# :zap: Security

- No security fixes since previous release
- Oldest release with no known [security issue](https://github.com/ovh/the-bastion/security/advisories) is `v3.14.15` (2023-11-08)

# :bulb: Highlights

This releases updates the supported OS list as follows:
- drop support for Ubuntu 16.04 and CentOS 7
- add support for Ubuntu 24.04 LTS and OpenSUSE Leap 15.6

Appart from the supported OS list, this release has a lot of changes, the most important ones are summarized below.

Add support of ``rsync`` (#301). Now, for specific protocols (such as scp, sftp and rsync), instead of having a dedicated option for all the plugins, they share a new ``--protocol`` option, which will permit adding more protocols if needed, without requiring adding new named options. The previous options are still supported and will keep working, even if the [documentation](https://ovh.github.io/the-bastion/using/sftp_scp_rsync.html) has been updated to only reference ``--protocol``.

Add support of wildcards (also called "shell-style globbing characters"), namely ``?`` and ``*``,
when using the ``--user`` option for plugins such as ``groupAddServer``, ``groupDelServer``, ``groupAddGuestAccess``,
``groupDelGuestAccess``, ``accountAddPersonalAccess``, ``accountDelPersonalAccess``, ``selfAddPersonalAccess``,
``selfDelPersonalAccess``. This implements #461.

Add a new per-account option: egress session multiplexing (usage of the ``ControlPath`` and ``ControlMaster`` ssh client options), for accounts opening a large number of connections to the same hosts, such as is the case with e.g. Ansible usage. You'll find it in the [accountModify](https://ovh.github.io/the-bastion/plugins/restricted/accountModify.html?highlight=multiplexing#cmdoption-accountModify-egress-session-multiplexing) documentation.

Worth noting is also a new plugin: ``groupSetServers``, to permit setting the ACL (asset list) of a group in one shot, to attain a given wanted list, instead of having to rely in several `groupAddServer` and `groupDelServer` calls.

We also enable the ``sntrup761x25519-sha512@openssh.com`` KEX algorithm by default on shipped versions
of ``sshd_config`` and ``ssh_config``, read the specific upgrades instructions linked below if you're interested and this is not a new installation.

A more complete list of changes can be found below, for an exhaustive (and boring) list, please refer to the [commit log](https://github.com/ovh/the-bastion/compare/v3.16.01...v3.17.00).

# :pushpin: Changes
- feat: support wildcards in ``--user`` (fix #461)
- feat: add rsync support through the ``--protocol rsync`` option in all plugins
- feat: add ``--egress-session-multiplexing`` option to ``accountModify``
- feat: add ``groupSetServers`` to entirely change a group ACL in one shot
- feat: ``accountFreeze``: terminate running sessions if any
- enh: add lock for group ACL change to avoid race conditions on busy bastions
- enh: ``selfPlaySession``: remove sqliteLog.ttyrecfile dependency
- enh: autologin: set term to raw noecho when --no-tty is used
- chg: add Ubuntu 24.04 LTS
- chg: bump OpenSUSE Leap from 15.5 to 15.6
- chg: Debian12, Ubuntu20+: enable sntrup KEX by default
- chg: remove support for EOL CentOS 7
- fix: stealth_stdout/stderr was ignored for plugins (fix #482)
- fix: ignore transient errors during global destruction
- fix: install under FreeBSD 13.2

# :fast_forward: Upgrading

- [General upgrade instructions](https://ovh.github.io/the-bastion/installation/upgrading.html)
- [Specific upgrade instructions for v3.17.00](https://ovh.github.io/the-bastion/installation/upgrading.html#v3-17-00-2024-10-14)
