v10.0.8-alpha — The security guard becomes a real lock, safely and on your terms

The least-privilege "guard" that mediates every privileged action on your server can now actually block anything outside its allow-list — and turning that on is a deliberate, one-way operator choice, so it can never surprise a production box.

What's new

Enforcement — opt-in, never automatic. For several releases the guard has run in watch mode: it records what a compromised console would attempt but lets everything through. This release completes the allow-list so the guard recognizes every legitimate operation your servers perform (validated with zero false-flags across Ubuntu 22.04, Rocky / RHEL 9, and ARM64), then adds real enforcement — as an opt-in:

• A box never flips itself. After it has run 72 hours with a completely clean record, it becomes eligible, and a "Turn on enforcing" button appears on the Cyber Controls page.
• Enabling it is confirmed and one-way from the browser — turning enforcement back off requires SSH break-glass — so a compromised console can only ever make a box more locked down, never less.
• Existing boxes stay in watch mode until you press the button. Brand-new installs are opted-in automatically but still watch for 72 hours first, so a fresh box never breaks its own setup.

Snapshots capture a real database again. On unprivileged (non-root) consoles, TAK Server snapshots previously shipped config-only backups with no database dump. Snapshots now capture a genuine database dump, and dumps are authenticated so only a real, guard-produced snapshot can be restored.

CloudTAK cryptominer scanner works under the guard. The built-in PostGIS/PGMiner incident scanner (which detects and quarantines the cryptominer that has targeted exposed CloudTAK databases in the wild) now runs correctly on locked-down consoles.

Security hardening. A batch of fixes from an internal security review of the guard's mediation layer.

Upgrade

Applied automatically on the next console update. Your boxes keep running exactly as before — in watch mode — until you choose to enforce. Nothing is blocked until an operator deliberately turns it on, and only after a box has proven itself clean for 72 hours.