mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-28 21:17:36 +00:00
114 lines
5.2 KiB
Plaintext
114 lines
5.2 KiB
Plaintext
secubox-nac (3.1.0-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* Phase 2: Requires=secubox-core.service -> Wants= on this module's unit
|
|
(remove the hard cascade-stop when secubox-core restarts/fails).
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Sun, 19 Jul 2026 12:00:00 +0200
|
|
|
|
secubox-nac (3.0.0-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* Device Guardian consolidation (#817): secubox-nac becomes the single
|
|
canonical Device Guardian, replacing secubox-mac-guard,
|
|
secubox-device-intel and secubox-iot-guard.
|
|
* New normalized SQLite device store (devices.db, WAL) with an
|
|
idempotent legacy-store migration (mac-guard JSON, device-intel
|
|
JSON, iot-guard SQLite) — MAC-canonical, per-column best-value
|
|
merge, lossless.
|
|
* One unified discovery pipeline (dnsmasq + ISC + ARP merge) replaces
|
|
the four separate legacy pollers.
|
|
* Absorbed enrichment: OUI vendor lookup (ieee-data), device-type /
|
|
risk classification, OpenWrt/router fingerprinting.
|
|
* Background collector + double-cache; all API handlers are now
|
|
non-blocking plain `def` reading the cache/store — no inline
|
|
discovery/scan work on the shared aggregator loop (#808).
|
|
* mac-guard's whitelist/blacklist folded into nac's existing
|
|
`allow_state` / `inet secubox_nac` zones (blocked / lan_allowed);
|
|
its separate `inet secubox_mac_guard` nft sets are migrated into
|
|
`secubox_nac` by a one-shot idempotent postinst step.
|
|
* Absorbed endpoints: vendors, on-demand scan, OpenWrt LuCI probe,
|
|
mDNS, device groups, JSON/CSV export.
|
|
* WebUI: vendor/device-type/risk columns + fingerprint badges, groups
|
|
view, CSV export.
|
|
* secubox-mac-guard, secubox-device-intel and secubox-iot-guard now
|
|
308-redirect their API surface to the nac equivalents (retained as
|
|
thin compatibility shims); secubox-network-anomaly's previously
|
|
open /status is now JWT-gated. Package removal is a separate gated
|
|
follow-up, not part of this release.
|
|
* Depends: add ieee-data (OUI vendor DB at /usr/share/ieee-data/oui.txt).
|
|
|
|
* Carries the LXC Containers zone + interface auto-classification
|
|
(br-lxc -> lxc) forward into the consolidated store: ARP discovery
|
|
now records the interface, the store persists it (best-value column),
|
|
and zone resolution falls back to it (nft set > interface > JSON >
|
|
quarantine). Folds in the standalone 1.0.5-1.0.7 releases below.
|
|
* postinst now ensures the `inet secubox_nac` table + all zone sets
|
|
(incl. `lxc_zone`) exist, idempotently, so operator "move to zone"
|
|
works on a fresh install and the mac-guard element migration has its
|
|
destination sets (the live board had no such table).
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Sat, 05 Jul 2026 18:00:00 +0000
|
|
|
|
secubox-nac (1.0.7-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* feat: add an LXC Containers zone and auto-classify clients by the interface
|
|
they were seen on (br-lxc to lxc), configurable via nac interface_zones.
|
|
Operator moves (nft sets) still take priority. gk2: 10 containers land in
|
|
the lxc zone, 3 upstream devices in lan.
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Thu, 10 Jul 2026 11:45:00 +0200
|
|
|
|
secubox-nac (1.0.6-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* fix: Zones tab was empty because /zones reported only raw nftables set
|
|
members (0), not discovered clients. It now groups discovered clients by
|
|
their resolved zone (nft set > JSON assignment > fallback), so populated
|
|
zones show their members.
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Thu, 10 Jul 2026 11:20:00 +0200
|
|
|
|
secubox-nac (1.0.5-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* fix: NAC discovered 0 clients when devices live on br-lxc or an interface
|
|
outside the hardcoded LAN set (dashboard showed only the template). ARP
|
|
discovery now includes br-lxc by default and reads extra interfaces from
|
|
nac config (gk2: eth2).
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Thu, 10 Jul 2026 11:00:00 +0200
|
|
|
|
secubox-nac (1.0.4-1~bookworm2) bookworm; urgency=medium
|
|
|
|
* webui: hybrid-dark cyan reskin (WebUI Panel Guidelines) baked into the package.
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Thu, 10 Jul 2026 10:00:00 +0200
|
|
|
|
secubox-nac (1.0.4-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* Add dynamic menu system with menu.d JSON definitions
|
|
* Menu items auto-registered when package installed
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Sat, 21 Mar 2026 16:36:21 +0100
|
|
|
|
secubox-nac (1.0.3-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* Add UMask=0000 for world-accessible sockets
|
|
* Add www-data to secubox group for nginx access
|
|
* Make dashboard endpoints public (no auth for read-only)
|
|
* Fix security endpoint error handling
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Sat, 21 Mar 2026 08:12:37 +0100
|
|
|
|
secubox-nac (1.0.2-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* Fix RuntimeDirectory conflict between services
|
|
* Only secubox-core manages /run/secubox directory
|
|
* Fix secubox-core.service install path (use /usr/lib/systemd/system)
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Sat, 21 Mar 2026 08:06:00 +0100
|
|
|
|
secubox-nac (1.0.1-1~bookworm1) bookworm; urgency=medium
|
|
|
|
* Initial release — migration depuis SecuBox OpenWrt.
|
|
* Port de luci-app-client-guardian : backend FastAPI + frontend conservé.
|
|
|
|
-- Gerald KERMA <devel@cybermind.fr> Sat, 21 Mar 2026 07:36:46 +0100
|