The HotFix generates an error when manually updating the Artica version, it is normal.
It can be applied only for Artica 4.50.00000 Service Pack 10
New Hotfix erase modifications of old applied HotFixes.
¶ Official Hotfix
¶ Issues resolved by The Hotfix
- 20261029-15: Fix: in Artica Proxy, On a categories server, the "Compile" button of a personal category now also rebuilds the web-filtering database sent to the proxies, so websites added to the category reach the proxies.
- 20261029-15: Fix: in Artica Proxy, A categories server no longer drops unchanged categories from the list it publishes, so proxies always see every category and download the updated ones.
- 20261029-15: Add: in Artica, The Artica AI assistant can now tell whether the Synology Active Backup agent may compile its own snapshot driver, and switch that option on or off after an administrator approves it.
- 20261029-15: Add: in Artica, A new Synology Active Backup option controls whether the agent may compile its own snapshot driver; it is off by default, because that driver crashes on Artica and blocks every backup at 0%.
- 20261029-15: Fix: in Artica, The Disconnect button of the Synology Active Backup page now closes the session with the NAS instead of reconnecting it.
- 20261029-15: Fix: in Artica, Synology Active Backup no longer stays stuck at 0% when the agent compiled its own snapshot driver on the appliance: the driver shipped by Artica is now always the one loaded, including at boot.
- 20261029-15: Fix: in Artica, The four summary tiles of the Docker containers page are now shown on a single line.
- 20261029-15: Fix: in Artica Proxy, Searching a URLs database object can no longer run system commands through a crafted search.
- 20261029-15: Fix: in Artica Proxy, Removing a site or a URL from the proxy cache can no longer run system commands through a crafted name.
- 20261029-15: Fix: in Artica Proxy, Removing a URL from the proxy cache now also removes it when the object was cached over HTTPS.
- 20261029-15: Fix: in Artica Proxy, The watchdog button of the proxy status page now applies the watchdog settings.
- 20261029-15: Fix: in Artica, Saving the colors or the logo of the RDS bastion no longer restarts the gateway, so the open sessions are no longer cut; the new look applies from the next connection.
- 20261029-15: Fix: in Artica, The RDS Proxy console now previews the logo on the background color of the gateway, so a light logo is no longer invisible.
- 20261029-15: Fix: in Artica, The session limit of the RDS bastion Community edition now follows the real license state: licensed appliances are no longer capped, and Community appliances are limited as intended.
- 20261029-15: Fix: in Artica, Without an Artica license, the RDS bastion now accepts 3 simultaneous sessions instead of 5.
- 20261029-15: Add: in Artica, Customizing the look of the RDS bastion (colors, background, logo, welcome text) now requires an Artica license; without it the gateway keeps the default Artica look, and the usage charter stays available.
- 20261029-15: Fix: in Artica Proxy, Saving the proxy watchdog settings now applies the URL checking and the network analysis options.
- 20261029-15: Fix: in Artica Proxy, The option that reconfigures the proxy services after a reboot works again.
- 20261029-15: Add: in Artica, The RDS bastion login screen can show a welcome text to every user before sign-in, and now uses the gateway's standard login page with the Artica logo instead of the bare "Target information required" dialog.
- 20261029-15: Add: in Artica, The screens of the RDS bastion now use the Artica green background (#005447) by default, and the background color chosen in the console applies even when the custom template is off.
- 20261029-15: Fix: in Artica Proxy, The Empty DNS cache button of the proxy dashboard now really empties the DNS cache before restarting the proxy.
- 20261029-15: Fix: in Artica, The DNS watchdog no longer restarts the DNS cache in a loop when the cache refuses queries from the appliance itself.
- 20261029-15: Fix: in Artica, Sending DNS cache events to a Statistics Appliance now survives the periodic rebuild of the system log configuration.
- 20261029-15: Fix: in Artica, Allowing a domain from the DNS events now reloads the DNS cache service instead of failing silently.
- 20261029-15: Fix: in Artica, The DNS cache settings no longer show a DNS blacklists option that had no effect.
- 20261029-15: Fix: in Artica, A snapshot schedule inherited from an older version now keeps the time chosen by the administrator instead of falling back to the default schedule.
- 20261029-15: Fix: in Artica, Migrating a failover (keepalived) node to a new server now installs and prepares the failover service, so it starts after the final reboot.
- 20261029-15: Fix: in Artica, The Web Application Firewall deployment wizard now completes instead of stopping at 70%, and also installs the proxy.pac service.
- 20261029-15: Fix: in Artica, The IPsec deployment wizard no longer fails on an appliance where strongSwan has never been configured.
- 20261029-15: Fix: in Artica, The simple proxy and the cache deployment wizards now reach the end of their progress bar and remove the services they announce.
- 20261029-15: Fix: in Artica, The deployment wizards can now only be run by a system administrator.
- 20261029-15: Fix: in Artica, The web filtering error page wizard now publishes the page with TLS 1.2 and TLS 1.3 only.
- 20261029-15: Fix: in Artica, Restoring a snapshot from the installation wizard no longer corrupts the administrators and proxy databases.
- 20261029-15: Fix: in Artica, A snapshot restore now replaces a corrupted database instead of stopping, and restores the remaining databases.
- 20261029-15: Add: in Artica, The RDS bastion can show a usage charter that every user must accept after signing in, before choosing a target; declining closes the session and each answer is recorded in the access events.
- 20261029-15: Fix: in Artica, A logo uploaded for the RDS Proxy login screen is now checked, resized and re-encoded, so an oversized image can no longer exhaust the memory of the bastion.
- 20261029-15: Fix: in Artica, The disk quota tabs of a Docker container no longer fail with an internal server error.
- 20261029-15: Fix: in Artica, The packages update list now offers new versions of the RDP proxy even when the service is installed but disabled.
- 20261029-15: Add: in Artica, The SSH targets of the RDS bastion now show their messages, status bar and file explorer in English or French, following the language of the session, while the transfer and command logs stay in English.
- 20261029-15: Fix: in Artica, Pasting files from a Windows Remote Desktop client (mstsc) into an SSH target of the RDS bastion no longer fails with "the workstation did not send the file".
- 20261028-17: Fix: in Artica, The RDS Proxy console now mentions SSH targets in the page descriptions and in the policy evaluation steps.
- 20261028-17: Fix: in Artica, The RDS Proxy target form no longer shows an empty unlabeled field under the user name when the protocol is SSH.
- 20261028-17: Fix: in Artica, The RDS Proxy SSH session trace now shows small sizes in bytes instead of 0 KB, and no longer rounds file sizes down.
- 20261028-17: Fix: in Artica, The RDS Proxy console no longer shows internal label names instead of text on the SSH target, policy, pattern and second factor screens: 97 English and French labels lost by an earlier language file update are back.
- 20261028-17: Add: in Artica, The RDS Proxy can transfer files with SSH targets when the policy allows clipboard files: paste files in the terminal to drop them into the account's home directory (an existing file is never overwritten), press Ctrl+Alt+F to browse the target and copy files or folders to the Windows clipboard, and press Ctrl+Alt+X to cancel a drop in progress. Each file is fingerprinted with SHA-256 and logged in the session recording and in the access events. When the policy has command patterns that refuse or kill, a file or folder whose name starts with a dot is refused at the top of the home directory. Requires ReDemPtion Artica 12.3.19 and the authentication hook 1.6.1.
- 20261028-17: Add: in Artica, The RDS Proxy recordings page has a Files view listing each file uploaded to or retrieved from an SSH target (direction, path, size, SHA-256 fingerprint and outcome), the access log shows these transfers, and the policy page tells whether the RDS proxy engine applies the clipboard file rights to SSH targets.
- 20261028-17: Add: in Artica, The firewall general settings now appear as a protection board with one tile per protection, showing at a glance which ones are active.
- 20261028-17: Fix: in Artica, The web console PHP service is now refreshed when Debian updates PHP, so the console no longer stays stuck on "loading its PHP components" after a PHP security update.
- 20261028-17: Add: in Artica, The packages update list now also offers new versions of the Keepalived failover service.
- 20261028-17: Fix: in Artica, The web console no longer restarts its PHP service every minute when the PHP curl extension is missing; the cause is now reported instead.
- 20261028-17: Fix: in Artica, Updating the Failover service (keepalived) now installs the system libraries it needs before downloading the package, so the new version no longer fails to start on appliances where they are missing.
- 20261028-17: Fix: in Artica, The waiting message and percentage shown on the login page while the API service starts are now displayed in white so they remain readable on the dark background.
- 20261028-17: Add: in Artica, keepalived (Failover) is now built for Debian 10, 12 and 13 from the official 2.x releases, automatically for Debian 12 and 13, with SNMP, D-Bus, JSON, BFD and content checks (regex) in HTTP health checks.
- 20261028-17: Fix: in Artica, On Debian 10 appliances, the firewall rebuild is no longer refused with "Bad argument FIN,SYN,RST,ACK" when old rules have to be removed, which left the previous firewall rules in place.
- 20261028-17: Fix: in Artica, The server migration window of the console now shows which network card of the new server replaces each card of the old one; it was only shown in the installation wizard.
- 20261028-17: Fix: in Artica, A migration from a server without the latest hotfix now moves every network card of its configuration to the new server, not only the card carrying its address, so the default gateway is no longer lost.
- 20261028-17: Fix: in Artica, The Failover service no longer stays stopped after a migration to a server whose network cards have other names; the floating IP label now follows the renamed card.
- 20261028-17: Fix: in Artica, On Debian 10 consoles still running the former dedicated PHP 7.4, the Fix PHP2Shell button now switches to the official, patched PHP 7.3 (CVE-2026-109618, CVE-2026-109619), and puts PHP 7.4 back if the console does not answer afterwards.
- 20261028-17: Fix: in Artica, The System information page no longer offers the obsolete upgrade to PHP 7.4, which no longer worked.
- 20261028-17: Fix: in Artica, The Synology Active Backup agent is now started and stopped only through its own systemd service, so a second copy can no longer remove its control socket and make the console show version 0.0.0.
- 20261028-17: Fix: in Artica Proxy, The daily and weekly PDF statistics reports are generated and sent again instead of stopping on a chart error.
- 20261028-17: Fix: in Artica Proxy, The blocked sites statistics now count only web filtering blocks and 403 answers, instead of counting redirects, cached answers and errors as blocked requests.
