TarleyNode 0.3.2

Security

• Upgrading no longer runs the settings file (deploy/.env) as a script: only the host name and port are read from it, as text. A restored or edited value, such as a sign-in URL with an ampersand, can no longer run a command as root during an update, and a proxy list with spaces no longer stops the upgrade.
• A licence lease is accepted only as the answer to the request this server just sent, for this installation and, when it grants the licence, this machine's fingerprint. A stand-in licence server (say, through internal DNS) cannot replay or reshape one; it can only fail to answer. The lease's issuer and audience are fixed outside development.

Fixed

• Removing a login from a device now closes the open incidents of the checks it removes and cancels their alerts still waiting to go out, as removing a check does.
• An incident opened because a connected site stopped reporting says so in words.
• A port check by name no longer shows "unsupported" when a VLAN has the same name as the port, as VLAN 1 and port 1 do on Aruba Instant On switches.
• A failing check on a device's page says what went wrong and what to do, in words, instead of a code such as "target outside scope".
• A device whose address is outside its site's ranges is refused when added, with the reason, instead of being added and never monitored.
• The graph axes show large numbers in short form, so they are not cut off.
• System resources on pfSense and other FreeBSD devices shows the real memory use (pfSense read 98% used with three quarters free) and its disks, which were left out (one per ZFS pool rather than one per dataset). These systems list over 700 kernel memory pools alongside memory and disks; only memory, swap and disks are read now.
• Disk forecasts no longer predict a full disk from growth before the disk was enlarged, or from short spikes such as an update unpacking images: the trend follows each disk's lowest reading every six hours, across edits of the check.

New

• Rescan for changes on a device's page reads its interfaces and sensors again straight away (normally every 5 minutes) and says what is new and what has gone.
• Getting started has a training manual: a course to read in order, with exercises and a quick reference, that prints as a booklet. The how-tos are one click away.

Changed

• A licence the licence server issues with fields this version does not know is accepted, so a newer licence server cannot strand installed servers. A paid licence that names no sensor allowance is the 500-sensor tier, never unlimited.
• New connected sites install as the tarleynode-site service (TarleyNodeSite on Windows), and the console's commands fetch from /site; sites already installed keep running as they are. `tarleynode logs site` and `tarleynode status` call this server's own monitoring service the site.
• A new look for the console, matched to tarleynode.com: the Geist typeface, a teal accent in place of purple, flat surfaces, and no text smaller than 11px, with secondary text that passes 4.5:1 contrast in light and dark. The unused workspace switcher, the dotted lines on the overview cards and the captions above every page title are gone, and the sign-in page says plainly what TarleyNode does.
• Check now, Install, Back up now and growing the disk start within a minute instead of up to six: the server's background agent now runs every minute.
• A device that still answers but has some failing checks shows Partly down, not Down. Down now means it does not answer a ping, or nothing on it works.
• Rules, Maintenance and Dependencies have their own icons in the menu.
• With automatic discovery on, a port given a name on the device (such as a firewall's DMZ) is monitored when it first comes up, and Rescan for changes adds named active ports without a check. Unnamed switch ports that come and go with desks are left alone.
• System resources reports the load average where the device has it (net-snmp).
• Certificate checks report the key type and size and the signature algorithm. An RSA key under 2,048 bits or an MD5 or SHA-1 signature fails the check, unless only expiry is watched; Certificates marks it weak either way.
• Devices added from a scan that answered HTTPS get a certificate check straight away.
• A port check removed by hand stays removed: automatic monitoring no longer adds it back when the port comes up again or on Rescan for changes, until someone monitors the port again.
• Automatic discovery adds at most 40 sensors to a device, system, CPU, memory, power and fans first, and never per-optic readings such as transceiver light levels; the rest are listed under Sensors to tick. Sensors count towards the licence, so a chassis no longer fills it on its own.

All releases · Plain text