Releases: bastillion-io/Bastillion

Release list

5.1.0

🎬 Session audit & replay — now a first-class feature, on by default

Every terminal session is now recorded and can be replayed from Audit Sessions in the

UI — who ran what, where, and when, side by side for sessions that spanned multiple hosts,

with a text filter to jump straight to the lines that matter.

This feature existed behind enableInternalAudit but was experimental: reviewing a session

loaded its entire output into the browser in one shot, which hung the tab on any session

with real output. That's fixed properly:

  • Output streamsfrom the database to the browser and renders incrementally — sessions
    with hundreds of megabytes of terminal output replay without breaking a sweat
  • Fixed a server-side cleanup loop that was quadratic in session size and could spin a
    request threadforeverwhen output contained a backspace at the start of a line
  • Full ANSI/VT100 control sequences (colors, cursor movement, screen modes, window titles)
    are now stripped from replayed output — no more[?1049hnoise fromtopand friends

Practically every compliance framework has a privileged-access audit-trail requirement

somewhere — PCI DSS, HIPAA, SOC 2, ISO 27001 — and this checks that box without a

commercial PAM product.

Upgrade note: enableInternalAudit now defaults to true on fresh installs; existing

installs keep whatever their persisted config says. Retention is deleteAuditLogAfter

(90 days by default); disable recording entirely with ENABLE_INTERNAL_AUDIT=false. If you

scripted against the old getJSONTermOutputForSession.ktrl endpoint, it's replaced by the

streaming streamTermOutputForSession.ktrl (plain text, one line per record).

🔒 Hardening

  • CSRF token comparison is now constant-time

📦 Dependencies

  • Bouncy Castle bcprov-jdk18on1.84 → 1.85
  • JUnit Jupiter 6.1.1 → 6.1.2

5.0.0

Highlights

  • Licensing model— Bastillion now runs unlicensed at up to 5 registered systems.
    Paid tiers (Starter/Team/Business) raise the cap; a- .licfile is supplied via the
  • LICENSE_KEYenv var or- licenseKeyin- BastillionConfig.properties. New
  • LicenseUtilvalidates the license, enforces the system cap, and surfaces
    licensee/expiry info (with a 90-day pre-expiry warning) under Settings.
  • Self-contained jar— the app now runs as- java -jarwith an embedded Jetty
    server and HTTPS out of the box (new- io.bastillion.Main), instead of requiring a
    separate servlet container distribution.
  • Upgraded to Java 21 and Jakarta EE 11, with dependency updates across the board.
  • Full Ed25519 (default) and Ed448 SSH key support.
  • v4 → v5 migration tool(- tools/migrate) — a standalone export/import utility
    that moves users, systems, profiles, scripts, public keys, audit logs, and the
    Bastillion application SSH key/identity from a v4 H2 database into a fresh v5
    instance, re-encrypting secrets under the new instance's keystore. See
  • tools/migrate/README.mdfor the full procedure.

Security

  • New SecurityHeadersFilteradds hardened response headers app-wide.
  • New CSRFFilter(part of the bundled MVC framework) protects state-changing
    requests.
  • Session cookies now set securein addition to the existinghttp-only.
  • EncryptionUtiland- KeyStoreUtilwere reworked;- AuthDB/password verification
    now supports the newer PBKDF2 hash format alongside the legacy single-round
    SHA-256 formats (including v4's own concatenation scheme), so users can migrate
    and log in with existing passwords unchanged.

Internal / build

  • The previously external io.bastillion:lmvcframework dependency is now merged
    directly into the codebase asloophole.mvc, so the whole app builds from one
    pom.xml.
  • Added unit test coverage: AppConfigTest,EncryptionUtilTest,LicenseUtilTest,
    and new tests for theloophole.mvcframework (dispatcher, base controller, CSRF
    and security filters).
  • CI (.github/workflows/github-build.yml) now runs the build/test on every push
    and pull request, in addition to the existing hourly schedule — previously it
    only ran on cron, so commits weren't verified until the next scheduled run.
  • README overhauled with an updated feature walkthrough, licensing section, and
    screenshots.

