If your ZFW went blank after updating to ZimaOS v1.7.1-beta1, this is the release you want.
Every tab answered HTTP 401 and the dashboard stayed empty. Nothing about ZFW had changed — ZimaOS renamed the issuer of its session token.
ZFW verifies the ZimaOS session token itself (the gateway proxies module routes without authenticating them) and pins the token's iss claim, so that the refresh token — signed with the same key, valid for a week — cannot be replayed as a fully-privileged firewall session. That pin was the single string casaos. Measured with live logins:
| ZimaOS | access token | refresh token |
|---|---|---|
| v1.7.0-beta1 | casaos |
refresh |
| v1.7.1-beta1 | zimaos |
refresh |
So the daemon refused every genuine login with invalid session: token issuer "zimaos" not accepted (want "casaos").
Fixed
- The issuer is now a set —
{casaos, zimaos}— so ZFW works on v1.7.1+ and on v1.7.0 and older hosts alike. Nothing to configure. - The refresh token kept its own issuer through the rename and is still refused, as is any other issuer. The protection the pin exists for is intact.
Made findable next time
A refused session used to leave no trace at all: the reason went into the 401 body and nowhere else, so an outage that broke every single request left journalctl -u zfw-ui looking perfectly normal, and the cause was visible only in the browser console.
journalctl -u zfw-ui | grep 'session rejected'Rejections are now logged at WARN with the reason, the path and the client. They are triggerable from outside, so they are rate-limited to one line per 30 s, and whatever is suppressed in between is counted on the next line. The token is never logged.
New: tools/check-session-auth.py proves both directions against a running host after any ZimaOS update — a genuine token must be accepted, and the refresh token, a missing header and a tampered signature must each be refused.
Install
tar xzf zfw-1.0.23-<arch>.tar.gz && cd zfw-1.0.23-<arch> && sudo sh install.shRe-running the installer updates an existing install in place; your rules are untouched.
Or via Docker Hub — multi-arch (amd64 + arm64), same payload as the tarballs:
docker run --rm --privileged --pid=host -v /:/host chicohaager/zfw:1.0.23The container is a delivery vehicle, not a runtime: it installs the sysext onto the host and exits.
Verified
On a live ZimaOS v1.7.1-beta1 host (ZimaCube, amd64): all seven tab endpoints 200 with real data, the three negative cases 401, the rejection visible in the journal naming the issuer. 17 packages green, gofmt and go vet clean.
SHA-256
amd64 e06230b62178b22051a705041c478ff906c64cb222298292727b2f8ab6e006c3
arm64 d1ed541de1bedffde6544cfed0993fbef5c750d55e7028b0df8deffc989224be