- 20261028-17: Fix: in Artica Proxy, The nightly categorization of unknown websites now records the category found instead of treating every successful lookup as a failure, and no longer floods the system log.
- 20261028-17: Fix: in Artica, A disabled proxy.pac service no longer leaves a monitoring rule that tried to restart it every minute.
- 20261028-17: Fix: in Artica, The swap cleaning event now reports the swap size in the right unit.
- 20261028-17: Add: in Artica, Older PHP versions left behind by a system upgrade (such as PHP 8.2 next to PHP 8.4) are now removed automatically once nothing uses them anymore, so security scanners no longer report them.
- 20261028-17: Fix: in Artica, The "Download client certificate" button of the server migration page no longer answers with a 404 error.
- 20261028-17: Fix: in Artica, The server migration service now listens only on the address it publishes instead of every interface, and by default publishes the web console interface rather than the interface of the default route.
- 20261028-17: Add: in Artica, The server migration page lets you choose the network interface on which the source server waits for the destination appliance.
- 20261028-17: Add: in Artica, The AI assistant can now read the state of the server migration service (listening address, chosen and active interface, available interfaces) and change its listening interface with your approval.
- 20261028-17: Fix: in Artica, Importing the server migration certificate on the new server no longer fails with "no such file or directory" when the uploaded file was renamed because an earlier copy was already there, for example to "client (4).gz".
- 20261028-17: Fix: in Artica, Migrating to a server whose network cards have other names (for example eth0 on Debian 12 and ens192 on Debian 13) now takes over the address of the source server instead of stopping at the end: the wizard asks which card of the new server replaces each card of the source, and the whole imported configuration follows.
- 20261028-17: Add: in Artica, The network interfaces page now lists the interfaces that the configuration still cites but that the server no longer has, and either moves their whole configuration to a card of the server that has none yet, or removes them together with their routes, routing rules, NAT, firewall and DHCP entries.
- 20261028-17: Fix: in Artica, On the network interfaces page, a card named with the Debian 13 scheme (such as ens192) can now be opened and configured before it is registered.
- 20261028-17: Add: in Artica, The AI assistant can now list the ghost network interfaces and, with your approval, move the configuration of one of them to a present card or remove it.
- 20261028-17: Fix: in Artica, On the firewall interfaces page, a click anywhere on an interface card now opens its settings, not only a click on its name.
- 20261028-17: Fix: in Artica, Installing the IPv6 gateway (NAT64/SIIT) no longer fails on Debian 13 with "jool.ko: file does not exist", the compressed kernel modules built by DKMS are now recognized.
- 20261028-17: Fix: in Artica, Starting the IPv6 gateway while it is disabled, or installing it while IPv6 is disabled, is now refused at once with the reason instead of reporting a success, and a start or stop waits for a running check instead of failing.
- 20261028-17: Add: in Artica Reverse Proxy, The web services page now warns when nginx still publishes sites that were deleted or disabled, and offers a button that removes their configuration and reloads nginx.
- 20261028-17: Fix: in Artica Reverse Proxy, The automatic cleanup of deleted sites now also removes the configuration of deleted TCP/UDP stream services, which kept their listening port open.
- 20261028-17: Add: in Artica, The AI assistant can now read the NAT64/SIIT gateway (state, instances, translation sessions) and propose, with approval, adding, changing or removing instances, pool4 and EAM entries, and starting, stopping, installing or uninstalling the gateway, each change verified and undoable.
- 20261028-17: Fix: in Artica, The bonding option of the network interfaces page now shows its explanation text in every language.
- 20261028-17: Fix: in Artica, The ISP prefix label of the IPv6 interface page is now translated in every language, and a correction to that label now applies to every page that shows it.
- 20261028-17: Fix: in Artica Reverse Proxy, The "Listen address and port" tab of a TCP/UDP stream service no longer fails with a blank panel, so its listening ports can be listed and added again.
- 20261028-17: Fix: in Artica, A web console panel that fails to load now shows the error instead of retrying endlessly, which sent tens of thousands of requests per hour to the appliance.
- 20261028-17: Fix: in Artica KSC Installer, After restoring the certificate of an old server, signing in no longer fails with "Administration Server uses an untrusted certificate".
- 20261028-17: Fix: in Artica, Stopping the IPv6 gateway (NAT64/SIIT) from the console now holds, the watchdog no longer restarts it three minutes later.
- 20261028-17: Fix: in Artica, The IPv6 gateway watchdog now repairs a lost or extra IPv4 pool or address mapping, not only a changed IPv6 prefix, and a temporary read error no longer recreates a live translator and cuts its sessions.
- 20261028-17: Fix: in Artica, One IPv6 gateway instance refused by the kernel no longer keeps the other instances down, and invalid IPv6 prefixes, overlapping IPv4 pools and overlapping address mappings are refused when they are saved.
- 20261028-17: Fix: in Artica, The IPv6 gateway pages are now reserved to system administrators, refresh the IPv4 pool and mapping lists after a change, can enable or disable an instance, and propose the safe 61001-65535 port range for a new IPv4 pool.
- 20261028-17: Add: in Artica, The Docker status page has been redesigned as a dashboard showing the service and engine health, container and image counts, host capacity, storage, runtime, image sources and engine versions at a glance.
- 20261027-17: Add: in Artica, The network interfaces status page now shows each interface, VLAN, bond, kernel-only interface and Samba instance as a card with its gateway, MAC address, options and traffic, and can be filtered by name, IP or tag.
- 20261027-17: Fix: in Artica, On a virtual machine, the console of a newly installed Artica system and of its rescue system is no longer flooded with "systemd-ssh-generator: Failed to query local AF_VSOCK CID" messages.
- 20261027-17: Add: in Artica, The IPv6 widget of the network interfaces page now enables or disables IPv6 in one click and applies it at once to the kernel, the network interfaces and the services that use it, with a progress bar. Disabling is refused while NAT64 is enabled. The IPv6 option of the kernel network settings applies the same way.
- 20261027-17: Fix: in Artica Proxy, Upgrading the reverse-proxy engine from the Artica repository no longer overwrites the appliance's nginx configuration with the files shipped inside the package, which stopped nginx with an unknown "geoip2_data_country_code" variable error.
- 20261027-17: Fix: in Artica Proxy, The reverse-proxy service now repairs its GeoIP country definition before each start, so nginx starts even when that file was damaged or emptied.
- 20261027-17: Fix: in Artica Proxy, After an nginx upgrade, the reverse-proxy service detects the modules of the new nginx binary immediately instead of reusing those of the previous one.
- 20261027-17: Fix: in Artica Proxy, Building the WAF rules no longer logs an error for each published site that has no host name.
- 20261026-17: Fix: in Artica, The SSH terminal of the RDS bastion no longer leaves stray marks and dark lines on screen when used from the Windows Remote Desktop client.
- 20261026-17: Add: in Artica, Each action button of the certificates center now shows a tooltip explaining what it does (view, PFX, PEM download, export, renewal, deletion).
- 20261026-17: Add: in Artica, The Artica AI assistant can read the Web console session debug log and turn it on or off with your approval, to diagnose a login that keeps returning to the login screen.
- 20261026-17: Add: in Artica, The Web interface menu of the system console can turn the session debug log on or off and display its last lines, to diagnose a login that keeps returning to the login screen.
- 20261026-17: Add: in Artica, The RDS Proxy sessions page shows the protocol of each session (RDP, VNC or SSH), lists SSH sessions, and tells that a disconnected session ends within 30 seconds.
- 20261026-17: Add: in Artica, The RDS Proxy recordings page marks recordings holding an SSH trace and lets you read the commands typed and the terminal transcript as plain text, page by page, or download the transcript file; synchronization stays available for SSH transcripts when video support is missing.
- 20261026-17: Add: in Artica, The RDS Proxy status page now explains why SSH targets are unavailable: missing SSH module in the engine, or an authentication hook that is too old, with its running version.
- 20261026-17: Add: in Artica, The RDS Proxy target list shows a short SSH host key fingerprint, and the access log links a connection refused for a changed host key to the target, where the recorded key can be checked and forgotten.
- 20261026-17: Fix: in Artica, Reading, downloading or deleting RDS Proxy session recordings and disconnecting a session now require the proxy administrator privilege.
- 20261026-17: Add: in Artica, The RDS Proxy second factor messages (code prompt, enrollment, invalid code, locked account, unavailable) can now be customized from the console.
- 20261026-17: Fix: in Artica, The RDS Proxy policy and pattern pages no longer show the recording and window-title OCR warnings for SSH command patterns, and state that SSH sessions are always recorded and which session rights apply to SSH targets.
- 20261026-17: Add: in Artica, The RDS Proxy SIEM page states that SSH session commands and transcripts are not sent to the SIEM yet.
- 20261025-17: Add: in Artica, The RDS Proxy console can now register SSH targets, with the password typed at connection time or kept in an encrypted vault as a password, a private key or the bastion key. Opening SSH sessions through the bastion requires the next RDS Proxy engine update.
- 20261025-17: Add: in Artica, The RDS Proxy console can create the bastion SSH key, show its fingerprint, regenerate it, and deploy it in one click on a Linux server or an Artica appliance; the password typed for the deployment is never kept.
- 20261025-17: Add: in Artica, The RDS Proxy console stores the host key fingerprint of each SSH target, with a button to forget it, and lets you prepare session patterns for SSH commands, which will apply once the next RDS Proxy engine update is installed.
- 20261026-17: Add: in Artica, The RDS Proxy opens SSH sessions to Linux servers and Artica appliances from any RDP client, with the same access rules as other targets, a check of the server host key, typed or vault authentication, and text copy and paste allowed by the policy (requires ReDemPtion 12.3.18 and the authentication hook 1.6.0).
- 20261026-17: Add: in Artica, RDS Proxy session patterns can now apply to SSH commands: a matching command is refused before it runs, reported, or ends the session, and every SSH session keeps a command log and a terminal transcript next to its recording.
- 20261026-17: Fix: in Artica, Disconnecting an RDS Proxy session from the console now really ends a session that is already open, within 30 seconds.
- 20261026-17: Fix: in Artica, The RDS Proxy Community Edition limit now stops at five simultaneous sessions instead of six.
- 20261026-17: Fix: in Artica, The RDS Proxy access log no longer records a normal end of session as a disconnection by the administrator.
