group cache entries stale
• 6bbc955 feat(frontend): name the admin on an accepted NSS id change row
• 922fa83 Merge branch 'feat/200-nss-history-rows' into feat/200-nss-directory
• 208c585 feat(webui): show NSS entry history as one line per change
• aa10454 fix(config): decode http.tls.certificate_file and private_key_file
• 06f4502 test(migration): record foreign key delete and update rules in the Postgres golden
• 1b00d93 Merge branch 'chore/200-remove-shell-pref' into feat/200-nss-directory
• b99a259 chore(nss): remove the shell self-service
• 0d75999 docs(http): say what a Unix socket listener trusts for the client address
• c660b39 test(nssd): run the man-page tree subtests serially
• 537b349 Merge branch 'fix/200-nssd-conn-cap' into feat/200-nss-directory
• 0b72ff9 test(nss): pass the posix gid as a pointer in the audit refs test
• 3780b1d fix(nssd): cap userdb connections and bound their idle time
• 8e0771a Merge branch 'feat/200-nss-directory-primary-gid' into feat/200-nss-directory
• a85b24c feat(nss): handle the primary gid the way sssd does in each auto_private_groups mode
• 92530f8 Merge branch 'chore/200-nss-id-ranges' into feat/200-nss-directory
• 31bba55 docs(config): rewrap the nss.rate_burst comment
• f8ddef0 docs(nss): warn that trusted_proxies decides the NSS source address
• 6714cef docs(nss): document choosing min_id and max_id against systemd's ranges
• 32c3fd0 Merge branch 'fix/200-sqlite-fk-order' into feat/200-nss-directory
• 60eed01 fix(test): read SQLite foreign key actions in PRAGMA column order
• 5275a3c Merge branch 'fe...

v1.4.0

Changelog

• 7c8e6da docs: pam-ssoossh v1.3.0 brings EL 10 and a working sshd path
• 5fe5592 docs(pam): drop the confined-user caution, it was wrong
• 51c3f2f docs(pam): give both SELinux routes, and name the confined-user gap
• 2e0b14d docs(pam): name the .deb as the release actually publishes it
• 56a62b8 docs: say that the PAM module has no EL 10 build
• 8befde3 docs: write up installing from the package repository
• 22ea588 feat(packaging): serve the PAM module from this repository
• 4a69b53 fix(ci): install rclone from upstream, not from Ubuntu's 1.60
• 197e257 fix(release): upload to R2 only once the release is published
• fbf5e3d fix(release): upload the signing key as a file, and skip the bucket check
• 7f5b4d8 fix(release): stage the generated keys outside dist/
• 28ddb64 fix(ci): ignore the apk signing key so the release tree stays clean
• 0126d20 fix(ci): point the R2 secrets at the item's new 1Password UUID
• 4cab5d0 refactor(packaging): read the repository prefix from 1Password
• fd35a0a docs(selinux): say how to hand the check to someone with an EL9 host
• b72b7fe feat(packaging): publish the repository on tags, and refuse to publish unsigned
• 6d4fa7b docs(selinux): narrow an overstated caveat about the pam policy package
• b47fc69 docs(selinux): say why the check is unrun, and what does not substitute
• 823db5b feat(packaging): add the R2 publish step, wired but not invoked
• 9486c5b test(selinux): add the enforcing-host check for the binary path move, and record why RHEL gets no authselect feature
• d855d08 fix(packaging): stop the collision error asserting a cause it cannot know
• 5005000 feat(packaging): sign the apk and publish its public key
• 6356a72 perf(packaging): store each rpm once in a shared pool
• 5fe7b4a fix(packaging): refuse to silently drop apk packages from the repository
• be2a52f feat(packaging): add the ssoossh-release repository configuration package
• 579ea38 fix(packaging): file rpms by their Release field, not their file name
• 2dbae67 fix(packaging): fail the repo build on a NEVRA collision
• 14b3cc3 feat(packaging): generate signed apt and yum repository trees
• f327a31 docs: fix the two recipes that could not work as written
• 2d594cb feat(packaging): make the packages do the host integration work
• 6fab3d7 fix(server): set security headers on health routes, pass proxy trust when direct

pam_ssoossh

The PAM module is not built or released here. It ships from its own
repository, github.com/mnestor/ssoossh-pam,
on its own cadence, and its packages -- the -glibc-openssl3,
-glibc-openssl1.1 and -musl builds -- are attached to its releases,
not to this one.

• Packages: latest pam_ssoossh release
• All versions: ssoossh-pam releases
• Installing it: Installing pam_ssoossh

v1.3.0

Changelog

• c119308 feat(client): report administrative policy so an approver can see why (#67)
• 6448514 chore(macos): move the Jamf profile schema to deploy/ (#66)
• 589f546 docs(proposals): record client policy assertions and the paused picker (#64)
• 17c9940 feat(service): let extensions be requested at enroll and chosen at approval (#65)

pam_ssoossh

The PAM module is not built or released here. It ships from its own
repository, github.com/mnestor/ssoossh-pam,
on its own cadence, and its packages -- the -glibc-openssl3,
-glibc-openssl1.1 and -musl builds -- are attached to its releases,
not to this one.

