# :zap: Security

- No security fixes since previous release
- Oldest release with no known [security issue](https://github.com/ovh/the-bastion/security/advisories) is `v3.14.15` (2023-11-08)

# :bulb: Highlights

The main noteworthy change in this release is the support for so-called Secure Keys :key:  (FIDO2) for ingress connection. If you're upgrading from a previous version, you'll have to enable support in the configuration file, refer to the specific upgrade instructions below. This is enabled on new installations by default.

How to generate and use a Secure Key from your hardware token to secure SSH access is usually detailed in the documentation of your hardware key vendor (For example [Yubico](https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html)).

A more complete list of changes can be found below, for an exhaustive (and boring) list, please refer to the [commit log](https://github.com/ovh/the-bastion/compare/v3.15.00...v3.16.00).

# :pushpin: Changes
- feat: support hardware-based Secure Keys (FIDO2) for ingress authentication
- enh: remove netcat dependency by using perl bultins
- enh: ``--wait`` now checks whether the TCP port is open instead of just pinging the host
- fix: logic error in ``etc/pam.d/sshd.rhel`` breaking MFA handling if enabled

# :fast_forward: Upgrading

- [General upgrade instructions](https://ovh.github.io/the-bastion/installation/upgrading.html)
- [Specific upgrade instructions for v3.16.00](https://ovh.github.io/the-bastion/installation/upgrading.html#v3-16-00-2024-04-10)