Upgrading from v4

Use tools/migrate to bring your data forward — see tools/migrate/README.md.

Password hashes migrate as-is; existing users can log in immediately without a

reset.

4.0.1

🚀 Bastillion Release Notes

What’s New

  • ✅ Upgraded to Java 21andJakarta EE 11— modern language features, improved performance, and long-term support.
  • 🔐 Added full support for Ed25519andEd448SSH key generation, withEd25519now set as the default key type.
  • 📦 Updated all libraries and dependencies to their latest stable releases for enhanced security, stability, and compatibility.

Migration Guide (from v3.10.00)

To migrate from a previous installation:

  • Ensure Java 21 is installed
    Bastillion now requiresJava 21. Confirm it's installed and available in your environment:java --version On Ubuntu, you can install it via: sudo apt update sudo apt install -y openjdk‑21‑jdk
  • Backup your existing database
    The H2 data store is usually named:bastillion.h2.db(Older versions may use keybox.h2.db.)
  • Copy the following files and directoriesfrom your old installation:- jetty/bastillion/WEB-INF/classes/keydb/→ copy the entire folder and its contents
  • jetty/bastillion/WEB-INF/classes/bastillion.jceks

  • jetty/bastillion/WEB-INF/classes/BastillionConfig.properties

  • Review and migrate configuration filesas needed:- jaas.conf

  • log4j2.xml
  • keystore
  • jetty-ssl.xml

  • jetty-http.xml

  • Restart Bastillion
    Confirm that the application is connected to its previous database and that all services start cleanly under Jetty.

Additional Notes

  • Ed25519 keys (256-bit) are now the default for improved speed and security.
  • Ed448 keys (448-bit) are supported for environments requiring extended cryptographic strength.
  • Migration preserves existing authorized keys and stored credentials if configuration paths are copied correctly.

3.15.00

Update 3rd party dependencies to latest including Jetty.

To migrate from >= 3.10.00

  • Backup previous bastillion.h2.db data store (possibly named keybox.h2.db)
  • Copy old jetty/bastillion/WEB-INF/classes/keydb folder (and it's contents) to the jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Copy old jetty/bastillion/WEB-INF/classes/bastillion.jceks to the /jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Copy old jetty/bastillion/WEB-INF/classes/BastillionConfig.properties to the /jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Run the bastillion-upgrade-4.00.01.jar on the database copied to the new installation

java -jar bastillion-upgrade-4.00.01.jar /jetty/bastillion/WEB-INF/classes/BastillionConfig.properties
- Adjust settings or copy as needed for the jaas.conf, log4j2.xml, keystore, jetty-ssl.xml and jetty-http.xml

3.14.0

New look and feel - Upgraded to Bootstrap v5, the latest Jetty, and updated all 3rd party libraries to the latest.

To migrate from >= 3.10.00

  • Backup previous bastillion.h2.db data store (possibly named keybox.h2.db)
  • Copy old jetty/bastillion/WEB-INF/classes/keydb folder (and it's contents) to the jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Copy old jetty/bastillion/WEB-INF/classes/bastillion.jceks to the /jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Copy old jetty/bastillion/WEB-INF/classes/BastillionConfig.properties to the /jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Run the bastillion-upgrade-4.00.01.jar on the database copied to the new installation

java -jar bastillion-upgrade-4.00.01.jar /jetty/bastillion/WEB-INF/classes/BastillionConfig.properties
- Adjust settings or copy as needed for the jaas.conf, log4j2.xml, keystore, jetty-ssl.xml and jetty-http.xml

3.13.00

Update h2 to the latest version fix issue upgrading due to incompatibilities with H2 v2 - #417

