Skip to content

v1.9.0 — Security hardening

Choose a tag to compare

View all tags
@msmcpeake msmcpeake released this 02 Jul 18:02
· 9 commits to main since this release
v1.9.0
ba25496

Security hardening release.

  • Security: block direct access — requests must arrive via a trusted reverse proxy (PATCHKIT_TRUSTED_PROXIES); prevents spoofing the forward-auth header
  • Security: credential API no longer returns private keys or sudo passwords (fingerprint only)
  • Security: database and known_hosts files locked to owner-only (0600) at startup
  • Security: global sudo password masked in settings API
  • Security: HTML-escape all host- and command-derived output in the UI (patch logs, package names, OS names) to prevent XSS from managed hosts
  • Security: validate webhook URLs (http/https only; block loopback and link-local targets)
  • Security: confine ad-hoc OS-detection key paths to the PatchKit home directory
  • Security: host connectivity test no longer returns raw server tracebacks
Assets 2
Loading