v2.1.0

🎉 Welcome to Defguard 2.1 🎉

2.1 makes the device itself part of the access decision - admins define the security criteria a machine must meet, and non-compliant endpoints simply can't establish a connection - and it ships a rebuilt Desktop Client whose tray mode gets your users onto the VPN in two clicks.

🛡️ Device Posture verification - client and OS version, security updates, AD membership, antivirus, disk encryption,
🖥️ a redesigned Desktop Client with tray mode,
⌨️ defguard-client - drive the client from a terminal, MFA included,
🔒 Allowed IPs generated from Firewall Rules - least-privilege configs, no network recon,
🐧 service locations on Linux - Always-on VPN from system boot,
🧩 official support for running Defguard Gateway on VyOS as a container.

More details with videos in this blogpost.

🔐 As always, this release was pentested by ISEC, together with Striga.AI - all major findings were fixed before release. The full report will be published on our pentesting page.

📖 Documentation for the new features:

• Device Posture verification
• CLI client
• Generate Allowed IPs from Firewall Rules
• Service locations
• Running Gateway on VyOS

🚅 If you would like to test Defguard, we offer a quick and easy One-line install script.

⚠️ Device Posture verification and service locations are Enterprise features.
Business features require free registration.
👉 https://defguard.net/get-free-business/
Once registered, simply apply your license to your instance.

We want to get as much feedback as possible, so we encourage you to:
💬 open a GitHub discussion
🪲 report any missing features or bugs as issues

