3.0.2 — 2026-07-16
A fleet-management and reliability release on top of 3.0.1: a much sturdier host enrollment lifecycle (kill-switches and clean-up for runaway/stale hosts), new system-administration tooling (full firewall management, a time-daemon installer, an Environment & Shell section), a console that scales to large fleets, and another round of web-surface hardening. No breaking changes — upgrade in place with sysible_controller update.
Added
Full ufw firewall management — reads status and the rule list, turns the firewall on/off, and adds/deletes allow/deny rules (by port/proto/source), not just an installer.
"Environment & Shell" tools section — manage system-wide environment variables (/etc/environment, profile.d drop-ins) and shell aliases from the console.
Time Synchronization — explicit Install buttons for chrony and NTP (previously the only path was "Configure chrony", with no NTP install at all).
Update Hosts — "Defer to maintenance window" — schedule the install into a recurring maintenance window instead of running it immediately (creates a managed Schedule).
Pause Enrollment kill-switch — one-click emergency brake that stops the controller accepting new enrollments; plus Revoke Checked and robust bulk Disenroll / Force Delete for runaway fleets.
disenroll_agent.sh and migrate_agent.sh in the agent bundle — host-side cleanup and controller-failover re-pointing, no console round-trip.
Deployed build version shown in the console ("Current build: v… · commit (branch)").
Changed
SSH host connections are being phased out in favour of the managed agent — existing SSH records are marked, individually deletable, and clearable via "Remove all SSH hosts"; tool pickers no longer offer SSH-only hosts.
Firewall tool — each installer sits with its own backend (ufw / firewalld / nftables) rather than a separate install group.
Busy tool pages auto-tab instead of one long vertical scroll.
SSH Auth Policy uses explicit intent buttons instead of a checkbox-then-apply toggle.
User & Group Administration — redesigned account list for fleet scale (keyed on the distinct account, coverage counts, per-environment drill-down + "create on the N missing hosts", clickable filter tiles).
Enrolled Hosts footer polish — only the primary action is solid red; Force Delete/Revoke are outline-danger, disabled until a host is checked; Pause/Resume drops its ⏸/▶ glyphs.
Agent terminal defaults to bash, not the systemd /bin/sh.
Fixed
Duplicate enrollment when a host reported an empty hostname (reconciler now adopts the existing record by IP).
Runaway host enrollment — stable host-id derivation + mass-revoke / robust bulk ops.
openSUSE / SLES user management crash (capture_output/text 3.7-only kwargs → 3.6-safe PIPE/universal_newlines, with a regression test).
Updater gives a clear remedy when tracked files are locally modified.
Ported four shared console fixes from Enterprise.
Security
Hardened web-facing defaults — Secure cookie on by default, CSRF Origin/Referer backstop, loopback-only /openapi.json, clamped list limits.
fstab-line injection via mount options (fixed) — whitespace/newlines rejected.
_validate_path rejects CR/LF as well as NUL.
Additional QA-sweep + infra/reliability hardening across command paths.
Pre-release enterprise security & UX audit findings:
HIGH — command injection via an admin username → root on SSH-managed hosts (fixed) — usernames charset-validated at ingest and the run-as status echoes shlex-quoted.
fstab-line injection via fstype / mount options / NFS export path / CIFS share (fixed) — all reject CR/LF/NUL; fstype is a single token.
Session & bearer tokens hashed at rest (SHA-256) — a leaked DB snapshot no longer yields replayable sessions (existing sessions re-login once).
Local-package upload is size-bounded (413) so an operator can't OOM the console.
Removed a stray NUL byte from a console source file.
Console reliability & hardening (audit follow-through):
No more wedging on a hung request or expired session — request timeout, a global 401→login handler, and a top-level error boundary.
Durable login brute-force lockout — moved to the database so it survives a restart/crash-loop; per-IP throttle now mutation-locked.
Python dependencies pinned for reproducible builds (agent keeps a compatible range).
Configurable controller bind via SYSIBLE_CONTROLLER_BIND; firewalling :9000 stays primary.