• Packages: latest pam_ssoossh release
• All versions: ssoossh-pam releases
• Installing it: Installing pam_ssoossh

v1.2.6

Changelog

• 74dea95 test(client): stop the config tests reading real system state (#63)
• 37cd27d fix(client): read the binary plists macOS actually writes (#62)
• 9de7042 docs(macos): add an MDM-ready plist and a Jamf custom profile schema (#61)

pam_ssoossh

The PAM module is not built or released here. It ships from its own
repository, github.com/mnestor/ssoossh-pam,
on its own cadence, and its packages -- the -glibc-openssl3,
-glibc-openssl1.1 and -musl builds -- are attached to its releases,
not to this one.

• Packages: latest pam_ssoossh release
• All versions: ssoossh-pam releases
• Installing it: Installing pam_ssoossh

v1.2.4

Changelog

• b682bb1 fix(client): answer with the floor when the principals map will not load (#60)
• efca3c8 Merge pull request #59 from mnestor/docs/ldap-probe-workflow
• 7e6f4a5 docs(ldap): document the probe as a diagnostic workflow
• df1fcac Merge pull request #58 from mnestor/feat/host-principals-self-floor
• d884680 Merge pull request #56 from mnestor/fix/group-names-with-commas
• e762c18 Merge pull request #57 from mnestor/fix/csp-inlined-fonts
• 75c1396 test(e2e): update the host command suite for the principal floor
• b1d91d8 feat(client): always include the looked-up account in host principals
• c7463b7 test(session): cover full-DN group values, and state the DN/CN contract
• fd9d5b3 fix(frontend): stop inlining fonts the CSP will not load
• 932de9b fix(session): stop splitting group names on their own commas

pam_ssoossh

The PAM module is not built or released here. It ships from its own
repository, github.com/mnestor/ssoossh-pam,
on its own cadence, and its packages -- the -glibc-openssl3,
-glibc-openssl1.1 and -musl builds -- are attached to its releases,
not to this one.

• Packages: latest pam_ssoossh release
• All versions: ssoossh-pam releases
• Installing it: Installing pam_ssoossh

v1.2.3

Changelog

• b429e6c Merge pull request #55 from mnestor/fix/session-payload-limit
• 3ac15be fix(session): stop applying a cookie size limit to the session row

pam_ssoossh

The PAM module is not built or released here. It ships from its own
repository, github.com/mnestor/ssoossh-pam,
on its own cadence, and its packages -- the -glibc-openssl3,
-glibc-openssl1.1 and -musl builds -- are attached to its releases,
not to this one.

• Packages: latest pam_ssoossh release
• All versions: ssoossh-pam releases
• Installing it: Installing pam_ssoossh

v1.2.2

Changelog

• b429e6c Merge pull request #55 from mnestor/fix/session-payload-limit
• 3ac15be fix(session): stop applying a cookie size limit to the session row

pam_ssoossh

The PAM module is not built or released here. It ships from its own
repository, github.com/mnestor/ssoossh-pam,
on its own cadence, and its packages -- the -glibc-openssl3,
-glibc-openssl1.1 and -musl builds -- are attached to its releases,
not to this one.

• Packages: latest pam_ssoossh release
• All versions: ssoossh-pam releases
• Installing it: Installing pam_ssoossh

v1.2.1

Changelog

• 49c1b4c Merge pull request #54 from mnestor/feat/branding-support-contact
• c68b76a Merge main into feat/branding-support-contact
• b353cb1 Merge pull request #53 from mnestor/feat/pkce-toggle-and-mail-log-tag
• 5ad6b9a fix(logging): keep audit events above the shipped log level
• e736202 feat(branding): point users at local support instead of GitHub
• 361cb8c feat(auth): allow PKCE to be turned off for a provider that refuses it
• da9877c fix(logging): route mail records to the destination mail.logging names
• 1c5746a adding a why page

pam_ssoossh

The PAM module is not built or released here. It ships from its own
repository, github.com/mnestor/ssoossh-pam,
on its own cadence, and its packages -- the -glibc-openssl3,
-glibc-openssl1.1 and -musl builds -- are attached to its releases,
not to this one.

• Packages: latest pam_ssoossh release
• All versions: ssoossh-pam releases
• Installing it: Installing pam_ssoossh

v1.2.0

Changelog

• 1e61d84 Merge pull request #52 from mnestor/chore/design-motion-refactor
• 91829f5 fix(frontend): return the caret to whatever opened a ConfirmModal
• 02a5b4c feat(frontend): give every overlay an entrance, an exit and a reduced-motion path
• e18f4ec feat(frontend): give every data surface a real loading and empty state
• 2f3340c refactor(frontend): put the type, radius and colour strays on the token scale

pam_ssoossh

The PAM module is not built or released here. It ships from its own
repository, github.com/mnestor/ssoossh-pam,
on its own cadence, and its packages -- the -glibc-openssl3,
-glibc-openssl1.1 and -musl builds -- are attached to its releases,
not to this one.

• Packages: latest pam_ssoossh release
• All versions: ssoossh-pam releases
• Installing it: Installing pam_ssoossh