v1.1.3 — Package post-install fix

v1.1.3

Bug fix: service not starting after install / not restarting after upgrade

The post-install script had a guard on systemctl is-system-running that silently bailed out on systems where systemd reports a degraded state — which is the norm on Proxmox VE. This meant:

• Fresh installs: the webux service was never started automatically
• Upgrades: the running service was never restarted to pick up the new binary (so you'd see the old version's behavior even after upgrading)

The fix removes that check entirely and uses start vs restart based on whether this is a fresh install or an upgrade ($1 argument differences between DEB/RPM/Arch packages).

If you installed v1.1.2 on Proxmox, run systemctl restart webux once to pick up the correct binary — or just upgrade to v1.1.3.

---

Binaries built with Go, no dependencies. PAM auth requires libpam on the host.

v1.1.0 — Virtual Machines & SSL Certificates

What's New in v1.1.0

🖥 Virtual Machines

A new Virtual Machines section has been added under the System sidebar. Webux auto-detects your hypervisor at startup — no configuration needed.

• Proxmox VE (detected via qm) — list all VMs on the local node with ID, name, state, memory, vCPUs, and disk. Start, stop, graceful shutdown, reboot, suspend, resume, or force-stop any VM directly from the UI.
• KVM / QEMU via libvirt (detected via virsh) — same full management capabilities.
• Shows a friendly setup card with install instructions if no hypervisor is detected.

Dashboard integration: when a hypervisor is present, the dashboard shows a compact VM summary panel (running/stopped counts, VM list) right below the capabilities bar. On Proxmox, a second panel shows all VMs across the entire cluster grouped by node, powered by a single fast pvesh query.

The Detected Capabilities bar also picks up a Virtual Machines dot when a hypervisor is found.

---

🔐 SSL Certificates

A new SSL Certificates section has been added under the Applications sidebar.

• Certificate browser — scans system cert paths across Debian, RHEL, and Arch (including Let's Encrypt, nginx, and Apache config-referenced certs). Certs are sorted by days until expiry so expiring ones surface first. A live search box filters by CN, issuer, path, source, or SANs.
• Per-cert details — subject, issuer, SANs (DNS + IP), validity window with color-coded expiry countdown (red < 14 days, orange < 30, yellow < 90, green), key type and size.
• Copy / Download PEM — grab the certificate PEM directly from the UI.
• Generate CSR + Key — fill in CN, org, country, SANs, pick RSA (2048/4096-bit) or ECDSA (P-256/P-384/P-521); get a private key and CSR PEM back instantly with copy/download buttons. Pure Go — no openssl required.
• Generate Self-Signed Certificate — same fields plus a validity period. Optionally installs the cert directly into the distro's trusted CA store (update-ca-certificates on Debian/Ubuntu, update-ca-trust on RHEL/Fedora/Arch) with a single checkbox.

---

🐛 Fixes

• Cron "Add Job" schedule dropdown showed blank entries () — a missing json struct tag caused the preset label/value fields to serialize with uppercase keys, which the frontend couldn't read. Fixed.
• Cron moved from the Applications section to the System section in the sidebar.
• VM hypervisor detection previously ran qm version at page load, which took 30–60 seconds on Proxmox VE. Detection now uses only a PATH lookup — instant.

---

Install / Upgrade

Platform	Package
Debian / Ubuntu (amd64)	webux_1.1.0_amd64.deb
Debian / Ubuntu (arm64)	webux_1.1.0_arm64.deb
Debian / Ubuntu (armhf)	webux_1.1.0_armhf.deb
RHEL / Fedora (x86_64)	webux-1.1.0-1.x86_64.rpm
RHEL / Fedora (aarch64)	webux-1.1.0-1.aarch64.rpm
RHEL / Fedora (armv7hl)	webux-1.1.0-1.armv7hl.rpm
Arch Linux (x86_64)	webux-1.1.0-1-x86_64.pkg.tar.zst
Arch Linux (aarch64)	webux-1.1.0-1-aarch64.pkg.tar.zst
Arch Linux (armv7h)	webux-1.1.0-1-armv7h.pkg.tar.zst
Universal tar.gz	webux-1.1.0-linux-{amd64,arm64,armv7}.tar.gz

SHA256 checksums: checksums-1.1.0.sha256

v1.0.2 — Performance score fix, log search, background package ops

v1.0.2

Summary

This is largely a small patch-set to fix a couple minor annoyances and one/two QOL improvements. This will set the stage for the next feature-set; more (and bigger) things coming soon :)

🐛 Bug Fix — Performance Tuning Score

The Performance Tuning score was truncating instead of rounding (e.g. 53.8% showed as 53 instead of 54). Fixed to use proper rounding.

🔍 Logs — File Search

Added a search input above the /var/log file tree so you can quickly filter log file names as you type — same style as the existing unit filter below it.