- 20261026-17: Add: in Artica AI, New read-only skills report the RDS Proxy state, the open sessions, the recordings and the SSH commands of a recording, with passwords masked.
- 20261026-17: Fix: in Artica KSC Installer, The Web Console now reaches the authentication service by the name in its certificate, which fixes the "Authentication service unavailable" login error when Kaspersky Security Center was installed with a host name.
- 20261026-17: Add: in Artica KSC Installer, The installer detects a Web Console left on a previous IP address or server certificate, explains why login fails and offers to configure it again.
- 20261026-17: Add: in Artica KSC Installer, The Certificate menu can now restore the server certificate of an old server from its klbackup folder, after saving the current one, and then reconfigures the Web Console.
- 20261026-17: Add: in Artica KSC Installer, A new --health option prints the health check without changing anything.
- 20261026-17: Fix: in Artica KSC Installer, The database checks no longer fail when the installer is started with su without a login shell.
- 20261026-17: Add: in Artica, The AI assistant can now read the snapshot backup schedule, detect when its cron file is missing or stale, and rewrite it after approval.
- 20261026-17: Add: in Artica, The AI assistant can now destroy the Kerberos tickets of the appliance after approval, without touching the Active Directory machine account.
- 20261026-17: Fix: in Artica, Web console pages no longer receive empty system information when the appliance runs PHP 8.0 or 8.1.
- 20261026-17: Fix: in Artica, Revalidating the license API key from the license page now actually contacts the licensing server instead of silently doing nothing.
- 20261026-17: Fix: in Artica, The "Destroy Kerberos tickets" action of the Active Directory page now really destroys the tickets and reports an error when it fails.
- 20261026-17: Fix: in Artica, When the Web console loses its connection to the system framework, the automatic service restart now runs, at most once per minute.
- 20261026-17: Fix: in Artica, Saving a kernel parameter through the generic field editor now requires system administrator rights and never runs a command supplied by the browser.
- 20261026-17: Fix: in Artica, The scheduled snapshot backup is now applied when saved from the console and repaired automatically on appliances where it was saved but never ran.
- 20261026-17: Add: in Artica, The AI assistant can list the trusted relays declared in "Follow source addresses" and, with your approval, add or remove one; it refuses a source wider than a /8 network.
- 20261026-17: Fix: in Artica Proxy, A trusted relay entered as an IP range in "Follow source addresses" is now taken into account; it was silently ignored.
- 20261026-17: Fix: in Artica Proxy, Adding, enabling or deleting a trusted relay in "Follow source addresses" now reloads the proxy instead of restarting it, so connections in progress are no longer cut.
- 20261026-17: Fix: in Artica Proxy, The global settings page shows the trusted relays whatever the outgoing X-Forwarded-For mode; they were hidden unless that mode was "Enabled".
- 20261026-17: Add: in Artica, The AI assistant can read the ClamAV signature exclusions and signature databases, and, with your approval, add, switch on or off, or remove a signature exclusion, each change being checked on the antivirus and reversible.
- 20261026-17: Fix: in Artica, A ClamAV signature exclusion containing a line break is refused, so it can no longer slip a second ignored signature into the antivirus.
- 20261026-17: Fix: in Artica, The dialog that adds a ClamAV signature exclusion now explains what to paste and that the .UNOFFICIAL suffix is handled, instead of showing a truncated title.
- 20261026-17: Add: in Artica, The ClamAV signature exclusions page shows how many exclusions are active, which ones come from third-party databases and who changed the list last, with filters, a search field and advice on choosing between excluding a signature and excluding a site.
- 20261026-17: Fix: in Artica, The ClamAV signature exclusions page shows its buttons in the page header and refreshes the list after an exclusion is edited.
- 20261026-17: Add: in Artica, The ClamAV signature databases view now shows the total number of signatures, the freshness of the databases with a clear warning when they are out of date, and lets you enable third-party databases in one click.
- 20261026-17: Add: in Artica, The AI assistant can now read and switch the option that takes the proxy user name from the X-Authenticated-User header of the declared relays, with a check and an automatic undo.
- 20261026-17: Add: in Artica Proxy, The proxy can take the user name from the X-Authenticated-User header sent by the relays declared in "Follow source addresses" (a VirtualBrowser cluster, for example), so requests, logs and statistics show the real user; the header is ignored from any other address.
- 20261026-17: Fix: in Artica, The notification bell no longer shows false alerts, such as "End of support for your OS" on Debian 13, while the Artica REST service is stopped or the system version is unknown.
- 20261026-17: Fix: in Artica Proxy, Applying a change to the antivirus exclusions now reloads the proxy instead of restarting it, so downloads in progress are no longer interrupted.
- 20261026-17: Fix: in Artica Proxy, Disabling the antivirus exclusions list now really sends all traffic to the antivirus again.
- 20261026-17: Fix: in Artica Proxy, The forms of the antivirus, global and SSL whitelists show the help for the selected entry type again, with the exact syntax of domain patterns.
- 20261026-17: Add: in Artica, The routing page has a new Gateway groups tab to create groups of gateways ranked by tier, see the live state, latency and loss of each gateway, and their quality over the last 24 hours.
- 20261026-17: Add: in Artica, The routing page shows a banner while a routing change is under watch, and a new Watch tab lists the automatic rollbacks and sets the watch duration.
- 20261026-17: Add: in Artica, The Internet access load balancer page shows the links of its gateway group once migrated, and offers to go back to the former balancer or resume the group.
- 20261026-17: Fix: in Artica, Reading the last lines of a service log from the console no longer leaves a temporary file behind on each request.
- 20261026-17: Add: in Artica Proxy, The integrated antivirus settings now show the threats blocked in the last 24 hours, the affected devices and the active exclusions at a glance, with a clear warning when the proxy runs without antivirus protection.
- 20261026-17: Fix: in Artica Proxy, An antivirus exclusion added from the console is now created enabled, and its window closes after saving.
- 20261026-17: Add: in Artica Proxy, The antivirus exclusions page shows counters of active exclusions, trusted domains and exempted networks, the global state of the list, filters by type and a guided screen when the list is empty.
- 20261026-17: Fix: in Artica Proxy, The antivirus exclusions list again offers the button to turn the whole list on or off.
- 20261026-17: Add: in Artica, The multi-WAN link balancer now takes its links, weights, health and backup links from the "wan" gateway group, migrated automatically from the existing links, with a way back to the previous behavior.
- 20261025-17: Add: in Artica, The Load-Balancer objects page has a new layout with indicator tiles (orphan objects included), a type filter, a preview of each object values, its rules and a button to create an object.
- 20261025-17: Fix: in Artica, Saving the items of a Load-Balancer ACL object no longer stores the whole list as a single URL-encoded item.
- 20261025-17: Fix: in Artica, The Load-Balancer service is started, reloaded and rotated through the lightweight Artica launcher, and is no longer restarted every few minutes while no balancing service is defined.
- 20261025-17: Add: in Artica, The Load-Balancer access rules page shows each rule as a card with its evaluation order and the sentence it reads as, and the rule editor chooses the action from cards with a live preview of the rule.
- 20261025-17: Fix: in Artica, The Load-Balancer objects page and the backend servers tab of a service work again with the new table layout, and their changes go through the Artica service.
- 20261025-17: Fix: in Artica, The Load-Balancer services page works again with a new layout (indicator tiles, publication templates, type filter), and creating, editing, duplicating, enabling and deleting a service go through the Artica service.
- 20261025-17: Fix: in Artica, The Load-Balancer access rules page no longer fails with an internal server error, and its rules, objects and items are now edited through the Artica service.
- 20261025-17: Add: in Artica, The Load-Balancer status page has a new layout with large service buttons, the result of the last operation and a description of each global parameter.
- 20261025-17: Add: in Artica, The Load-Balancer servers status page groups each server under its service, with indicator tiles (active services, servers online, servers in error, total requests), the health check result of each server and a pause or resume button.
- 20261025-17: Add: in Artica, After a change to the routing, the routing engine watches the gateways that answered before for a few minutes: if one stops answering, it puts the last valid configuration back on its own and tells why, and if the gateway stays silent anyway it restores the change, since the cause is elsewhere.
- 20261025-17: Fix: in Artica, A routing rule added without a priority now takes a free priority of the range instead of being refused when the highest one is already used.
- 20261025-17: Add: in Artica, The Load-Balancer status page shows its global parameters as a summary card, edited in a dialog.
- 20261025-17: Fix: in Artica, The Load-Balancer realtime requests page decodes the log lines the Load-Balancer actually writes, and shows the client, the site, the status, the backend server, the size and the latency of each request.
- 20261025-17: Fix: in Artica, The Load-Balancer status page shows the service state again, and its start, stop, restart and reload buttons, the server pause and resume actions and the log search work again.
- 20261025-17: Add: in Artica, The NAT tab of the routing engine shows counters, filters, the packets, bytes and connections translated by each rule, whether each enabled rule is really in the kernel, and the rules found in its kernel chain that the engine does not manage.
- 20261025-17: Add: in Artica, The window of a routing NAT rule only shows the translation address for SNAT and displays a summary of the rule.
- 20261025-17: Fix: in Artica, Installing the Load-Balancer feature no longer fails with "haproxy.cfg no such file" when no balancing service is defined yet.
- 20261025-17: Add: in Artica, The Routing rules tab shows the kernel evaluation order, counters, filters, the criteria and the decision of each rule, an on/off switch and arrows to change the order.
- 20261025-17: Add: in Artica, A routing rule can now select traffic by protocol and ports, with ready-made templates for Teams, Zoom, SIP and RTP, and send it to a gateway group; its window shows a summary of the rule.
- 20261025-17: Add: in Artica, The Routes tab of the routing engine shows counters, filters and how each route is forwarded (gateway, next hops, gateway group, direct link or blackhole), with an on/off switch per route.
- 20261025-17: Add: in Artica, A route of the routing engine can now be sent through a gateway group from the console, and its window only shows the fields of the chosen forwarding mode.
- 20261025-17: Add: in Artica, The Routing tables tab shows counters (tables, main table, custom tables, IP families, unused tables), filters, a hint when only the main table exists, and links that open the routes or the rules of a table.
- 20261025-17: Add: in Artica, The Routing rules tab can be filtered by routing table from its header.
- 20261025-17: Add: in Artica, Policy rules of the routing engine can now select traffic by protocol and ports (for example UDP 3478-3481 for Teams), so video calls and VoIP can be sent through a chosen link or gateway group, and the path tester simulates such a flow.
