Skip to content

v0.2.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Oct 16:15
· 2 commits to main since this release
v0.2.1
6e827dd

v0.2.1 — safer SSH defense, Telegram and verified daily updates

中文

  • 兼容性与升级：正式构建改用 Go 1.27.2，支持 macOS 26 的加载要求；启动即迁移本项目旧版 nft 全端口规则，无需等待新攻击。v0.2.0 被 CI 门禁拦截，未发布资产或更新网站。

  • 减少误封：新配置只计明确密码失败，按用户分组；同批成功登录优先处理，默认提供 10 分钟来源 IP 宽限。公司出口仍应加入白名单，公网 SSH 无法通过 MAC 识别内部设备。

  • 可靠扫描：Windows 事件游标与去重、文件轮转识别、半行等待、多规则独立偏移、状态写入锁；修复自定义规则意外继承默认字段的问题。

  • SSH 端口范围：新增 ssh_ports，默认 [22]；Windows 改用本地目标端口，Linux 支持多端口。没有连接频率丢弃规则。

  • 海外通知：新增 Telegram 机器人/话题/静默通知，完善 Discord；保留 Slack、Feishu/Lark、webhook、邮箱。独立渠道、10 秒超时、持久重试、消息限长和凭据脱敏。

  • 避免进程误杀：状态查看、doctor、定时巡检只读；手动清理默认关闭，仅限定入侵程序名可处置。临时目录、xmrig、masscan 不单独触发终止。报告碰撞不覆盖。

  • 每日自动更新：只选正式 Release，校验 SHA256、版本和现有配置，备份旧二进制，重启失败尝试回滚；保留配置、白名单、凭据和状态。

  • 文档与发布：19 页中英文 HTML/离线包，新增通知和更新手册；继续只在正式版本标签触发 Actions，通过检查后发布。

升级

先用安装器升级旧二进制，再执行：

sudo banhack233 safe-ssh -write -config /etc/banhack233/config.json
sudo banhack233 config-check -config /etc/banhack233/config.json
sudo systemctl restart banhack233
sudo banhack233 auto-update -enable -config /etc/banhack233/config.json

旧配置不会静默覆盖。safe-ssh 仅迁移原默认规则；自定义规则需审阅。通知需要本机真实凭据，示例不可直接用于收件。自动更新依赖 GitHub 可达和托管服务；macOS PF 仍需管理员配置过滤规则。

English

Release builds now use Go 1.27.2 for macOS 26 compatibility. Production startup immediately narrows this application's legacy nft all-port rules while preserving blocked addresses. The v0.2.0 candidate failed its release gate; no assets or Pages update were published for it.

Password-only defaults and successful-login grace reduce shared-egress false bans. Telegram joins Discord, Slack, Feishu/Lark, generic webhooks and TLS email, with independent bounded delivery and durable retries. Windows cursor/local-port fixes, configurable SSH ports, file identity, independent rule offsets and process locks improve ingestion and enforcement.

Diagnostics and scheduled audits never kill processes. Explicit manual cleanup remains conservative and disabled by default. Verified daily stable updates preserve configuration/state, keep a previous binary and attempt rollback when the managed daemon fails startup checks.

Existing configurations are preserved. Migrate the named default rule with safe-ssh -write, validate and restart, then opt in with auto-update -enable. Custom rules and live channel credentials need operator review. MAC-based remote-device bans are not supported; macOS PF filters remain administrator-managed.

Assets and documentation

Six native binaries, bilingual HTML archive and SHA256SUMS.txt. Installers/updater verify hashes; verify manual downloads against the same Release manifest. Online documentation: 中文 · English.

Assets 10
Loading