Skip to content

Orion Belt v0.4.0

Choose a tag to compare

View all tags
@zrougamed zrougamed released this 11 Jul 13:22
v0.4.0
a6c0455
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release date: July 2026
Status: Alpha

Privileged access management with MFA/WebAuthn, vanilla OpenSSH clients, a role-aware web console, optional OpenFGA, and encrypted session recordings.

Highlights

  • MFA — TOTP enrollment and enforcement on API login; org-wide auth.mfa_required
  • YubiKey / FIDO2 — WebAuthn for the web console; SSH security keys (sk-ssh-ed25519@openssh.com, etc.)
  • OpenSSH agentless clients — connect with stock ssh via user+machine@gateway (no osh required)
  • Web console (/ui) — role-aware ops UI with live terminal, file browser, approvals, and security settings
  • OpenFGA — optional external authorization with ReBAC fallback
  • Recording hardening — AES-256-GCM at rest + retention cleanup

What's new

Authentication & access

  • TOTP: POST /api/v1/mfa/enroll|confirm|disable, GET /mfa/status; backup codes
  • WebAuthn register/login APIs; config under auth.webauthn
  • Multiple SSH public keys per user (including FIDO sk-*) via /api/v1/ssh-keys
  • JWT, API keys, and session auth retained from earlier releases
  • User roles: admin, operator, auditor, user (admin/operator for approvals)

OpenSSH clients

  • Interactive: ssh alice+web-01@gateway, ssh alice+bob%web-01@gateway
  • Exec: ssh alice@gateway 'bob@web-01' / remote commands
  • PTY / window-change forwarding for interactive sessions
  • Guide: docs/openssh-clients.md

Web console

  • Embedded SPA at / → /ui
  • Dashboard, access requests, machines, sessions/playback, users, audit
  • Live web terminal (WebSocket + xterm)
  • File browser (list, upload, download, mkdir, delete)
  • Security: TOTP, WebAuthn, SSH keys

Authorization & recording

  • Optional OpenFGA client (auth.openfga); example model in docs/openfga-model.fga
  • Recording AES-GCM via recording.encryption_key
  • Retention via recording.retention_days (periodic cleanup)

Docs

  • Updated README, ROADMAP, ARCHITECTURE
  • New OpenSSH and OpenFGA docs

Upgrade notes

  1. Migrate — restart server so Postgres migrations add MFA, roles, SSH keys, and WebAuthn tables.
  2. Config — review config/server.example.yaml:
    • auth.jwt_secret, auth.mfa_required
    • auth.webauthn (rp_id, origins must match your public URL)
    • recording.encryption_key / retention_days
    • auth.openfga if using OpenFGA
  3. WebAuthn — rp_id / origins must match the host users open (e.g. not localhost in production).
  4. Recordings — existing plaintext files still play back; new sessions encrypt only when encryption_key is set.
  5. Breaking-ish — API login with MFA enabled requires totp_code (or WebAuthn login path). SSH with mfa_required denies users who have not enrolled MFA.

Compatibility

Area Notes
Agents Still required on targets (reverse tunnels)
osh / ocp / oadmin Still supported
OpenSSH Preferred for interactive shells without installing CLI
DB PostgreSQL

Known limitations

  • No ProxyJump / direct-tcpip to targets (session-on-agent model)
  • SFTP subsystem not implemented (use ocp or web file browser)
  • WebAuthn needs correct rp_id / HTTPS in real deployments
  • OpenAPI spec and HA / IdP integrations still upcoming

What's Changed

  • Adding docker compose for local dev by @zrougamed in #5
  • feat: Phase 1 hardening by @zrougamed in #6
  • feat: v0.4 — MFA/WebAuthn, OpenSSH clients, web console, OpenFGA, recording encryption by @zrougamed in #7

Full Changelog: v0.3.0...v0.4.0

Contributors

zrougamed
Assets 2
Loading