- 20261025-17: Fix: in Artica, A gateway group member added without weight, probe or tier now gets 1, ping and tier 1 instead of being refused.
- 20261025-17: Fix: in Artica Proxy, When the monitoring service restarts the web-filtering server, after a crash or for excessive memory use, it now comes back under its own system unit.
- 20261025-17: Fix: in Artica, The routing page no longer shows a separate banner saying that its configuration belongs to this appliance only: the sentence now ends the page description, leaving more room for the content.
- 20261025-17: Fix: in Artica Proxy, When the monitoring service restarts the web-filtering file watcher, it now comes back under its own system unit.
- 20261025-17: Add: in Artica, The Migration tab of the routing engine has a new layout: a status banner telling what to do next, the migration cycle step by step, the engine, dates and path equivalence cards, six counters, and report tables filtered by result that now also list the kernel routes the engine takes over.
- 20261025-17: Add: in Artica, The Path test tab of the routing engine has a new layout: the verdict first, with the gateway group used, then the decision path step by step with the blocking step in red, a session history to run a test again, and a button to copy the diagnostic.
- 20261025-17: Add: in Artica, The Kernel state tab of the routing engine shows the suppress_prefixlength 0 option of the rules that send traffic to a gateway group.
- 20261025-17: Add: in Artica, Routes and policy rules of the routing engine can now use a gateway group: when the main gateway goes down or degrades beyond its thresholds, traffic moves to the backup tier on its own within seconds, connections translated through the lost link restart through the backup, and traffic comes back when the main gateway recovers.
- 20261025-17: Add: in Artica, The Measures tab of the routing engine has a new layout: tracked connections with their table usage, forwarded packets, cumulated volume and gateway states at a glance, NAT rules with the share of connections of each one, the interface traffic, and one card per gateway with its latency, loss and 24-hour history.
- 20261025-17: Add: in Artica, The Kernel state tab of the routing engine has a new layout: kernel figures at a glance, the last apply and the differences with the model side by side, rules, routes per table, NAT chains with their iptables lines, and the reverse path filter of each interface.
- 20261025-17: Add: in Artica, The Forwarding tab of the routing engine has a new layout: forwarded packets and tracked connections, one card per IP family showing whether the kernel follows the saved choice, the reverse path filter as four choices, and the filter the kernel applies on each interface.
- 20261025-17: Fix: in Artica, The Network traffic page is now fully translated, and on a server with less than 2500 MB of memory it explains why its statistics are turned off instead of showing empty tabs.
- 20261025-17: Fix: in Artica, A server with less than 2500 MB of memory no longer runs the display-only statistics (network traffic, disk I/O, proxy Kerberos authentication, automatic disk usage scan), so that its memory stays available to the services and the console.
- 20261025-17: Add: in Artica, The System information page warns that a server with less than 2500 MB of memory does not have all Artica features, and lists the ones turned off.
- 20261025-17: Add: in Artica, The assistant can tell when a server runs without its display-only features because it has less than 2500 MB of memory.
- 20261025-17: Add: in Artica, Gateway groups: each gateway is probed every second, marked up, degraded or down from latency and loss thresholds, with notifications and a 24-hour history shown in the routing Measures; the AI assistant can create and change these groups.
- 20261025-17: Fix: in Artica, The routing Measures no longer show an empty interface list as "no interface" when the interface counters cannot be read, and a gateway that loses most of its probes is no longer counted as available.
- 20261025-17: Fix: in Artica, A NAT rule of the routing engine that Artica cannot read is now listed in the Measures tab with its counters, instead of silently shifting its connections to the next rule.
- 20261025-17: Fix: in Artica, The routing tabs now rebuild themselves when the routing engine was switched from another tab or by another administrator, and the old routing tab keeps the Apply, Multipath and Refresh buttons.
- 20261025-17: Fix: in Artica, Form fields whose name matches their label (such as a "type" list) no longer clash with their label, so their drop-down list works and the right value is saved.
- 20261025-17: Fix: in Artica, The "New route" and "New NAT rule" windows of the routing engine no longer raise a script error, and their type list is read correctly when the form is saved.
- 20261025-17: Add: in Artica, The buttons and filters of every routing tab are now in the page header, next to a Refresh button.
- 20261025-17: Add: in Artica, The routing page has a new Measures tab, also available to the assistant, with the traffic of each NAT rule, the tracked connections, the interface counters and the state of the gateways.
- 20261025-17: Fix: in Artica, A service whose process has died is now restarted under its own system unit instead of being launched outside it.
- 20261025-17: Fix: in Artica Proxy, The web-filtering file watcher now runs under its own system unit and is moved back there when it was started outside it.
- 20261025-17: Fix: in Artica, A routing rule that matches all traffic through 0.0.0.0/0 or ::/0 now needs the same confirmation as a rule without any criterion, so a blocking rule of this kind can no longer cut all traffic by mistake.
- 20261025-17: Fix: in Artica, On the routing page, enabling a rule that blocks all the traffic now asks for a confirmation, and IP forwarding that was never decided is shown as such with the kernel state instead of as disabled.
- 20261025-17: Add: in Artica, The Web console routing page manages the routing engine: tables, routes, rules, NAT, IP forwarding, kernel view, path finder and the migration from the previous routing.
- 20261025-17: Fix: in Artica, The previous routing pages no longer change the old routing configuration once the routing engine is active.
- 20261025-17: Fix: in Artica, Firewall "Forward to" and "Next hop" rules now really send the traffic they mark through their gateway: enabled rules of this kind that had no effect before take effect after this update, and a notification lists them at the first firewall rebuild.
- 20261025-17: Fix: in Artica, A transparent proxy port, NAT rule or firewall routing rule whose routing table would fall on a system or reserved table is now skipped instead of flushing the main routing table.
- 20261025-17: Fix: in Artica, A firewall "Forward to" rule whose mark is already used by another rule or by the transparent proxy is now refused and reported instead of diverting that traffic.
- 20261025-17: Fix: in Artica, Firewall mark routing rules now get their own priority, and cleaning them no longer removes the main routing table rule.
- 20261025-17: Fix: in Artica, Forced-gateway tables of virtual IP addresses no longer collide with each other and no longer empty the main routing table.
- 20261025-17: Fix: in Artica, Rebuilding the network now keeps the routing rules of other services: HaCluster, transparent proxy, load balancer, namespaces and virtual IP addresses.
- 20261025-17: Fix: in Artica, The Squid transparent proxy mark rule, which never worked and could pile up, is removed.
- 20261025-17: Fix: in Artica, The per-interface IP forwarding settings are now read correctly and no longer overwritten by the global switch, except forwarding off while the appliance is a gateway.
- 20261025-17: Fix: in Artica AI, The network reconfigure action of the assistant now rebuilds the routes as well.
- 20261025-17: Fix: in Artica, The routing pages of the console are now protected against SQL injection.
- 20261025-17: Fix: in Artica, Firewall next-hop rules no longer write into the tables of the routing engine.
- 20261025-17: Add: in Artica, Routing tables, routes, source and destination rules, NAT rules and gateway settings of the routing engine can now be created, changed and removed through the API: each change is applied to the system at once, put back if it fails, and can be undone for 24 hours.
- 20261025-17: Add: in Artica AI, The assistant can create, change and remove routing tables, routes, rules, NAT rules and gateway settings; every change except an empty table or a disabled NAT rule waits for a confirmation and is undone when nobody confirms it.
- 20261025-17: Fix: in Artica, Unit routes added or removed by the assistant now go through the new routing engine once it is active, instead of being written beside it.
- 20261025-17: Fix: in Artica, IP forwarding can again be turned off from the routing engine when no other service needs it.
- 20261025-17: Fix: in Artica, DNS servers set from the text console on tty1 are now saved in the Artica settings and kept after the next resolv.conf rebuild, and an error is shown when they cannot be applied.
- 20261025-17: Fix: in Artica, The text console on tty1 now reports errors returned by the system instead of always showing success, and tells that advanced routing is handled by the routing engine once it is active.
- 20261024-17: Fix: in Artica, The PHP engine of the web console is again reported as active by systemd: restarts from the command line, the system console or the init script now go through systemd, and a watchdog puts back under systemd an engine found running outside of it.
- 20261024-17: Add: in Artica, The Web Console menu of the system console has a new PHP entry that rebuilds the PHP configuration, restarts the PHP engine and checks that the extensions the web console needs are loaded.
- 20261024-17: Fix: in Artica, Starting the REST service from the command line no longer reports it as already running when it is stopped.
- 20261024-17: Fix: in Artica, After an update, the web console no longer refuses every login with "curl_init No such function available": reloading the PHP service no longer removes the curl, posix and ctype extensions from its configuration.
- 20261024-17: Fix: in Artica, Switching to the new routing engine no longer removes the firewall's mark-based routing (NAT to a node, transparent forwarding, marked routes).
- 20261024-17: Fix: in Artica, On appliances using systemd-networkd, the switch to the new routing engine now waits for the administrator's decision, and the network files are regenerated when switching and when going back.
- 20261024-17: Fix: in Artica, Once the new routing engine is active, firewall, virtual interface and virtual IP routing tables can no longer overwrite its tables.
- 20261024-17: Fix: in Artica, The new routing engine no longer turns IP forwarding off.
- 20261024-17: Fix: in Artica, The AI assistant now reads the routing engine migration when routes are taken over, and no longer reverts a good switch because of objects the engine deliberately leaves in place.
- 20261024-17: Add: in Artica, The new routing engine now applies its routes, policy rules, NAT and gateway settings to the system, and applies them again after a network or firewall rebuild.
- 20261024-17: Add: in Artica, The existing routing is now migrated automatically to the new routing engine when the result is equivalent, with a report of every change and a way back to the previous routing.
- 20261024-17: Fix: in Artica, Once the new routing engine is active, advanced routing routes are no longer placed in a table that no rule uses.
- 20261024-17: Fix: in Artica, Once the new routing engine is active, global routing rules are now applied in standard mode.
- 20261024-17: Fix: in Artica, Once the new routing engine is active, source routing rules keep their type, so blackhole and prohibit rules are now applied.
- 20261024-17: Fix: in Artica, Once the new routing engine is active, source routing rules no longer require the output interface as input interface, so traffic from the local network now matches them.
