Back to Changelog
Panel Backend
v1.0.566
fail2ban bans are enforced on AlmaLinux and Rocky Linux, SSH protection survives a restart, a slow SMTP password-guessing rule and five panel fixes
New Feature
1- AppArmor Activity records which user ran the process and who owns the file (migration 000638).
Improvements
3- An unused Meilisearch installation (service not enabled, not running) is removed at startup (SH-187); nothing in the panel uses it.
- Mail certificate renewal: every name that fails is written to the log with its reason.
- Carries external-server, the panelica CLI and pn-isolated-guard.
Bug Fixes
5- AlmaLinux / Rocky Linux 10: when the ban action changes, fail2ban is restarted in the background. Pending firewalld bans (about 60 seconds each there) no longer hold the panel's startup or make the change roll back.
- Ubuntu 24.04 / 26.04 with socket-activated SSH: the panel's SSH section in fail2ban is no longer removed when the server starts before the first SSH login (sshd -T fails until /run/sshd exists). The ports written last time are kept, so a custom SSH port and the panel's SSH settings stay in force.
- The slow SMTP rule's name fits the iptables chain limit; with the longer name its bans were never written to the firewall on iptables systems such as Debian 12 and Ubuntu 22.04.
- Mobile app and browser extension keys: each request now updates the paired device's last use, and requests no longer cause a database error on every call.
- Deleting a domain removes its mail certificate folder. Folders left by earlier deletions are removed at startup (SH-186); folders still in use are kept.
Security Fixes
2- fail2ban on AlmaLinux / Rocky Linux 9 and 10: bans were never enforced. EPEL's fail2ban uses firewalld ban actions, while Panelica keeps firewalld off, so a jail listed the address as banned and the attacker stayed connected (panel login, SSH, mail and FTP). The panel now sets the nftables ban actions there (jail.d/01-panelica-banaction.conf). An operator's own ban action in a .local file still wins, and the file is removed again when firewalld runs. Debian and Ubuntu are not changed.
- New fail2ban rule against slow SMTP AUTH password guessing (panelica-postfix-slow): 10 failures within one day ban the address for one day. The existing fast rule (5 failures in 10 minutes) is unchanged.