📦 Packages — Background Operations & Auto-Scroll

Two quality-of-life improvements to the Packages page:

Background operations — Package installs, upgrades, removals, and cache refreshes now run in the background. You can navigate away to any other page while an upgrade is in progress, and come back to the Packages page to see the full output and whether it finished. The running indicator stays visible if it's still going. When an operation completes while you're away, the package lists refresh automatically when you return.

Auto-scroll — The output panel now always scrolls to the latest line as output streams in, so you never have to manually scroll down to see what's happening.

---

Upgrade

# Debian/Ubuntu
sudo dpkg -i webux_1.0.2_amd64.deb && sudo systemctl restart webux

# RHEL/Fedora
sudo rpm -Uvh webux-1.0.2-1.x86_64.rpm && sudo systemctl restart webux

# Arch
sudo pacman -U webux-1.0.2-1-x86_64.pkg.tar.zst && sudo systemctl restart webux

v1.0.1 — Fix remediation sudo commands

v1.0.1 — Hotfix

Bug Fix

The ▶ Run in Terminal fix commands on the Security Hardening and Performance Tuning panels were running without sudo despite the commands including it. The issue was a stale database cache: results were cached before the sudo prefixes were added in v1.0.0, so the old commands kept being served.

This release bumps the internal cache keys to force a fresh check run on first load, ensuring all remediation commands correctly include sudo.

Upgrade

```bash

Debian/Ubuntu

sudo dpkg -i webux_1.0.1_amd64.deb && sudo systemctl restart webux

RHEL/Fedora

sudo rpm -Uvh webux-1.0.1-1.x86_64.rpm && sudo systemctl restart webux

Arch

sudo pacman -U webux-1.0.1-1-x86_64.pkg.tar.zst && sudo systemctl restart webux
```

v1.0.0 — Performance Tuning + One-Click Remediation

What's New in v1.0.0

⚡ Performance Tuning Dashboard Panel

A new full-width Performance Tuning panel sits below the Security Hardening panel on the dashboard. It grades 15 kernel and system parameters across five categories — Memory, Filesystem, Network, Kernel, and Systemd — and assigns a Bronze/Silver/Gold/Platinum rank just like the Security panel.

Checks included:

• Memory: vm.swappiness, vm.vfs_cache_pressure, vm.dirty_background_ratio
• Filesystem: fs.file-max (system-wide open file descriptor limit)
• Network: net.core.netdev_max_backlog, net.core.somaxconn, tcp_max_syn_backlog, rmem_max, wmem_max, tcp_fin_timeout, ip_local_port_range, tcp_congestion_control (BBR), tcp_slow_start_after_idle
• Kernel: kernel.pid_max
• Systemd: DefaultLimitNOFILE hard limit

🛠 One-Click Remediation — Security & Performance

Every failing check in both the Security Hardening and Performance Tuning panels now shows:

• A description of why the setting matters
• The exact fix command to apply
• A ▶ Run in Terminal button that navigates to the terminal and runs the command for you

Fix commands are distro-aware:

• Arch: uses pacman
• RHEL/Fedora: uses dnf
• Debian/Ubuntu: uses apt-get

All commands are prefixed with sudo for non-root users.

🐛 Bug Fixes

• Migration Template page: The "← Open Ports" link was using an absolute URL (/ports) which broke hash-based SPA routing. Fixed to #/ports.
• Settings — Auth description: The Shadow build description now correctly notes that SSSD/LDAP also authenticates via PAM/NSS, not just /etc/shadow.

---

Note: The packages attached to this release are v1.0.1 builds (identical feature set — a stale cache bug in the original v1.0.0 packages caused remediation commands to run without sudo). See v1.0.1 for details.

---

Installation

Debian/Ubuntu (.deb)
```bash
wget https://github.com/brendan4linux/webux/releases/download/v1.0.0/webux_1.0.1_amd64.deb
sudo dpkg -i webux_1.0.1_amd64.deb
sudo systemctl restart webux
```

RHEL/Fedora/CentOS (.rpm)
```bash
sudo rpm -Uvh webux-1.0.1-1.x86_64.rpm
sudo systemctl restart webux
```

Arch Linux (.pkg.tar.zst)
```bash
sudo pacman -U webux-1.0.1-1-x86_64.pkg.tar.zst
sudo systemctl restart webux
```

v0.9.9 — Logs

Logs

New Logs section — browse, read, and live-tail log files and systemd journals directly in the web UI.