- 20261024-17: Fix: in Artica, Once the new routing engine is active, obsolete NAT policy rules are no longer created.
- 20261024-17: Fix: in Artica, Once the new routing engine is active, a 0.0.0.0 netmask is no longer read as /8.
- 20261024-17: Fix: in Artica, The old routing and firewall cleanup no longer delete the rules and tables of the new routing engine.
- 20261024-17: Fix: in Artica Proxy, Copies of rotated logs left behind by older versions in the log rotation working directory are now removed once their compressed archive is verified, instead of being kept for the whole retention period.
- 20261024-17: Add: in Artica, The AI assistant now reports memory pressure (verdict, stall time, swap activity and last cache purge) when asked about memory.
- 20261024-17: Add: in Artica, The system memory page has been redesigned: RAM usage over the last hour with average, peak and free reserve, RAM and swap gauges, a memory stall indicator read from the kernel, and one card per memory setting with a Purge now button.
- 20261024-17: Fix: in Artica, The shared memory limit (kernel.shmall) is now shown and edited as a number of pages instead of being displayed as bytes.
- 20261024-17: Fix: in Artica, The automatic cache purge threshold now only offers values from 20% to 95%, the range the system actually applies, instead of accepting lower values that were silently ignored.
- 20261024-17: Fix: in Artica, Changing the memory settings, zRam or the cache purge threshold now requires the system administrator privilege.
- 20261024-17: Fix: in Artica Proxy, The antivirus exclusions list uses the new table design, with type icons, sorting by date and pages, and its search no longer shows an unstyled table.
- 20261024-17: Add: in Artica, The AI assistant can now compute a dry-run report of the routing engine migration, switch to the new routing engine with a deferred confirmation, and go back to the previous routing; it never does it on its own.
- 20261024-17: Fix: in Artica, When the REST API service is started by another service or by an administrator, it now always runs under its own system service, even after a failed start at boot.
- 20261024-17: Fix: in Artica Proxy, The nightly Kerberos renewal no longer fails and raises a notification on proxies where Kerberos authentication was turned off but an old keytab remained.
- 20261024-17: Fix: in Artica Proxy, The proxy service monitor now has a working stop command; its start and stop commands were merged into one malformed line.
- 20261024-17: Fix: in Artica, The console session is now really closed after the inactivity delay when the page only pings the server, instead of failing with an error and staying open.
- 20261024-17: Fix: in Artica, The OpenLDAP version check no longer runs the directory server every 3 minutes on Debian 10, which filled the OpenLDAP log with "slapd stopped" lines.
- 20261024-17: Fix: in Artica, The rejected certificates list of the trust store shows the short name, the issuer with its country and the full rejection date instead of raw distinguished names and a time of day.
- 20261024-17: Fix: in Artica, The DNS Firewall is no longer started twice when the monitoring service tries to start it while it is being restarted.
- 20261024-17: Add: in Artica, The trusted certificates window has been redesigned: counters per tab, a search on name, issuer or country, an origin filter, the key type and expiry of each authority, and pagination.
- 20261024-17: Add: in Artica, The trust store in force on the system can be downloaded as a single PEM file from the trusted certificates window.
- 20261024-17: Fix: in Artica Proxy, The DNS servers check no longer reports "does not answer" for a server that replies but refuses the test query, such as the categorization server; a server Squid relies on that refuses to resolve is reported as refusing queries.
- 20261024-17: Fix: in Artica, Applying a cluster synchronization or new rules on the DNS Firewall now restarts dnsdist through its own system service, instead of leaving it attached to the Artica service and leaving a dead process behind at each synchronization.
- 20261024-17: Fix: in Artica, The DNS Firewall no longer triggers a false "not running" alert from the monitoring service right after each restart.
- 20261024-17: Add: in Artica Proxy, The SSL status page shows the signing authority tile in red with "Incompatible certificate" when the certificate loaded on a decrypting port is not a certificate authority, since browsers reject the certificates generated from it.
- 20261024-17: Add: in Artica Proxy, The SSL protocol status page has been redesigned with live indicators for the signing helpers, the generated certificates, the inspection state and the signing certificate expiry, and the main settings can be switched on or off directly from their card.
- 20261024-17: Add: in Artica Proxy, The SSL status now reports the signing certificate loaded on each decrypting port (expiry, fingerprint, key type) and the disk usage of the generated certificates database, also visible to the AI assistant.
- 20261024-17: Fix: in Artica, Clearing the SSH keys of an account other than root can no longer be redirected to another file through a link, and the AI assistant no longer gives up undoing a key removal when the appliance cannot read its trash for a moment or when the key came back disabled.
- 20261024-17: Fix: in Artica, When an undo of the AI assistant fails for a passing reason, it keeps retrying until that change is undone, even if another change of the same operation was refused for good, and reports the refusal at the end.
- 20261024-17: Add: in Artica, The VPN client page now redraws each tunnel's traffic graph every 5 seconds with the live throughput.
- 20261024-17: Fix: in Artica, When the SSH server configuration is managed by hand, the AI assistant can still undo the disabling or removal of a key of an account other than root, and an undo the appliance refuses no longer blocks the rest of the rollback.
- 20261024-17: Add: in Artica, The AI assistant can add a pasted SSH public key, enable, disable or remove an authorized key after approval; disabling or removing a key must be confirmed in the Web console, otherwise it is undone.
- 20261024-17: Add: in Artica, The SSH server API can now add, enable, disable and remove an authorized key, refuses to remove the last key that still lets an administrator in, and can undo a removal for 24 hours.
- 20261024-17: Fix: in Artica, Disabling or removing the last SSH key of an account other than root now really removes it from that account's authorized_keys file, so the key can no longer be used to log in.
- 20261024-17: Add: in Artica, The AI assistant can read the routing tables, policy rules, NAT and gateway state of the appliance and resolve which way a packet goes.
- 20261024-17: Add: in Artica, The AI assistant can read the traffic of the VPN client connections: tunnel state, current, average and peak rates and volume over the requested period.
- 20261024-17: Add: in Artica, The VPN client page shows one card per connection with its state, tunnel address, remote gateway, account validity, current download and upload rates, volume and a two-hour traffic graph, with a search box and the number of connected and offline tunnels.
- 20261024-17: Fix: in Artica, The traffic of VPN client connections is now measured every minute (it was always recorded as zero) and these measurements are deleted together with the connection.
- 20261024-17: Add: in Artica Proxy, The AI assistant can read the SSL inspection state of the proxy: emergency mode, SSL ports, outgoing TLS policy, certificate database and trusted authorities.
- 20261024-17: Fix: in Artica, The routing rules table no longer stays empty when no routing rule has been created in Artica: it now also lists the routing rules loaded in the system, with the routes of each table.
- 20261024-17: Fix: in Artica, The traffic mirroring of a network interface now refuses a probe address that is not on a directly connected network, which made the copies reach their real recipients a second time.
- 20261024-17: Add: in Artica, The Mirror tab of a network interface shows whether the kernel applies the mirror, live counters and throughput of the copied traffic, and a probe reachability test.
- 20261024-17: Fix: in Artica, The Meta policies list and the virtual network cards page no longer fail with an internal error as soon as a policy or a card exists, so attaching a node to a policy refreshes the list correctly.
- 20261024-17: Fix: in Artica Proxy, An ACL rule created by the AI assistant and placed first no longer fails its verification when another rule is created at the same time: proxy ACL changes of the assistant now run one after the other.
- 20261024-17: Add: in Artica Proxy, The AI assistant can delete a proxy ACL rule together with its linked objects, keeping every object still used by another rule or object group.
- 20261024-17: Fix: in Artica, Deleting an IP alias now removes its address from the system at once; it used to stay active until the next network rebuild.
- 20261024-17: Fix: in Artica, Creating an IP alias now really checks that the address is not already used by another host of the network.
- 20261024-17: Add: in Artica, The IP aliases tab of a network interface now shows one card per alias with its address, prefix, gateway and broadcast address, whether the system carries it, an Activate button for an inactive alias, and a search and sort bar.
- 20261024-17: Fix: in Artica, Adding a multipath gateway to a network interface no longer removes the default route of the appliance when the interface metric is 0 or above 256.
- 20261024-17: Fix: in Artica, Multipath gateways defined for an interface that uses its own routing table are now really installed in that table.
- 20261024-17: Fix: in Artica, A multipath gateway can now be edited, its weight is checked (1 to 256) and a gateway outside the network of the interface is refused.
- 20261024-17: Add: in Artica, The Multipath tab of a network interface now shows one card per gateway with its weight, its real share of the connections, its latency and losses measured by ping, whether the kernel applies it, and an Apply button when the configuration is not applied.
- 20261024-17: Add: in Artica, The Features tab of a network interface now groups the hardware features by family (checksums, segmentation, GRO, VLAN, tunnels), explains each one, shows which ones the driver locks, and lets you filter them.
- 20261024-17: Add: in Artica Proxy, The AI assistant can now create a complete proxy access rule in one approved step (client addresses, web sites, allow or deny, first or last position), verified after compilation and fully reversible.
- 20261024-17: Fix: in Artica, The AI assistant no longer proposes non-existent "console" steps for a configuration change: it now looks up the actions really available before building its plan.
- 20261024-17: Fix: in Artica, When the API service is not yet available (for example just after the installation), the login page now shows a progress bar, checks the service at every 10% step and reloads by itself as soon as the service answers. While the web console is still loading its PHP components, it shows a waiting message instead of asking to restart the API service.
- 20261023-17: Fix: in Artica, At the end of the installation, the Artica partition labels of an older installation found on another disk are removed, so that only the new system can be started or repaired.
- 20261023-17: Fix: in Artica, The installer now warns when an NVMe disk is hidden by the Dell "RAID On" storage mode, and the boot menu no longer starts an older Artica installation left on another disk.
- 20261023-17: Add: in Artica, OpenVPN 2.7 is now built for Debian 12 and 13 with its own private libraries, so installing it can no longer replace system libraries used by other services such as PostgreSQL.
- 20261023-17: Fix: in Artica, The Apply buttons of several console pages, such as Address Rewriting, no longer report "This link has expired or was altered" after installing Service Pack 10.
- 20261023-17: Add: in Artica, The settings panel of a network interface is reorganized into four sections (general, advanced features, IP and routing, connectivity) and shows whether the stored address is the one the system runs.