To migrate from >= 3.10.00

  • Backup previous bastillion.h2.db data store (possibly named keybox.h2.db)
  • Copy old jetty/bastillion/WEB-INF/classes/keydb folder (and it's contents) to the jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Copy old jetty/bastillion/WEB-INF/classes/bastillion.jceks to the /jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Copy old jetty/bastillion/WEB-INF/classes/BastillionConfig.properties to the /jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Run the bastillion-upgrade-4.00.01.jar on the database copied to the new installation

java -jar bastillion-upgrade-4.00.01.jar /jetty/bastillion/WEB-INF/classes/BastillionConfig.properties
- Adjust settings or copy as needed for the jaas.conf, log4j2.xml, keystore, jetty-ssl.xml and jetty-http.xml

3.12.02

Update jetty, jsch, and h2 to the latest version

To migrate from 3.10.00

  • Backup previous bastillion.h2.db data store (possibly named keybox.h2.db)
  • Copy old jetty/bastillion/WEB-INF/classes/keydb folder (and it's contents) to the jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Copy old jetty/bastillion/WEB-INF/classes/bastillion.jceks to the /jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Copy old jetty/bastillion/WEB-INF/classes/BastillionConfig.properties to the /jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Run the bastillion-upgrade-4.00.00.jar on the database copied to the new installation

java -jar bastillion-upgrade-4.00.00.jar /jetty/bastillion/WEB-INF/classes/BastillionConfig.properties
- Adjust settings or copy as needed for the jaas.conf, log4j2.xml, keystore, jetty-ssl.xml and jetty-http.xml

3.12.01

Remediation for CVE-2021-45105

To migrate from 3.10.00

  • Backup previous bastillion.h2.db data store (possibly named keybox.h2.db)
  • Copy old jetty/bastillion/WEB-INF/classes/keydb folder (and it's contents) to the jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Copy old jetty/bastillion/WEB-INF/classes/bastillion.jceks to the /jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Copy old jetty/bastillion/WEB-INF/classes/BastillionConfig.properties to the /jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Run the bastillion-upgrade-4.00.00.jar on the database copied to the new installation

java -jar bastillion-upgrade-4.00.00.jar /jetty/bastillion/WEB-INF/classes/BastillionConfig.properties
- Adjust settings or copy as needed for the jaas.conf, log4j2.xml, keystore, jetty-ssl.xml and jetty-http.xml

3.12.00

Remediation for CVE-2021-23463

To migrate from 3.10.00

  • Backup previous bastillion.h2.db data store (possibly named keybox.h2.db)
  • Copy old jetty/bastillion/WEB-INF/classes/keydb folder (and it's contents) to the jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Copy old jetty/bastillion/WEB-INF/classes/bastillion.jceks to the /jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Copy old jetty/bastillion/WEB-INF/classes/BastillionConfig.properties to the /jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Run the bastillion-upgrade-4.00.00.jar on the database copied to the new installation

java -jar bastillion-upgrade-4.00.00.jar /opt/Bastillion-jetty/jetty/bastillion/WEB-INF/classes/BastillionConfig.properties
- Adjust settings or copy as needed for the jaas.conf, log4j2.xml, keystore, jetty-ssl.xml and jetty-http.xml

3.11.01

Update Log4j to 2.16 to address CVE-2021-44228 and CVE-2021-45046

To migrate from 3.10.00

  • Backup previous bastillion.h2.db data store (possibly named keybox.h2.db)
  • Copy old jetty/bastillion/WEB-INF/classes/keydb folder (and it's contents) to the jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Copy old jetty/bastillion/WEB-INF/classes/bastillion.jceks to the /jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Copy old jetty/bastillion/WEB-INF/classes/BastillionConfig.properties to the /jetty/bastillion/WEB-INF/classes directory of the new installation.
  • Adjust settings or copy as needed for the jaas.conf, log4j2.xml, keystore, jetty-ssl.xml and jetty-http.xml