Akamai is pleased to announce the immediate availability of PacketFence v15.2. This is a minor release with new features, enhancements, and bug fixes. This release is considered ready for production use, and upgrading previous versions is strongly advised.
What is PacketFence? PacketFence is a fully supported, trusted, Free and Open-Source Network Access Control (NAC) solution. Boasting an impressive feature set, PacketFence can be used to effectively secure small to very large heterogeneous networks. Among the features provided by PacketFence, there are: * powerful BYOD (Bring Your Own Device) capabilities * multiple enforcement methods including Role-Based Access Control (RBAC) and hotspot-style * built-in network behavior anomaly detection * state-of-the art devices identification with Fingerbank * compliance checks for endpoints present on your network * integration with various vulnerability scanners, intrusion detection solutions, security agents and firewalls * bandwidth accounting for all devices A complete overview of the solution is available from the official website: https://www.packetfence.com/features/ Changes Since Previous Release New Features * Cluster-wide live log streaming — the admin UI now tails log files from every cluster node in parallel and merges events client-side with hostname/filename attribution (#9091) * Historical log view — query active and rotated .log.*.gz files across the cluster with a time-range picker, served by the Go log-tailer plugin (RE2 filters, bounded scans, lossless byte-offset pagination) (#9091) * pftest in admin GUI — the authentication and profile_filter subcommands are exposed under Auditing > pftest, guarded by the new PFTEST_CREATE admin-role action, rate-limited per tested user, and fan out across the cluster on request (opt-in) (#9091) * RADIUS authentication and accounting through pfconnector — remote sites can proxy RADIUS to the cloud over pfconnector tunnels, with a dedicated accounting tunnel, routing by packet code and a unified shared secret (#8963) * Connector-backed Active Directory domains — AD join and DNS resolution now work through the pfconnector, with automatic tunnel provisioning on domain commit and an Active Directory Domains menu in SaaS mode * VoIP dACL — new VoIPDACL switch toggle merges the full Access-Accept (including downloadable ACLs) with the Voice VSA instead of returning only the Voice attributes (#9068) * Captive portal theming — per-connection-profile theme.css support and refreshed default styling (#9071) * Record the node computername directly from DHCP server traffic (#9124) * SQL query tagging — all MySQL queries from Perl and Go services carry a /* pf:<service>[:<unit>] */ comment for ProxySQL routing and troubleshooting (#9097) * Files uploaded through the admin UI (PathUpload fields) are now synced to git storage (#9213) Enhancements * New auth_log.source_type column recording the authentication source type (AD, LDAP, SQL, Email, SMS, ...) alongside the source id, so portal authentication reports survive a source being renamed or deleted * Per-zone VRRP router id: in a multi-zone (layer 3) cluster, the keepalived virtual_router_id can now be set per zone in the zone's CLUSTER section of cluster.conf, instead of sharing the single active_active value across all zones (#9159) @casdr * pfdhcplistener performance — external DHCP events hashed by client MAC across dedicated workers, Fingerbank lookups skipped when the signature is unchanged, firewall SSO updates gated by a half-lease cache, and notifications run in-process (#9054) * pfacct no longer drops RADIUS accounting under load — larger UDP receive buffers with backpressure, and the node session cache is bounded with an idle TTL to stop a memory leak (#9166) * Faster RADIUS audit-log statistics — per-switch and per-connection-type metrics rewritten as GROUP BY queries (#9164) * MySQL connection compression enabled on TCP connections from both the Perl and Go database layers (#9047) * Fix pfcmd configreload hang and slow switch-config admin UI rooted in unbounded per-role switch mappings, plus clearer UX for blocked role deletions (#9078) * Removed the SCEP PKI provider (#9051) * Update Go to 1.26.4 (#9083) * Bump Fingerbank package to 4.3.4 (#9104) * Faster admin login — only authentication sources that define admin rules are queried, while match-time rule sources are still evaluated (#9215, #9218) * New pfcron task switch_observability_acls_cleanup to purge old switch observability ACL entries (#9196) * pfconnector: chisel pprof profiling can be enabled with the CHISEL_PPROF environment variable (#9210) * pfpki: SCEP requests are logged with the device CN in CA.Verify Bug Fixes * Self-heal the missing locationlog_history table when upgrading from 15.0 to 15.1 (#9121, #9069) * Fix switch NAS configuration not expiring in pfconfig after changes (#9134) * Fix non-deterministic RADIUS filter merge when using the reply: prefix (#9063) * Refresh the Fingerbank collector authorization header at request time so a changed