- 20261023-17: Add: in Artica, The AI assistant can now switch the network offloads of an interface on or off (with approval, verified and reversible), and explains why the offloads of a card are off.
- 20261023-17: Add: in Artica, Network offloads (checksum, TSO, GSO, GRO) are now on by default on physical network cards for the best throughput, and can be switched off per interface from the interface settings.
- 20261023-17: Fix: in Artica, Saving the settings of a network interface no longer silently switches off its TCP/IP checksum offloading.
- 20261023-17: Fix: in Artica, A cluster member no longer fails to synchronize, nor loses part of its web filtering categories, when the master's category list contains a duplicate category key.
- 20261023-17: Fix: in Artica, Purging obsolete packages no longer reports success when packages are left behind: the progress bar now names what remains and why the purge stopped.
- 20261023-17: Add: in Artica, The Purge obsolete packages button now opens a window listing each package that will be removed, with its version and the reason it is obsolete, and shows why the previous purge did not remove everything.
- 20261023-17: Fix: in Artica, The network interface page now shows TCP/IP checksum offloading as always on for VMware vmxnet3 and virtio network cards instead of offering a switch that the system would not apply.
- 20261023-17: Add: in Artica, At startup, servers already installed on VMware vmxnet3 or virtio network cards switch their network offloads back on when an earlier configuration had turned them off.
- 20261023-17: Fix: in Artica, Applying the network configuration no longer disables TCP segmentation, scatter-gather and receive offloads on virtual network cards: they are now always switched on for VMware vmxnet3 and virtio cards and left to the driver on Hyper-V and Xen, which restores full network speed on virtual appliances.
- 20261023-17: Fix: in Artica, The Artica REST API service is no longer reported as failed when the system stops another process for lack of memory, and a service state left failed that way is repaired automatically.
- 20261023-17: Fix: in Artica Proxy, The category service started by Artica now runs in its own system unit or scope, so a memory kill of it no longer affects the Artica REST API service.
- 20261023-17: Fix: in Artica Proxy, A categories server now republishes its databases and its categories table to the proxies as soon as the web-filtering repository is enabled, instead of reporting the table as unavailable until a category is recompiled.
- 20261023-17: Add: in Artica DNS, The new DNS record dialog shows one tile per record type, with a short explanation of each type and a search box, instead of a drop-down list.
- 20261023-17: Fix: in Artica Proxy, The category service no longer rebuilds its table of category names for each request, which reduces its memory use.
- 20261023-17: Fix: in Artica, The DNS Firewall cache can no longer be sized beyond what the server memory can hold: all DNS caches together are kept under 70% of the RAM.
- 20261023-17: Fix: in Artica, Archived logs copied to another disk are now removed after the retention period counted from their archive date, not from the date of the copy.
- 20261023-17: Fix: in Artica, Archives left in the former backup directory are removed once an identical copy exists in the configured backup directory, which frees the system disk.
- 20261023-17: Fix: in Artica, A single failed system unit no longer makes Artica start every other service outside systemd.
- 20261023-17: Fix: in Artica Proxy, The PAC server started outside its system unit is now restarted under it automatically, so the unit no longer stays in the failed state.
- 20261023-17: Fix: in Artica, The DNS Firewall service no longer leaves defunct dnsdist processes behind each time dnsdist stops, and no longer keeps its console output in the Artica API memory.
- 20261023-17: Fix: in Artica, The left menu no longer keeps every visited entry highlighted in white: only the entry of the page currently displayed stays highlighted.
- 20261023-17: Fix: in Artica, Restarting a stopped Zabbix agent no longer reports a failure while the agent actually starts.
- 20261023-17: Fix: in Artica, Searching the Zabbix agent events no longer passes the search text to a system command, and lists the newest events first.
- 20261023-17: Add: in Artica, The AI assistant can read the last bulk categorization test and, after approval, run it again, export a personal category, and perform the emergency removal of ClamAV.
- 20261023-17: Fix: in Artica, Uploading ClamAV signatures as a zip file no longer needs the unzip command, installs the incremental databases (.cld) too, and fails clearly when the archive holds no signature.
- 20261023-17: Fix: in Artica, The emergency removal of ClamAV now purges only the packages actually installed and refuses to run while another package operation is in progress.
- 20261023-17: Fix: in Artica Web Filtering, Testing a list of websites against the categories is now done by the Artica daemon, accepts URLs and proxy log lines, and no longer builds its result page from unescaped site names.
- 20261023-17: Fix: in Artica Web Filtering, Exporting the websites of a category no longer goes through a system command.
- 20261023-17: Fix: in Artica, The DHCP configuration file is now shown read-only with its DDNS and OMAPI keys masked, and is no longer copied to a folder served by the web console.
- 20261023-17: Add: in Artica, The AI assistant can now search ten service logs and see which parent-proxy rules are applied, and, after approval, apply the AppArmor boot setting and the TFTP server settings, test the FTP account of the console and export the event tables.
- 20261023-17: Fix: in Artica Proxy, The web filtering service no longer uses up to 1 GB of extra memory within a minute when it categorizes many IP addresses, which could make the system stop it or the DNS service on servers with 4 GB of memory.
- 20261023-17: Fix: in Artica Proxy, The IP addresses of Blizzard game servers are now categorized as Games; a typo in the first address range had disabled the whole list.
- 20261023-17: Fix: in Artica, The AppArmor protection switch of the System information page works again: it updates the boot loader instead of leaving its progress bar stuck.
- 20261023-17: Fix: in Artica, Searching the events of a service (Redis, SNMP, Rsync, ITCharter, Wazuh agent, web error page, mail filter, DNS backends, statistics retention, Active Directory API) no longer passes the search text to a system command, and lists the newest events first.
- 20261023-17: Fix: in Artica, Saving the TFTP server settings no longer reinstalls the service each time, and the server listens on all addresses when the chosen interface has none.
- 20261023-17: Fix: in Artica, Exporting a database table to CSV no longer requires the sqlite3 command to be installed.
- 20261023-17: Fix: in KasperskyTIP, The installation ISO no longer stores the root password in clear text; only its hash is written to the installer configuration.
- 20261023-17: Add: in Artica, The AI assistant can read the certificate of a Docker Store application and propose, for approval, the installation of a hardened Vaultwarden server.
- 20261023-17: Add: in Artica, The Docker Store can now install a ready-to-use Vaultwarden password server in one step: HTTPS certificate generated for your host name, public sign-up closed, administration page protected by a hashed token, optional mail server, and a certificate authority to download for the client devices.
- 20261022-17: Fix: in Artica, The Web console PHP engine now loads only the extensions the console uses (about 46 modules instead of 61, without FFI, XML-RPC or Phar), and no longer depends on the extensions enabled by the operating system packages.
- 20261022-17: Fix: in Artica, PHP extensions are no longer loaded twice by the Web console: duplicates are removed when the configuration is written, then checked against PHP itself and disabled if any remain.
- 20261022-17: Fix: in Artica, Two unused PHP-FPM pools with permissive settings were removed, and the PHP engine no longer writes memory dumps of its administrator processes or loads extensions at runtime.
- 20261022-17: Fix: in Artica, The root back-end of the console no longer ships about 1,000 unused request handlers and 35 unused scripts, reducing the code that runs with administrator privileges.
- 20261022-17: Add: in Artica Proxy, ACL objects listing user names go back to the native Squid user list when the installed proxy includes the Artica letter-case fix, and keep the pattern-based match on any other proxy version.
- 20261022-17: Fix: in Artica, Installing a system package from the console now reports a failure when the package could not be installed, instead of always ending with a success.
- 20261022-17: Fix: in Artica, The system checks that follow a Service Pack installation now run again; they called a file that did not exist.
- 20261022-17: Fix: in Artica, The Apply button of the web console no longer fails with "This link has expired or was altered" when several pages load at the same time, for example on the Address Rewriting page after a hotfix update.
- 20261022-17: Add: in Artica AI, The assistant can now check which disk the boot loader will be written to and warns when the next GRUB update could leave the server unable to start.
- 20261022-17: Add: in Artica, The appliance now warns when the boot loader is configured for the wrong disk, including on VMware, and apt displays a warning before a system update would leave the server unable to restart.
- 20261022-17: Add: in Artica, A watchdog now closes forgotten idle statistics database connections before the connection limit is reached, and names the program that opens too many of them.
- 20261022-17: Fix: in Artica, The statistics database now closes sessions left idle for 15 minutes and reports session states again, which lets idle connections be cleaned up automatically.
- 20261022-17: Fix: in Artica Proxy, Updating the proxy logging helper no longer leaves a moment where the helper is missing, which made a proxy reload fail during Artica updates.
- 20261022-17: Fix: in Artica Proxy, Blocking rules restricted to plain HTTP no longer make the new configuration be refused right after an Artica update.
- 20261022-17: Fix: in Artica, A reboot no longer leaves the Motorcomm YT6801 network card armed for Wake-on-LAN; wake-up stays enabled only after a power-off.
- 20261022-17: Fix: in Artica Proxy, ACL objects of type "Is Authenticated" now match any authenticated user instead of being checked as an Active Directory group of the same name, which matched nobody.
- 20261022-17: Add: in KasperskyTIP, Blocklists are saved to disk after each update and reloaded at startup, so the data port serves the last known lists immediately after a restart.
- 20261022-17: Add: in Artica SIEM, New DHCP pages show requests, leases and a dashboard, and the address sheet now lists the DHCP leases of an address.
- 20261022-17: Add: in Artica, On Debian 10, the System information page warns when PHP is exposed to PHP2Shell (CVE-2026-109618, CVE-2026-109619) and offers a button that installs the fixed PHP 7.3 from the Freexian Extended LTS repository, then restarts PHP.
- 20261022-17: Fix: in Artica, Two nodes that each declare the other as their cluster master no longer make Meta send a policy back and forth between them every three minutes; the policy is held and the editor explains why.
- 20261022-17: Add: in Artica, The delivery status of a Meta policy now lists the cluster slaves reached through their master and flags those whose master is not managed by Meta.
- 20261022-17: Add: in Artica, The AI assistant can now list Meta policies, check their delivery to each node and apply, attach or detach them with confirmation.
- 20261022-17: Add: in Artica, The Meta console can define virtual network cards and map each one to the real interface of every node, and the old per-group proxy page is replaced by the Policies page.