What's Changed

• policy components update by @filipslezaklab in #2889
• implement Device Posture data model & management API by @wojcik91 in #2899
• Cleanup posture code by @moubctez in #2901
• Code clippification by @t-aleksander in #2905
• Report pre-release info by @t-aleksander in #2888
• Posture check list by @t-aleksander in #2907
• Posture check wizard by @t-aleksander in #2918
• Evaluate posture checks during client connection by @j-chmielewski in #2906
• add version badge to navbar by @wojcik91 in #2935
• Merge stable/2.x -> dev by @t-aleksander in #2920
• Posture check assigining from the locations view by @t-aleksander in #2927
• Assign locations, delete posture check actions by @t-aleksander in #2945
• Edit posture checks menu by @t-aleksander in #2946
• Implement posture checks by @j-chmielewski in #2936
• generate AllowedIPs from ACL Rules by @wojcik91 in #2942
• Fix minor visual posture checks issues / report last system update by @t-aleksander in #2952
• Build debs for debian 12/ubuntu 22.04 by @jakub-tldr in #2961
• GatewayEvent refactor by @wojcik91 in #2965
• Hide disk encryption posture check for macOS by @moubctez in #2976
• add activity log filtering by @wojcik91 in #2962
• add group filter for list_users endpoint by @wojcik91 in #2987
• decouple business logic modules in defguard_core from WebError by @wojcik91 in #2984
• add option to generate Allowed IPs from ACL rules by @wojcik91 in #2992
• Device posture check activity log by @moubctez in #2999
• Bulk user actions by @t-aleksander in #2995
• decouple AppState from non-API modules by @wojcik91 in #3003
• Trim client version list and remove Android integrity check option by @j-chmielewski in #3004
• Add no groups filter to users overview table by @filipslezaklab in #3001
• Fix EU Jumpcloud OIDC provider by @jakub-tldr in #2990
• fix failing e2e test by @wojcik91 in #3007
• update ui module by @filipslezaklab in #3013
• Fix e2e tests by @t-aleksander in #3015
• Add posture check sidebar (drawer) by @t-aleksander in #2977
• remove event router service by @wojcik91 in #3019
• Support synchronizing disabled AD users status by @t-aleksander in #3018
• adjust no_group user filter semantics by @wojcik91 in #3023
• Fix selecting predefined destinations by @t-aleksander in #3022
• Synchronize enrollment pending users from LDAP by @t-aleksander in #3024
• Duplicate posture check by @j-chmielewski in #3006
• Configure steps mfa UI components by @filipslezaklab in #3027
• user table fixes by @filipslezaklab in #3029
• Change ldap authority wording, fix LDAP integration crashes on references, support nested groups for limiting synchronization by @t-aleksander in #3028
• Stable to dev by @t-aleksander in #3031
• Location wizard posture by @j-chmielewski in #3026
• XOAUTH2 for SMTP by @moubctez in #3025
• Tweak edit posture check form spacings by @j-chmielewski in #3036
• Prevent wizard from querying postures endpoint if no license is present by @j-chmielewski in #3056
• Migrate LDAP library by @t-aleksander in #3035
• Posture tooltip dark by @j-chmielewski in #3071
• Allow prerelease below min_client_version by @j-chmielewski in #3084
• add comment by @j-chmielewski in #3085
• Update UI dev by @filipslezaklab in #3092
• Improve error handling during OIDC enrollment flow by @j-chmielewski in #3098
• Add "Any version" options to all posture version inputs by @j-chmielewski in #3100
• Filter out posture enabled locations for clients that don't support them by @t-aleksander in #3086
• Activity log posture module by @j-chmielewski in #3106
• control Edge UI by Core settings by @wojcik91 in #3108
• Feature flags by @t-aleksander in #3111
• Posture assigned to by @j-chmielewski in #3125
• Add LDAP sync activity log events by @j-chmielewski in #3112
• Android security patch level posture check by @filipslezaklab in #3126
• return pre-release versions in app_info endpoint by @wojcik91 in #3137
• disable manual WireGuard config option for users without access to non-MFA locations by @wojcik91 in #3140
• merge stable/2.x -> dev by @wojcik91 in #3141
• add missing awaits in e2e test for generating TOTP codes by @wojcik91 in #3143
• allow disabling password management for users synced from external IdP by @wojcik91 in #3139
• fix e2e selectors by @wojcik91 in #3145
• fix MFA session validation in forward_auth by @wojcik91 in #3150
• invalidate cached app version by @wojcik91 in #3159
• add password reset disabled email by @wojcik91 in #3160
• Always on linux by @j-chmielewski in #3156
• LDAP dry run by @t-aleksander in #3161
• Allow ignoring validation of SMTP certs by @t-aleksander in #3177
• Add VyOS/OPNSense deployment method by @jakub-tldr in #3186
• implement better errors for cert upload by @filipslezaklab in #3187
• pin pnpm by @wojcik91 in #3188
• dev -> 2.1 update by @t-aleksander in #3183
• Fix cargo deny by @t-aleksander in #3353
• Allow disk encryption posture check on macOS by @moubctez in #3354
• Block service locations when postures are assigned by @j-chmielewski in #3327
• Don't check if reported version is present in versions array by @j-chmielewski in #3356
• UI fixes batch by @filipslezaklab in #3357
• Open a support ticket button by @moubctez in #3369
• Fix time synchronization crash during stats purge by @t-aleksander in #3372
• batch release fixes 2 by @filipslezaklab in #3385
• Exclude disabled users from license limits by @t-aleksander in #3383
• Fix logging in via oidc for the first time when exceeding limits by @t-aleksander in #3368
• Don't swallow SMTP error while running the SMTP test by @t-aleksander in #3393
• Fix expires in for tokens by @moubctez in #3396
• port e2e issue workflow by @wojcik91 in #3407
• Fix license limits frontend cache invalidation by @t-aleksander in #3410
• Fix limits invalidation, second attempt by @t-aleksander in #3418
