Signotaur - v2.1.0.296 Released

[Sparky (Dave Sparks)]

Hi All,

A new version of Signotaur has been released and is available from Signotaur Downloads. The latest stable version of Signotaur is 2.1.0.296.

Changes in v2.1.0.296

Before Upgrading

This release follows an internal security review and adds hardening across the web interface, API and client tool. We recommend upgrading all installations.

Signotaur is designed as an internal LAN service rather than a public web service. The server holds the private keys it signs with, so while this release hardens it further against hostile traffic, it should still be deployed on a private network and accessed externally through a secure VPN rather than made directly accessible from the internet.

• Mail server TLS certificates are now validated. If your mail server uses a self-signed certificate or an internal certificate authority that Signotaur does not trust, outgoing mail will stop. Trust the authority on the server or select Accept any certificate under Settings, Email, then use Send test message to verify the configuration.

• Google and GitHub registrations now require approval. A new user signing in through either provider creates a request on the Users page and administrators are notified by email. Existing users retain access. Under Settings, Authentication, you can restrict requests to verified email domains or refuse them entirely. Individual administrators can disable these notifications under Profile, Email without affecting others.

• The server data directory now has restricted permissions. The installer grants access to the service account, which no longer needs administrator rights, only “log on as a service”. The log directory remains readable. If you change the service account outside the installer, re-run the installer or run VSoft.Signotaur.Server.exe configure as an administrator.

• The configured sign-in durations now take effect. Remember me expiry and Two-factor remember-me expiry previously used a fixed 14 days. Their defaults are 14 and 30 days respectively, so an installation that never changed them will find two-factor remember-me lengthens from 14 days to 30. Check both settings before upgrading if you intended to use shorter periods.

• Reverse proxies must be trusted explicitly to preserve client addresses. Add the proxy to TrustedProxies and restart the server. Until then, the audit log records the proxy’s address for every request. See Recording the Original Client Address.

• Unauthorised certificate requests now return a not-found result. SignotaurTool therefore returns a different exit code. Check pipelines that depend on the previous access-denied code against the exit code reference.

• SFTP publishing of revocation list and CA certificates now warns when the destination’s SSH host key is not checked. Publishing continues, but the SFTP password could be exposed if the connection is intercepted. Pin the host-key fingerprint or authenticate with a private key to remove the warning.

• Password reset is no longer available for accounts that sign in only through Google or GitHub. These accounts have no Signotaur password, and resetting one would allow sign-in without the provider or any second factor it enforces. The Reset Password action and Forgot password link now decline the request. To add a password, the account holder can set one under Profile, Change Password.

Security

• Accounts are temporarily locked after repeated failed sign-in attempts. Administrators can clear a lockout by re-enabling the account. Active sessions are also rechecked periodically, so disabled accounts and role changes take effect without waiting for the session to end.

• Fixed an authorisation flaw that allowed a signed-in user to act on API keys belonging to other users.

• Two-factor authentication is better protected. Viewing an existing authenticator key now requires the Signotaur password or a current authenticator code. Any change, including displaying the key, emails the account holder providing a mail server is configured.

• Browser-facing security has been strengthened with HTTP Strict Transport Security, secure cookies, anti-forgery protection, a content security policy and other protective headers. Signotaur can no longer be displayed inside a frame, and rejected anti-forgery submissions are recorded on the Events page. HSTS is not applied to subdomains or the Validation Authority’s plain-HTTP port, and new Site.HstsMaxAgeDays setting in the configuration file controls how long browsers remember it.

• Sign-in, password-reset and email-confirmation requests no longer reveal whether an account exists. Two unused endpoints that could confirm a username have been removed.

• archive restore now blocks backups that write outside their intended directory or specify an implausible key-derivation cost. It also warns when a restored configuration places a certificate authority’s private key outside the data directory. Restore only backups you produced yourself.

• Client downloads and update checks now require a signed-in session, and the update badge is hidden when signed out. An update-feed redirect is followed only when it carries a valid VSoft signature.

• Event entries, error messages and API responses no longer expose full server paths. Security events now record the client address.

• Secrets in the server configuration are now stored using a stronger encryption method that gives each value a distinct result and detects tampering. Existing secrets continue to work.

Improvements

• Administrators can now resend the verification email from the Users page for any unverified address. Changing a user’s email address also sends one automatically, since the new address starts unverified.

• Save confirmation dialogs now show potentially harmful consequences as warnings. These include shortening retention, disabling an issuer or automatic renewal, relaxing certificate checks, disabling rate limiting and changing the backup passphrase.

• When the server has no internet access, update checks now fall back to the browser. Failed checks are cached briefly to avoid repeated requests and warnings.

• User avatars are now fetched by the server, so browsers no longer contact Gravatar directly. Set UI.EnableGravatar to false to disable these lookups and display initials for every account.

• Email failures now give administrators the reason and configuration location, while other users are directed to an administrator. The full reason is always recorded in the log.

• Certificate authority expiry warnings are now sent only while the server holds an Enterprise licence, since the certificate authority cannot be renewed or regenerated without one. The preference is hidden and the settings are kept; installing a licence resumes the warnings.

• Enabling, disabling or deleting an API key now reports the outcome, and its row remains accurate if the change fails.

• Some minor UI updates.

Bug Fixes

• Fixed changing a user’s administrator status removing every other role they held, including the API key rotator role granted in the same save.
• Fixed a two-factor recovery code remaining usable after it had been redeemed.
• Fixed an issue where an account could become unreachable after an administrator changed the email address. An administrator can also no longer change an address to one that another account already uses.
• Fixed Microsoft AD CS certificate enrolment holding a server thread while it waited for the CA, which could slow the server under load.
• Fixed the temporary password warning on the Change Password page remaining after the password was changed. The time remaining now also counts down while the page is open instead of only updating after a reload.

Infrastructure

• The server now requires .NET Runtime 10.0.11, which the installer installs if missing.
• Various third-party package updates.

Full change history

Introducing Signotaur