- 20261022-17: Add: in Artica, The Meta console has a policy editor: each proxy setting can be left to the node or defined by the policy, with the Artica default shown for reference, plus the general whitelist and blacklist, the targeted nodes and groups, and the delivery report of every node.
- 20261022-17: Add: in Artica, The Meta console now has a Policies page to create named sets of proxy settings and apply them to nodes and groups of nodes, with the update status of each policy.
- 20261022-17: Add: in Artica Proxy, The Certificate Center can now remove root authorities from the system trust store and refuse specific compromised certificates, and the change is replicated to every proxy of the cluster.
- 20261022-17: Add: in Artica, The AI assistant can read the system trust store and, with an administrator's approval, remove or restore trusted roots, add authorities, refuse a compromised certificate and apply the policy.
- 20261022-17: Fix: in Artica Meta, Opening the web console of a managed server through the Meta console no longer logs the administrator out of the Meta console.
- 20261022-17: Fix: in Artica Meta, Opening the web console of a managed Artica server through the Meta console no longer returns a 404 error on servers where the Artica AI remote terminal verifier is configured.
- 20261022-17: Add: in Artica, The network agent status page now shows the state of the tunnel to the Meta server when the agent is enrolled in reverse mode, and its status tiles all have the same height.
- 20261022-17: Fix: in Artica, A failed enrollment with the Meta server no longer keeps any data from the enrollment file on the agent, and an earlier unfinished enrollment no longer blocks a new enrollment file.
- 20261022-17: Fix: in Artica, Enrollment failures with the Meta server now show their real cause instead of always reporting a certificate error.
- 20261022-01: Fix: in Artica, Installing a hotfix no longer breaks the connection point used by agents to enroll with the Meta server, which made every enrollment fail with a 502 error.
- 20261022-01: Fix: in Artica, Enrolling an agent with a Meta server from the enrollment file no longer fails with a certificate error when "Allow self-signed certificates" is checked and the Meta server uses a publicly trusted certificate.
- 20261022-01: Fix: in Artica Proxy, A web-filtering category with no name no longer turns every official category into "Unknown" in the filtering rules.
- 20261022-01: Add: in Artica, The DNS records page shows whether each record is actually served by the DNS cache, its TTL, and can filter by record type.
- 20261022-01: Add: in Artica, The DNS cache can stop answering IPv6 (AAAA) records, for every domain or for a list of domains, without emptying the cache.
- 20261022-01: Add: in Artica, Each DNS firewall policy (RPZ) can limit the size and duration of its list download, so an oversized or slow source can no longer exhaust memory or stall the update.
- 20261022-01: Fix: in Artica, Adding an Active Directory DNS record no longer empties the DNS cache.
- 20261022-01: Fix: in Artica, Editing a local DNS record no longer rebuilds the DNS firewall zones, which could restart the DNS cache.
- 20261022-01: Fix: in Artica, Deleting one DNS record of a host no longer stops the DNS cache from answering the other records of that host.
- 20261022-01: Add: in Artica, The disk details now offer a "Format disk" button on a disk with no mounted partition: after a warning, it erases every partition and creates a single unmounted ext4 partition.
- 20261022-01: Fix: in Artica, The DHCP install button of the dashboard no longer fails with a "404 Not found" error.
- 20261022-01: Add: in Artica, On a physical server without smartmontools, the disk details and the SMART monitoring page offer an "Install SMART" button with an installation progress bar.
- 20261022-01: Fix: in Artica, The installer no longer offers disks smaller than 10 GB, which are too small to hold an Artica system.
- 20261022-01: Fix: in Artica, The installer now recognizes the internal SD modules of servers, such as the Dell Internal Dual SD, and offers them as installation disks instead of treating them as external USB keys.
- 20261022-01: Fix: in Artica, The cache rate and queries tiles of the DNS cache service show the real counters again instead of staying at 0.
- 20261022-01: Add: in Artica, The PostgreSQL status page now says when the database service is disabled and offers an "Enable PostgreSQL" button that enables and installs it.
- 20261022-01: Fix: in Artica, After the system clock is corrected backwards at boot, the scheduled maintenance tasks resume at once instead of stopping for as long as the correction.
- 20261022-01: Fix: in Artica, After the system clock is corrected backwards, the service status pages no longer show an outdated state for as long as the correction.
- 20261022-01: Fix: in Artica, A freshly installed DNS cache service answers on the network interfaces right away instead of listening on the loopback only.
- 20261022-01: Fix: in Artica, The DHCP configuration, leases and reservations pages no longer fail with an internal error when the PostgreSQL service is not running.
- 20261022-01: Fix: in Artica Reverse Proxy, The maintenance mode switch is back in the web services list (action menu of each website) and in the settings of each website.
- 20261022-01: Fix: in Artica Reverse Proxy, "Compile your rules" in the Web Application Firewall rules no longer fails with an error on appliances where GeoIP is enabled, so custom firewall rules are applied again.
- 20261022-01: Fix: in Artica Proxy, When the disk holding the system logs stops responding, the reverse-proxy service keeps running and only loses log lines instead of freezing until the disk recovers.
- 20261022-01: Fix: in Artica Proxy, The web application firewall audit index is no longer written to the system logs disk, so a stalled logs disk no longer stops the reverse-proxy from serving websites.
- 20261022-01: Add: in Artica AI, The assistant can read whether the Web console client-certificate authentication is enabled and really enforced, the state of the console certificate authority and which accounts hold a certificate.
- 20261022-01: Fix: in Artica, Web console client certificates are no longer stored in a public folder of the web server, and the password chosen for a certificate is no longer saved in the settings.
- 20261022-01: Fix: in Artica, The "Authenticate SSL Clients" option of the web console is now enforced by the web server: browsers without a client certificate issued by the console are refused before reaching the login page.
- 20261022-01: Fix: in Artica, The PHP configuration of the web console and of published PHP sites now applies the recommended mitigation for the PHP2Shell remote code execution flaws (CVE-2026-109618, CVE-2026-109619) until patched PHP versions are installed.
- 20261022-01: Fix: in Artica, Removing an OpenVPN client connection now also removes its watchdog entry, so the deleted tunnel is no longer restarted automatically.
- 20261022-01: Fix: in Artica, A load-balancer used as the DNS server of its proxy farm now answers DNS on its failover virtual IP, so member proxies no longer lose name resolution and Internet access when they point to that address.
- 20261022-01: Fix: in Artica, The installer now wipes old LVM volumes, RAID metadata and partition tables from the target disk before partitioning, so a disk that held a previous installation no longer stops the setup.
- 20261022-01: Fix: in Artica, The installer now removes the Artica labels left on other disks by an older installation, so the machine can no longer boot the old system after the first restart.
- 20261022-01: Add: in Artica, External USB disks are no longer offered anywhere during the installation, including manual partitioning and boot loader selection.
- 20261022-01: Fix: in Artica Proxy, Strict deny rules edited on the master of a proxy cluster are now replicated to the other members again; until now they stayed on the master.
- 20261022-01: Add: in Artica SIEM, The firewall events can now be searched by source MAC address, written in any common form and optionally followed by a destination port.
- 20261022-01: Fix: in Artica SIEM, Filtering firewall events by MAC address is now refused to accounts that are not allowed to see MAC addresses, which could otherwise check whether a hidden address was on the network.
- 20261022-01: Fix: in Artica Proxy, ACL objects listing user names now match a member whatever the letter case of the login, where Squid 6 and later only recognized logins written entirely in lowercase.
- 20261022-01: Fix: in Artica SIEM, Saving or deleting a firewall source now reports its errors in a translated error message instead of an untranslated line at the top of the form.
- 20261022-01: Fix: in Artica SIEM, The FortiGate menu entry and tab for firewall policies are now named Policies, like their page.
- 20261022-01: Add: in Artica Proxy, The Web-filtering categorization service now always recognizes sites hosted on Cloudflare Pages, Vercel, Wix Studio, GitHub Pages, Webflow, Netlify and Typedream as individual tenants when filing phishing reports.
- 20261022-01: Add: in Artica Proxy, The Web-filtering categorization service now imports the PhishDestroy blocklist into the Phishing category.
- 20261022-01: Fix: in Artica, The SIEM description in the product choice of the installation wizard is now short enough to fit inside its tile.
- 20261022-01: Add: in Artica, The AI assistant can now report how much traffic and how many sessions went through the FortiGate firewalls over a period, for one tenant if needed, and which machines and destinations account for most of it.
- 20261022-01: Add: in Artica SIEM, A new FortiGate General data page shows, per tenant and FortiGate over 15 minutes to 90 days, the data downloaded and uploaded and the number of sessions, next to the top clients, destinations and flows.
- 20261022-01: Add: in Artica SIEM, In every FortiGate chart legend, a client, destination or policy name now opens its details, on top of the window already open.
- 20261022-01: Fix: in Artica SIEM, A FortiGate client whose announced name is only a control character is now shown by its address instead of an unreadable symbol.
- 20261022-01: Add: in Artica SIEM, The event tables (firewall, proxy, web filtering, DNS and web server requests) now show the name of the machine that held the DHCP lease on an address at the time of the event, unless a local host name is already known.
- 20261022-01: Add: in Artica, DHCP requests, leases and reservations are now sent to the SIEM when the appliance serves DHCP and is connected to a SIEM.
- 20261022-01: Add: in Artica, The AI assistant can tell whether the DHCP events reach the SIEM and, after approval, turn them on or off.
- 20261022-01: Add: in Artica, The AI assistant can now tell where the traffic of the machines behind a FortiGate goes, which clients talk to a given destination, and when the biggest transfers happened.
- 20261022-01: Add: in Artica, The AI assistant can now tell which FortiGate policies let the most traffic through or refuse the most, and which clients cross a given policy.
- 20261022-01: Add: in Artica SIEM, A new FortiGate policies page shows the traffic, logs and denials of each firewall policy, Internet sources included, with the top policies, a searchable list and per policy its clients, destinations, largest flows and bandwidth over 1 hour to 21 days.
- 20261022-01: Add: in Artica SIEM, A new FortiGate destinations page shows what internal devices download from and upload to each destination, with the top destinations, a searchable list with trend lines and per destination its clients, largest flows and bandwidth.
- 20261022-01: Add: in Artica, The AI assistant can now show where an internal machine seen by a FortiGate sends and receives the most traffic, and when its biggest transfers happened.