Features

File browser

• Lazy-expanding tree of `/var/log` (subdirectories load on click)
• Click any file to read its last 500 lines instantly
• All paths restricted to `/var/log` via symlink-safe `safePath` validation

Live tail

• Click ▶ Follow on any open file to stream new lines in real-time via Server-Sent Events
• Uses `tail -n 50 -F` — handles log rotation automatically
• Pulsing ● live indicator while streaming
• Auto-scroll pauses when you scroll up; resumes when you reach the bottom

Systemd journal

• Lists all systemd service units with color-coded status dots (active=green, inactive=grey, failed=red)
• Filter box to search units by name or description
• Click any unit to stream its journal live via `journalctl -fu`
• Section hidden automatically on non-systemd systems

Log viewer

• Keyword-based line coloring: error/fatal/crit = red, warn = yellow, debug = muted
• Filter bar to search within loaded lines
• 2000-line ring buffer cap with indicator
• Line count footer

Bug fixes

• Fixed session persistence on existing installations — databases created before v0.9.8 had a `webux_sessions` schema mismatch (`user_id` vs `username`) that caused every session to fail silently, forcing re-login on every page refresh and leaving the dashboard stats and Security Hardening widget blank
• `make release` and `make release-full` now depend on the `web` target, ensuring cross-compiled binaries always embed the latest frontend

---

Special thanks to John for the feedback that shaped these improvements.

v0.9.8 — Security hardening pass

v0.9.8 — Security hardening pass

This release is a comprehensive security hardening pass based on an adversarial peer code review. No new features — focus is entirely on closing injection, session, and authorization gaps.

---

🔴 Critical / High fixes

ID	Issue	Fix
H1	Command injection in APT/RPM repo key import (sh -c curl | gpg)	Replaced with Go HTTP fetch + argv-only gpg --dearmor — no shell involved
H2	Firewall nftAdd fell back to sh -c on error, enabling injection via Port/Table/Chain fields	Deleted sh -c fallback entirely; added strict regex validators for all nft inputs
H3	SSO bypass token accepted via ?token= URL param (logged by reverse proxies, browser history)	Header-only (X-Webux-Token); comparison uses subtle.ConstantTimeCompare
H4	No rate limiting on /auth/login — online brute-force against PAM/shadow accounts	Per-IP rate limiter: 10 failures per 15-minute window → HTTP 429
H5a	Session cookie missing Secure flag	Secure: true + SameSite: Strict
H5b	JWT returned in login JSON body (invites localStorage storage, XSS-extractable)	Token removed from response body; cookie-only delivery
H5c	Logout was client-side only — leaked tokens stayed valid for 24h	Server-side session store (webux_sessions table); each JWT carries a jti; logout deletes the row; every request verifies the session still exists
H6	MySQL USE \database`andSHOW TABLES IN `database`` used raw string interpolation	Database name validated against ^[A-Za-z0-9_]+$ before any SQL construction
H7	Both WebSocket endpoints (/ws, /ws/terminal) accepted any Origin	Origin validated against Host header on both upgraders
H8	No warning when JWT secret was auto-generated (silently breaks multi-instance deployments)	Startup WARN log when ephemeral secret is used; directs operator to set auth.jwt_secret
H9	golang.org/x/net v0.21.0 — affected by CVE-2023-45288 (HTTP/2 CONTINUATION flood)	Bumped to v0.56.0; x/crypto bumped to v0.53.0
H10	AI OllamaURL/BaseURL were user-settable and used directly in server-side HTTP — SSRF pivot	Custom dial function blocks RFC-1918 and link-local ranges at connect time
C1 (partial)	No authorization layer — any authenticated user got root; no audit trail	Claims stored in request context; structured audit log on every authenticated request (user, method, path, ip); terminal now drops to the authenticated user's UID/GID/groups; auth.allowed_users config option restricts login to named accounts
C2 (partial)	File manager safePath had no root restriction and was vulnerable to symlink escape	EvalSymlinks + separator-aware prefix check; configurable files.root; sudo toggle for explicit root escalation

---

Other changes

• File browser: removed artificial /home root restriction — OS permissions enforced naturally. Added per-request sudo mode (sudo -n) for browsing/editing root-owned files without running webux as root.
• Terminal: shell now spawns as the Webux-authenticated user (SysProcAttr.Credential with UID/GID/supplementary groups resolved from the JWT subject).
• Settings UI: bypass token hint updated to show X-Webux-Token header usage instead of deprecated ?token= param.
• Router: fixed double /api/api/containers/run routing bug (L4).
• Migration 009: webux_sessions table for server-side revocation.

---

Config additions (config.yaml)

auth:
  allowed_users:        # optional: restrict login to these Unix accounts
    - bdubs
    - ops

files:
  root: /home           # optional: restrict file browser root (default: unrestricted)

---

Upgrade notes

• Breaking: the ?token=<bypass> query param no longer works — update any SSO redirects to send X-Webux-Token: <token> as a header instead.
• Sessions issued before this upgrade will be invalidated on first request (missing jti in old tokens → treated as revoked). Users will need to log in once after upgrading.
• The webux_sessions migration runs automatically on startup.

---

Thanks

Special thanks to John for the thorough adversarial security review that drove this entire release.

v0.9.7

Release v0.9.7 contains some minor login fixes, with the ability now to use SSSD instead of purely logins in /etc/shadow.

This release also adds a new health-check function to the dashboard to help 'score' your machine on how well it's doing.
You can add/modify these checks underneath the Settings page.

Webux v0.9.5

Initial commit