Changelog
Version v0.7.0-beta Latest
This release fixes a security issue, adds mailcow evidence, gives hosts a real overview and makes sync far cheaper. Please update right away.
Every earlier release let anyone who could reach the dashboard create a local account. The sign-in page never offered registration, but the sign-up endpoint behind it was enabled, and a created account has full access: read and delete decisions, manage users. Update, then open Users and delete any account you did not create. Deleting a user ends its sessions.
Highlights
Mailcow evidence
Dovecot alerts show the mailboxes tried, the protocol, the failure reason and the result of each attempt. Postfix and postscreen alerts show what the client sent, the disconnect stage, the verdict and the reason, with a plain explanation of pregreet violations and clients speaking HTTP or TLS to an SMTP port. Both have a page in the docs. Alerts synced before this release are parsed again when opened.
Hosts show what an IP has been doing
Expanding a host now loads its retained history: which scenarios fired, with counts and latest occurrence, and the domains, paths, accounts, ports and rules it targeted. Each value counts once per alert. Selecting a scenario opens the matching decisions. Nothing loads for hosts you do not expand. Details in Using the dashboard.
I hope you’ll enjoy this part, as i’ve missed a better overview of the actors hitting my own instance. If you have feedback, let me know!
Sync no longer blocks the dashboard
SQLite now runs in WAL mode. Every poll writes the full decision set in transactions, and the default journal locks the whole file for each write, so page loads and live updates waited for sync to finish. With WAL, readers keep going. Sync also stops fetching row payloads it threw away, and synchronous = NORMAL skips the disk flush after every transaction. A power failure can lose the last commits, but the next sync restores them from your Local API.
Full sync also works again above roughly a thousand active decisions. It used to fail on SQLite’s parameter limit, leaving decisions CrowdSec had already dropped active in the dashboard.
WAL adds app.db-wal and app.db-shm next to the database. Keep the db volume on a local disk, not NFS or SMB. The server warns and falls back if it cannot enable WAL. Back up with sqlite3 app.db ".backup backup.db" or copy all three files together.
Smaller things
- The Scenario filter suggests names present in your data, with counts that respect the other filters.
- Closing an expanded decision cancels its evidence request.
Upgrading
curl -o docker-compose.yml https://raw.githubusercontent.com/ollioddi/crowdsec-local-dashboard/main/docker-compose.ymldocker compose pulldocker compose up -dThen open Users and remove any account you do not recognise. There are no schema changes. The db volume survives updates and WAL is enabled on first start.
Upgrading from 0.5 or earlier? See the deployment guide for the .env move.
Breaking changes
None.
Changes
Features
- decisions: Suggest observed scenarios in text filters (#96, ffb3903)
- mailcow: Render Dovecot and Postfix alert evidence (#97, 40c63b2)
- hosts: Lazily summarize retained scenarios and targets (#98, 9e4e572)
Bug fixes
- auth: Block unauthenticated local account registration (#93, 65b9016)
- sync: Reconcile large active decision sets in bounded batches (37a6887)
- decisions: Cancel evidence requests when rows close (7b81fee)
Performance
Documentation
Dependencies
- deps: Bump the actions group with 2 updates (#90, 2262003)
- deps: Bump the minor-and-patch group with 14 updates (#91, 99f55bc)
- deps: Bump the minor-and-patch group with 13 updates (#92, e22823a)
- deps: Bump source-map-js from 1.2.1 to 1.2.2 in /docs-site (#101, 3496df1)
- deps: Bump smol-toml from 1.8.0 to 1.9.0 in /docs-site (#102, 7a24bee)
- deps: Bump sharp from 0.35.4 to 0.35.5 in /docs-site (#103, 640077c)
Full diff: v0.6.0-beta…v.0.7.0