API key is picked up without a restart (#9105) * Nightly backup: skip triggers in the dump so the pf-user backup isn't truncated, and reapply DB triggers on import (#9136) * Don't clobber existing rows in find_or_create when the database read fails (#9167) * pfflowjob: don't reconnect to Kafka on idle read timeouts (#9168) * Mask mariadb.socket so it cannot hold port 3306 from pf-mariadb (#9161) * Make a multi-node Kafka cluster reachable for PF-listener clients (#9089) * Entra ID: resolve sponsor group membership by email when the username is absent (#9144) * Allow disabling the AUP for sources under Authentication::Choice (#9079) * pfconnector: bind DNS tunnels on all interfaces and make Kubernetes port patching idempotent (#9149) * pfconnector: serve the local ntlm_auth host to remotes, validate that connector networks are not defined more than once, and pin the remote install URL to the PacketFence release * pfconnector-remote: remove the legacy fingerbank-collector on install/upgrade and restart Docker so the bridge picks up its address * pfacct: use webservices.aaa_host for the AAA client instead of the generic host * DHCP processor: fix the firewall SSO refresh gate and the Fingerbank DHCPv6 signature * IPv6 firewall rules are now actually applied — ip6tables rules are generated at monitor startup to close an inotify race, with CI validation (#9183) * pfcron: stop the panic when the management network is empty and self-heal on boot (#9181) * pfconnector: stop leaking UDP exit-node connections in the chisel tunnel (#9211) * RADIUS: fail the request when the node cannot be read from the database instead of fabricating an unregistered node (#9214) * httpd.aaa: fix a Fingerbank config memory leak and make mod_perl child recycling effective (#9217) * Fingerbank: restore the rate-limited query cache and fix cache hygiene (#9216) * Non-SQL (abstract) reports work again through the v1.1 report API — searching one returned a 400; those requests are now proxied to the Perl dynamic_report endpoint (#9207) Security Fixes * The default admin password has been removed — the admin password must now be set during initial configuration (#9118, #9148) * Replace shell command execution with safe_pf_run to prevent command injection (#9094) * Drop CBC/LUCKY13 ciphers on haproxy and apache listeners (#9052, #9162) * Improve the randomness of secrets generated at package installation * Escape user input in LDAP filters to prevent LDAP injection (#9119) * Restrict Sereal deserialization (THAW) to an allow-list of classes (#9155) External Contributor for this release: * Cas de Reuver (https://github.com/casdr) with enhancements PR #9159 Thank you! See https://github.com/inverse-inc/packetfence/compare/v15.1.0...v15.2.0 for the complete change log. See the Upgrade guide for notes about upgrading: https://packetfence.org/doc/PacketFence_Upgrade_Guide.html Getting PacketFence PacketFence is free software and is distributed under the GNU GPL. As such, you are free to download and try it by either getting the new release or by getting the sources: https://packetfence.com/download/ Documentation about the installation and configuration of PacketFence is also available: https://www.packetfence.com/docs/ How Can I Help? PacketFence is a collaborative effort in order to create the best Free and Open Source NAC solution. There are multiple ways you can contribute to the project: * Documentation reviews, enhancements and translations * Feature requests or by sharing your ideas * Participate in the discussion on mailing lists * Patches for bugs or enhancements * Provide new translations of remediation pages Getting Support Fill our online form (https://www.packetfence.com/contacts/?package=premium-support) and a representative from Inverse will contact you. Inverse offers professional services to organizations willing to secure their wired and wireless networks with the PacketFence solution. Akamai PacketFence Team Jeremy Goimard Senior Software Engineer PacketFence<https://www.packetfence.org> - Fingerbank<https://www.fingerbank.org> [Akamai Secure your applications]<https://www.akamai.com/solutions/security> Support:+1-555-183-6031 Akamai Technologies - Inverse 145 Broadway Cambridge, MA 02142 Connect with Us: [https://www.akamai.com/us/en/multimedia/images/custom/community.jpg] <https://community.akamai.com> [https://www.akamai.com/us/en/multimedia/images/custom/rss.png] <https://www.akamai.com/blog> [https://www.akamai.com/content/dam/site/en/images/logo/2024/x-logo.png] <https://x.com/akamai> [https://www.akamai.com/us/en/multimedia/images/custom/fb.png] <http://www.facebook.com/AkamaiTechnologies> [https://www.akamai.com/us/en/multimedia/images/custom/in.png] <http://www.linkedin.com/company/akamai-technologies> [https://www.akamai.com/us/en/multimedia/images/custom/youtube.png] <http://www.youtube.com/user/akamaitechnologies?feature=results_main>
_______________________________________________ PacketFence-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/packetfence-users
