Cardea

Network Security

SSH bastion server with access control, session recording, and optional TPM‑backed key protection

Track releases GitHub

Go Latest v1.8.0 · 4d ago Security brief →

Features

Access‑controlled SSH jump host via username encoding (e.g., user@backend@bastion)
Session recording in Asciinema v3 format (optional)
TPM‑backed key protection to safeguard the bastion's private key

Recent releases

View all 18 releases →

Review required

v1.8.0 New feature 4d

Auth RBAC

Key deauthorization revalidation

Open

v1.7.0 Maintenance 24d

Minor fixes and improvements.

Full changelog

What's Changed

Bump golang from 1.26.2-trixie to 1.26.3-trixie in the docker-all group by @dependabot[bot] in https://github.com/hectorm/cardea/pull/62
Bump the gomod-minor-patch group with 2 updates by @dependabot[bot] in https://github.com/hectorm/cardea/pull/63
Bump grafana/grafana from 13.1.0-25196703233 to 13.1.0-25530058790 in the docker-compose-all group by @dependabot[bot] in https://github.com/hectorm/cardea/pull/64
Bump github/codeql-action from 4.35.3 to 4.35.4 in the github-actions-all group by @dependabot[bot] in https://github.com/hectorm/cardea/pull/65

Full Changelog: https://github.com/hectorm/cardea/compare/v1.6.2...v1.7.0

View release on GitHub

v1.6.1 Maintenance 1mo

Minor fixes and improvements.

Full changelog

What's Changed

Bump golang from da39430 to c0074c7 in the docker-all group across 1 directory by @dependabot[bot] in https://github.com/hectorm/cardea/pull/52
Bump the docker-compose-all group with 2 updates by @dependabot[bot] in https://github.com/hectorm/cardea/pull/53
Bump the github-actions-all group with 3 updates by @dependabot[bot] in https://github.com/hectorm/cardea/pull/54
Bump grafana/grafana from 13.1.0-24485707904 to 13.1.0-24866141508 in the docker-compose-all group by @dependabot[bot] in https://github.com/hectorm/cardea/pull/55
Bump golang from c0074c7 to 982ae92 in the docker-all group by @dependabot[bot] in https://github.com/hectorm/cardea/pull/56
Bump prom/prometheus from v3.11.2 to v3.11.3 in the docker-compose-all group by @dependabot[bot] in https://github.com/hectorm/cardea/pull/58
Bump golang from 982ae92 to 4a7137e in the docker-all group by @dependabot[bot] in https://github.com/hectorm/cardea/pull/57

Full Changelog: https://github.com/hectorm/cardea/compare/v1.6.0...v1.6.1

View release on GitHub

v1.6.0 New feature 1mo

Notable features

Reject unknown options in authorized_keys entries.
Preserve key comments for piped authorized_keys entries.
Extract authorized_keys parser into public package pkg/authkeys.

Full changelog

What's Changed

Reject unknown options in authorized_keys entries.
Preserve key comments for piped authorized_keys entries.
Pause session recording for non-PTY sessions (e.g. rsync, git), which can generate unprintable data.
Extract authorized_keys parser into public package pkg/authkeys.
Extract timewindow parser into public package pkg/timewindow.

Dependencies

Bump the docker-compose-all group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/hectorm/cardea/pull/46
Bump the github-actions-all group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/hectorm/cardea/pull/47
Bump the gomod-minor-patch group with 2 updates by @dependabot[bot] in https://github.com/hectorm/cardea/pull/49
Bump golang from ce3f1c8 to e3474b9 in the docker-all group by @dependabot[bot] in https://github.com/hectorm/cardea/pull/48
Bump the docker-compose-all group with 2 updates by @dependabot[bot] in https://github.com/hectorm/cardea/pull/50
Bump golang from 1.26.1-trixie to 1.26.2-trixie in the docker-all group by @dependabot[bot] in https://github.com/hectorm/cardea/pull/51

Full Changelog: https://github.com/hectorm/cardea/compare/v1.5.2...v1.6.0

View release on GitHub

v1.5.0 New feature 2mo

Notable features

Recordings stored in date-based subdirectories (YYYY/MM/DD/)
Structured recording metadata field added to asciicast files

Full changelog

What's Changed

Features

Store recordings in date-based subdirectories (YYYY/MM/DD/)
Add structured recording metadata field to asciicast files

Dependencies

Bump golang.org/x/sys from 0.41.0 to 0.42.0 in the gomod-minor-patch group by @dependabot[bot] in https://github.com/hectorm/cardea/pull/35
Bump golang from ab8c494 to 96b2878 in the docker-all group by @dependabot[bot] in https://github.com/hectorm/cardea/pull/36
Bump the gomod-minor-patch group with 2 updates by @dependabot[bot] in https://github.com/hectorm/cardea/pull/37
Bump grafana/grafana from 13.0.0-22696220628 to 13.0.0-23336907879 in the docker-compose-all group by @dependabot[bot] in https://github.com/hectorm/cardea/pull/38
Bump the github-actions-all group with 2 updates by @dependabot[bot] in https://github.com/hectorm/cardea/pull/39
Bump golang from 96b2878 to ce3f1c8 in the docker-all group by @dependabot[bot] in https://github.com/hectorm/cardea/pull/40

Full Changelog: https://github.com/hectorm/cardea/compare/v1.4.1...v1.5.0

View release on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.