suSSHi Chef

Overview

Tip

The recommended update path is to update suSSHi Chef first, followed by the suSSHi Gateway(s).

Release

Upgrade Path

Image

26.10

>= 26.08

docker.io/wasabielements/susshi-chef:v26.10

26.09

>= 26.08

docker.io/wasabielements/susshi-chef:v26.09

26.08

-

docker.io/wasabielements/susshi-chef:v26.08

Release 26.10

Security

  • Inactive gateway user groups and target groups no longer grant access through their Access Profiles.

  • Client authentication properties are now stored encrypted. The database migration encrypts existing entries.

  • The Client Auth Set detail view no longer reveals the length of a stored secret.

  • Changing the interactive method of a Client Auth Set now replaces its settings completely, so no settings of the previous method are left behind.

Improvements

  • Multi-value fields such as Command Execs now have a remove button for each row.

  • The Client Auth Set detail view shows the IP Session Cache details only when caching is enabled.

  • Saving an unchanged Client Auth Set no longer creates a pending change.

Bug Fixes

  • Fix gateways receiving expired SIC certificate on SIC initialization. suSSHi Chef now issues a new certificate instead.

  • Fix SIC certificate renewal skipping gateways without an SSL client fingerprint.

  • Fix the reserved keywords ALL (gateway user and group names) and DENY (Access Profile names) being accepted in a different letter case.

  • Fix adding a row to a multi-value field copying the whole input group instead of a single empty field.

  • Fix “Last Auth fail” of a gateway user being shown in server-local time instead of UTC.

  • Fix HTTP 500 on the partition keys list when a key is assigned to a suSSHi Proxy.

  • Fix HTTP 500 on the suSSHi Proxy detail page when targets are assigned to the proxy.

  • Remove the QR code reference from the plain-text TOTP email.

Release 26.09

New Features

  • Enterprise Edition subscriptions can now be activated online and automatically renewed. For air-gapped installations, signed subscription token files remain supported. See Subscription for details.

Improvements

  • Add a hint on the gateway page when suSSHi Chef cannot reach the configured SUSSHI_CHEF_URL because it is being accessed via localhost.

Bug Fixes

  • Fix session_end_on_logout not being cast to a boolean before being stored in the OpenID Connect client authentication properties.

Release 26.08

Open Source Release

With this release, suSSHi Chef, suSSHi Gateway, suSSHi Proxy, and suSSHi Sous Chef are now freely available under the GNU Affero General Public License v3 (AGPL-3.0-or-later). We believe open source is the right foundation for security-critical infrastructure, and we are thrilled to share this work with the broader community.

Information

  • This release also marks a breaking change when updating from a proprietary version of suSSHi. Please contact us for more information and support on updating to this release.