• add missing SMTP setup in password reset test by @wojcik91 in #3420
• Fix saving LDAP settings after deleting the default admin by @t-aleksander in #3421
• add Edge UI settings E2E tests by @wojcik91 in #3422
• fix selected filter icon contrast by @j-chmielewski in #3425
• Posture assignment updates gateways by @j-chmielewski in #3424
• Block edit form for service locations if no/expired license by @j-chmielewski in #3432
• Show OpenID directory sync events in activity log by @jakub-tldr in #3430
• Mobile client version posture by @j-chmielewski in #3434
• Make error displayed when enabling a user over a limit clearer by @t-aleksander in #3442
• Cleanup in posture code by @moubctez in #3444
• generate shorter key IDs for OpenID tokens by @wojcik91 in #3448
• fix: avoid bidi request timeouts when calling blocking SMTP functions by @wojcik91 in #3450
• Reenrollment fixes by @j-chmielewski in #3451
• Add CLI manage commands by @jakub-tldr in #3452
• Updated Individual Contributor Assignment Agreement (#3453) by @kchudy in #3454
• enable external user password reset by @wojcik91 in #3457
• LDAP remote enrollment fix by @wojcik91 in #3460
• Update UI (fix table collapse) and small cleanups by @moubctez in #3461
• Dont clear phone number on enrollment by @t-aleksander in #3463
• Allow restricting synchronization scope for all directory sync providers by @t-aleksander in #3455
• License reactivation modal by @jakub-tldr in #3467
• Don't allow users to go back after completing Edge adoption by @t-aleksander in #3470
• Dont display manual device setup if only posture locations available by @t-aleksander in #3468
• Properly display Entra login error by @t-aleksander in #3464
• Prevent adding wireguard device for disabled users by @t-aleksander in #3471
• Group client traffic policy by @j-chmielewski in #3469
• Activity log connection events by @j-chmielewski in #3472
• CLI commands tweaks by @jakub-tldr in #3476
• Filter activity log by event date by @jakub-tldr in #3473
• Fix google field description, sort dry run table by deleted first by @t-aleksander in #3479
• Change label & Check license when adding gateway from VPN Overview by @jakub-tldr in #3482
• add Client behavior setting to disable bare WireGuard tunnels by @wojcik91 in #3481
• add table reference to help sidebar by @wojcik91 in #3486
• add SMTP backfill migration fix by @wojcik91 in #3494
• Properly handle email changes for directory sync providers by @t-aleksander in #3489
• Fix migration conflict by @t-aleksander in #3497
• add missing toggle in enrollment message settings by @wojcik91 in #3498
• Release UI fixes by @filipslezaklab in #3503
• Posture check authenticates the device with polling token by @j-chmielewski in #3500
• Update Swagger & automatically update openapi specification on gitbook by @jakub-tldr in #3504
• Fix logging in overwriting user groups when directory sync is enabled by @t-aleksander in #3519
• Service location posture checks by @j-chmielewski in #3508
• port workflow changes from stable branch by @wojcik91 in #3522
• add posture edit confirmation modals by @wojcik91 in #3517
• revoke active VPN sessions when a posture check is rejected by @j-chmielewski in #3523
• continue on postures step during network creation test by @j-chmielewski in #3524
• Prevent showing configuration for locations with posture checks by @jakub-tldr in #3528
• Fix location layout in rules by @jakub-tldr in #3562
• Exclude posture gated locations when creating network device by @jakub-tldr in #3559
• Fix phone number field by @jakub-tldr in #3566
• Invalidate session after password change by @jakub-tldr in #3567
• Fix LDAP synchronization interval form by @jakub-tldr in #3569
• misc pre-2.1 bugfixes by @wojcik91 in #3561
• table and skeleton should be mutually exclusive by @j-chmielewski in #3575
• Allow creation of disabled users in Active Directory by @moubctez in #3572
• fix google service file upload form by @j-chmielewski in #3578
• Fix right border for devices not managed by users by @moubctez in #3579
• OIDC email verified fix by @wojcik91 in #3598
• Add QR codes to desktop configuration emails by @jakub-tldr in #3604
• Return correct IPv6 addresses in ACL rules by @jakub-tldr in #3605
• Fix sync issues during a failed HTTP request to provider by @t-aleksander in #3610
• DG2608-12: [core] Broken Access Control in enrollment RegisterMobileAuth allows cross-user biometric key planting by @jakub-tldr in #3612
• DG2608-13: [core] Password reset and enrollment tokens logged in plaintext by @jakub-tldr in #3614
• DG2608-9: Instance master signing key exposed in support configuration bundle by @moubctez in #3613
• Apply posture check on location save by @jakub-tldr in #3621
• DG2608-6: CSRF on component setup GET endpoints allows rogue gateway adoption by @t-aleksander in #3616
• DG2608-16, DG2608-17: Unauthorized setup endpoints by @t-aleksander in #3615
• DG2608-3: [core] OAuth2 refresh_token grant skips client authentication and returns tokens unrotated by @wojcik91 in #3625
• Migrate sbom ignore by @t-aleksander in #3626
• DG2608-14: [core] Setup wizard issues administrator session cookie without the Secure attribute by @wojcik91 in #3627
• DG2608-19: [proxy] Enrollment and password reset session cookies are issued without the Secure attribute by @wojcik91 in #3628
• Fix TypeError: undefined is not an object by @moubctez in #3629
• Bump minimal version of components by @t-aleksander in #3631
• Refresh peer IP after modifying user device by @t-aleksander in #3632
• Use absolute path for useradd by @moubctez in #3633
• Remove major docker tag from being automatically added by @t-aleksander in #3636
• Remove no-op LDAP events from being emitted to activity log by @t-aleksander in #3640

Full Changelog: v2.0.1...v2.1.0