v1.5.1

What's Changed

• Introduce secret masking and restoring, to only POST back changed settings and not every-time all settings @swissmakers
• Add separate route to directly search on the ban-bucket form each fail2ban-server @swissmakers
• Use crypto sha256 to create real sha265 session secrets @swissmakers
• Add retention for the saved objects in the SQLite database. It is in days and new default is 180 days @swissmakers
• Initial changes to support admin and support groups for OIDC authenticated users. Support can only ban and unban IPs. Admin can do all UI functions @mchrisb03
• Add "None" as an SMTP Authentication Method @mchrisb03
• Added an option for SSH connections to establish a reverse tunnel for callback events @mchrisb03
• Provide ability to specify multiple comma separated email addresses in the Destination Emails @mchrisb03
• Fix deadlock on debug value reading @swissmakers
• Add saveguards for filter and jail naming @swissmakers
• Implement our ValidateIP function to validate all IP inputs against it @swissmakers
• Do not query again if the summary of the same server was already loaded (MatchesCurrentServer), important when changing servers also tune the refresh a bit @swissmakers
• Fix conflicts of the pull-request of mchrisb03 that introduces ssh-reverse connections, OIDC group support and support for multiple alert-mail addresses @swissmakers
• Make the action-ban more robust, add tests also add missing config bantime factor and maxtime @swissmakers
• Sync all connectors on server, fail2ban-ui restarts so all configs are always correct in case something has changed @swissmakers
• Also check is callback secret was changed, then the action file also needs to repushed @swissmakers
• Update the docs about the bantime factor changes and unsecure -k option, that is gone @swissmakers
• Add missing BantimeMaxtime, BantimeFactor, and BantimeOveralljails in the update/save logic @swissmakers
• Replace the httpClient from opnsence and pfsence to a common function. Also add a readlimit for response-body @swissmakers
• Change chmod for the action-file from 644 to 600 as a security measurement @swissmakers
• Errors on the log-boroadcasting itself must directly output the error and not again try to route through itself @swissmakers
• Translate all currently left / hardcoded toast messages or Modal texts to all supported languages, add new settings to the settings page @swissmakers
• We want to remember what server was choosen last, before a browser reload or something like that -> auto rechoosing @swissmakers
• Upgrade crypto to v0.52.0 @swissmakers
• Also upgrade the 'net' module to v0.55 to mitigate go-net HTML parser vulnerability @swissmakers
• Replace architecture.drawio.png with svg variant, that is also readable in darkmode by @swissmakers in #174

Important: older releases always passed -k for https:// callback URLs. TLS verification is now on by default, because the callback carries the shared secret and everything other would not be best-practises. If your UI runs with a self-signed certificate, either install the ca-certificate (of your self-signed cert) and trust this on every managed host or set CALLBACK_INSECURE_TLS=true, otherwise ban callbacks will fail silently after upgrading. The regenerated action file is pushed to managed hosts automatically at startup.

New Contributors

• @mchrisb03 made their first contribution in #171

Full Changelog: v1.4.9...v1.5.1