← 返回日报
精读 预计 1 分钟

Bastillion 5.1: single-JAR SSH gateway now audits and replays every session

摘要

Bastillion 5.1 发布，核心是会话审计与回放功能升级为默认开启的一等公民：终端会话被完整记录，可在 UI 中按多主机并排回放，支持文本过滤；回放改为流式渲染，可处理数百 MB 输出，修复了服务器端清理循环的二次复杂度问题和 ANSI 控制序列残留；同时强化了 CSRF 防护并更新依赖。升级说明提到 enableInternalAudit 默认开启、保留策略默认 90 天，旧接口被替换。

荐读理由

如果你在构建需要审计的远程访问或运维系统，Bastillion 的流式回放、ANSI 清理和性能修复是可直接借鉴的架构细节；同时，PCI DSS、SOC 2 等合规要求是真实需求，这个开源方案能低成本满足，可纳入技术选型参考。

原文

🎬 Session audit & replay — now a first-class feature, on by default

Every terminal session is now recorded and can be replayed from Audit Sessions in the UI — who ran what, where, and when, side by side for sessions that spanned multiple hosts, with a text filter to jump straight to the lines that matter.

This feature existed behind enableInternalAudit but was experimental: reviewing a session loaded its entire output into the browser in one shot, which hung the tab on any session with real output. That's fixed properly:

  • Output streams from the database to the browser and renders incrementally — sessions with hundreds of megabytes of terminal output replay without breaking a sweat

  • Fixed a server-side cleanup loop that was quadratic in session size and could spin a request thread forever when output contained a backspace at the start of a line

  • Full ANSI/VT100 control sequences (colors, cursor movement, screen modes, window titles) are now stripped from replayed output — no more [?1049h noise from top and friends

Practically every compliance framework has a privileged-access audit-trail requirement somewhere — PCI DSS, HIPAA, SOC 2, ISO 27001 — and this checks that box without a commercial PAM product.

Upgrade note: enableInternalAudit now defaults to true on fresh installs; existing installs keep whatever their persisted config says. Retention is deleteAuditLogAfter (90 days by default); disable recording entirely with ENABLE_INTERNAL_AUDIT=false. If you scripted against the old getJSONTermOutputForSession.ktrl endpoint, it's replaced by the streaming streamTermOutputForSession.ktrl (plain text, one line per record).

🔒 Hardening

  • CSRF token comparison is now constant-time

📦 Dependencies

  • Bouncy Castle bcprov-jdk18on 1.84 → 1.85

  • JUnit Jupiter 6.1.1 → 6.1.2

Lobsters · 1 赞 · 0 评 讨论 → 阅读原文 →

这条对你有帮助吗？