v10.1.9-alpha — Encrypted split-server database links, fail2ban lockout fixes, and reclaimed disk

Headline: the connection between a split TAK Server and its database is now encrypted, three ways fail2ban could lock you out or quietly stop protecting you are fixed, and servers built with unusable disk space get it back.

Encrypted split-server database link

When TAK Server and PostgreSQL run on two separate machines, traffic between them — including credentials — was crossing the network unencrypted. It is now encrypted, on existing deployments as well as new ones. The change only completes after a live encrypted connection has been verified, and a deployment left on the old path keeps telling you so rather than going quiet.

fail2ban — three field-reported failures

• It could stop protecting you silently. On server images without rsyslog, fail2ban pointed at a log file that did not exist, failed to start, and took every jail down with it. The server looked protected and wasn't. It now falls back to the system journal.
• It could lock you out of your own server. The SSH jail was able to ban the very connection used to manage the box, taking a remote server offline with no way back in. Management tunnels are now permanently exempt, and any existing ban on one is released automatically.
• You couldn't see what was protected. The never-ban list rendered as a single opaque string. It is now shown in plain English, grouped by origin — and it warns you when the address you are connected from is not covered, which is the case that strands someone on a server they cannot walk up to.

Reclaims stranded disk

Servers provisioned with a large, unusable partition — common on Rocky/RHEL cloud images — can now hand that space back to TAK Server. Existing data is verified byte-for-byte before anything is removed, and the operation refuses rather than half-completing if it cannot finish cleanly.

Red Hat installs fail clearly, not mysteriously (GH #56)

On Red Hat in the cloud, a repository step could fail silently and resurface three steps later as a baffling PostGIS dependency error. The installer now asks the system which repository actually exists instead of assuming a name, so the dependency is there when it is needed. Thanks to the reporter for the detailed log — it made this straightforward to pin down.

Configuration safety

TAK Server's main configuration file is rewritten by roughly a dozen different operations, and none of them kept a copy — a bad write left nothing to go back to. The previous version is now saved automatically before every rewrite.

Firewall

If you had restricted the console to specific source addresses, restarting the console quietly reopened the port to the entire internet without telling you. A deliberate restriction is now left alone.

Also in this release

• Tighter permissions on files holding passwords and private keys
• CloudTAK's approved version moves to 13.54.3
• Hardening and self-healing improvements across SELinux, disk monitoring, and the console UI

Upgrade

Applied automatically on the next console update — no SSH required.

Platforms validated: Ubuntu 22.04, Rocky Linux / RHEL 9, and ARM64.