- 20261022-01: Add: in Artica SIEM, Clicking a FortiGate client opens its details: top destinations, largest 10-minute flows, a bandwidth chart per 10 minutes and a searchable list of every destination with data received and sent, over 1 hour to 21 days.
- 20261022-01: Add: in Artica, The AI assistant can now tell when an internal machine seen by a FortiGate used the network, with its peak hours over the last week.
- 20261022-01: Add: in Artica SIEM, The FortiGate client list now shows a 24-hour trend line and a relative bar for received and sent data, the device type, the operating system and whether the device is active, with page navigation.
- 20261022-01: Add: in Artica SIEM, The FortiGate clients statistics now show large rings with the total received or sent in the centre, and each card opens the full ranking of the top 100 clients.
- 20261022-01: Add: in Artica SIEM, The FortiGate status view has a new layout with ranked bars, the share of each value and a link on every card to its full ranking.
- 20261022-01: Add: in Artica SIEM, The first-installation wizard can now set up a SIEM appliance: it downloads ClickHouse from the ArticaTech repository, then installs and enables the SIEM, with progress shown both in the wizard and in the SIEM feature section.
- 20261022-01: Fix: in Artica, Importing a p7r or p7b certificate answer no longer erases the private key of the request it completes, and a certificate that does not match that key is refused.
- 20261022-01: Fix: in Artica, Restoring a certificates database backup now replaces the certificates in a single safe step instead of overwriting the database file in use, and older backups restore correctly.
- 20261022-01: Fix: in Artica, The PFX password is no longer kept in the web session during a certificate import, and PFX, p7r and backup imports now report their result immediately.
- 20261022-01: Fix: in Artica, Generating a self-signed certificate from its settings now also records its validity dates and its PFX file.
- 20261022-01: Fix: in Artica Proxy, The listening-port certificate wizard now names the authority after the unit entered in the form and applies the new port settings without a full proxy restart.
- 20261022-01: Fix: in Artica, The default web-filtering certificate is no longer regenerated each time the setup wizard runs.
- 20261022-01: Add: in Artica, The AI assistant can now tell which internal machines a FortiGate sees, how much they download or upload, and when they were last seen.
- 20261022-01: Add: in Artica SIEM, A new Fortigate entry in the SIEM menu, shown only when FortiGate data is recorded, gathers the FortiGate status view and a FortiGate clients page with the top clients by data received and sent and a searchable client list filtered by tenant and FortiGate.
- 20261022-01: Add: in Artica SIEM, Each FortiGate client now records the tenant and the FortiGate that saw it, so identical internal addresses at two sites are no longer merged.
- 20261022-01: Add: in Artica SIEM, FortiGate traffic now builds an inventory of internal clients (MAC address, host name, operating system, address, bytes received and sent, last seen) with their traffic per destination in 10-minute slices; clients silent for more than three weeks are removed with their history.
- 20261022-01: Add: in Artica, The agent groups page can now show each group as a tile with its first agents, their state and version, and highlights groups with offline agents or alerts; a switch in the header returns to the table view.
- 20261022-01: Fix: in Artica, The help text about issuing one certificate for several hosts in the Let's Encrypt DNS request form is now translated.
- 20261022-01: Fix: in Artica, When the server cannot reach Let's Encrypt, certificate creation and renewal now stop immediately with a clear message saying that outbound traffic to Let's Encrypt is not open.
- 20261022-01: Fix: in Artica Proxy, The proxy auto-configuration (PAC) service now relays Let's Encrypt validation requests when it listens on port 80, so certificates can be issued and renewed on the same server.
- 20261022-01: Fix: in Artica, Let's Encrypt certificates are again issued and renewed on servers without the reverse-proxy web service: the validation is now answered directly on port 80 instead of waiting for a web server that is not running.
- 20261022-01: Add: in Artica, Monit 6 is now built automatically for Debian 12 and 13 from each new official release, with SSL, PAM and IPv6 support, ready to replace the older Debian package.
- 20261018-12: Add: in Artica, The settings of an existing firewall rule are now shown as a summary grouped by theme, and each setting is changed on its own in a small dialog.
- 20261018-12: Add: in Artica, The proxy and firewall objects page has been redesigned: filters by object type with counts, description of each object, on/off switches and the rules that use each object.
- 20261018-12: Add: in Artica, The firewall services page shows how many rules use each service, filters by protocol and status, and enables or disables a service with a switch.
- 20261018-12: Add: in Artica, The firewall rules page has been redesigned with a filter bar (search, interface, status), on/off switches, colour-coded directions and a count of the rules shown.
- 20261018-12: Fix: in Artica, The firewall rules list can be filtered by interface again, and moving a rule up or down now shows the new order immediately.
- 20261018-12: Fix: in Artica, The firewall rules page no longer fails to load when the firewall counters cannot be read.
- 20261018-12: Add: in Artica, The firewall services page uses the new table design, with a search box, the ports of each service shown as tags and its own address.
- 20261018-12: Fix: in Artica, The Suricata IDS service now reads and writes its settings through the Artica REST service instead of opening the cache database directly, so setting changes made in the Web Console are taken into account immediately.
- 20261018-12: Add: in Artica, The Suricata IDS package is now rebuilt automatically for Debian 12 and 13 whenever a new Suricata 8 release or a new Debian kernel is published, so its PF_RING driver always matches the latest kernel.
- 20261018-12: Fix: in Artica Proxy, The silent authentication page now shows accented chart labels and a capitalised time column.
- 20261018-12: Add: in Artica, The Artica Meta status dashboard has been redesigned: fleet health index, ring charts for the repository, agent and Debian versions and pending updates, and a live overview of the agents that need attention first.
- 20261018-12: Fix: in Artica Proxy, Silent authentication now presents users of the declared Active Directory domains without the domain prefix, so the user lists of the proxy rules match them as with NTLM and Kerberos.
- 20261018-12: Fix: in Artica Proxy, The silent authentication challenge now announces a valid NetBIOS computer name, as the NTLM specification requires.
- 20261018-12: Fix: in Artica Proxy, The authentication challenge now always returns a lightweight page, so browsers no longer drop the Windows sign-in handshake and show a login popup when user or Active Directory group rules are used.
- 20261018-12: Fix: in Artica, The GlusterFS storage pool now shows the real name of this node instead of "localhost".
- 20261018-12: Fix: in Artica, The last step of the GlusterFS volume creation wizard shows a clear summary and the full equivalent command, which was cut off on the right.
- 20261018-12: Fix: in Artica, When adding bricks to a GlusterFS volume, the proposed path is now on a dedicated disk not yet used by the volume instead of the system disk, and the help text explains that Use adds the disk to the list.
- 20261018-12: Fix: in Artica, The GlusterFS Status and Usage tabs no longer count the space of a volume deleted during the last hour.
- 20261018-12: Fix: in Artica, Disabling GlusterFS now asks for a clear confirmation listing what will be stopped, instead of a generic deletion message with an untranslated text.
- 20261018-12: Fix: in Artica, On an appliance with a single processor under load, the status of the services (uptime, running state) is no longer frozen on an old value.
- 20261018-12: Fix: in Artica, Active Directory LDAP connections now always use the recorded IP address of the domain controller instead of switching at random between its host name and its IP address.
- 20261018-12: Fix: in Artica Proxy, The Silent authentication page now shows the Active Directory groups of each recently identified user instead of an always empty column.
- 20261018-12: Fix: in Artica, Installing GlusterFS no longer needs access to a Debian package mirror: the GlusterFS package now carries the libraries it requires.
- 20261018-12: Fix: in Artica Proxy, HaCluster nodes no longer keep a replica of the IT charter database: they check and record the acceptances, and read the charters, directly on the load balancer, which ends the endless replication failures when the load balancer runs a newer database version.
- 20261018-12: Fix: in Artica Proxy, The web filtering service no longer opens a new connection to the IT charter database for every check: one connection is kept and reused, with bounded timeouts.
- 20261018-12: Fix: in Artica, A HaCluster failover master that starts while the backup node holds the floating IP address no longer records itself as the owner of that address.
- 20261018-12: Add: in Artica, The AI assistant can read the clock skew of the HaCluster nodes and, after approval, resynchronize a node on the load balancer.
- 20261018-12: Fix: in Artica Proxy, The HaCluster Windows console keeps showing the IT charter acceptances when the local socket of the charter database has disappeared, by reading the database on the loopback address instead.
- 20261018-12: Add: in Artica Proxy, The load balancer measures the clock of every cluster node and shows a yellow "Clock out of sync" label when it differs by 30 seconds or more, with a dialog to resynchronize the node from the web console or the Windows console.
- 20261018-12: Fix: in Artica Proxy, Cluster nodes without the chrony package now install it, so that they keep their clock synchronized on the load balancer instead of drifting until Kerberos fails.
- 20261018-12: Add: in Artica Proxy, Silent authentication identifies Windows users through NTLM without joining the domain and applies Active Directory group rules from the LDAP connection.
- 20261018-12: Fix: in Artica Proxy, A global blacklist holding both a domain and one of its subdomains no longer makes the proxy refuse every new configuration.
- 20261018-12: Fix: in Artica, Opening the GlusterFS Encryption tab after the Usage tab no longer leaves the Usage period selector, unstyled, in the page header: the Encryption tab now shows its own title, explanation and refresh button.
- 20261018-12: Fix: in Artica Proxy, After the Kerberos keytab is replaced, cluster nodes reload their authentication helpers, which kept the old key in memory and made browsers show a login popup.
- 20261018-12: Fix: in Artica, The GlusterFS mount wizard names its options in plain words (read-only, POSIX access control lists, do not record file access times) instead of showing the raw mount flags.
- 20261018-12: Fix: in Artica Proxy, The HaCluster status page now shows the address the load balancer really listens on: with failover it is the floating IP, flagged as such, instead of the configured interface that made clients aim at an address answering with a connection reset.
- 20261018-12: Add: in Artica Proxy, The HaCluster status page has a new design: four summary tiles, period selector, period totals that pick the chart to display, curve or raw view, CSV export, and a node table with state, weight share and last health check duration.
- 20261018-12: Add: in Artica, The AI assistant can read where the HaCluster load balancer really listens, to explain a connection reset on the proxy port.
- 20261018-12: Add: in Artica, The GlusterFS mount wizard gets the same design as the volume creation wizard: step indicator, source chosen between two cards showing which node serves the volume, live check of the mount point, backup servers and options as toggles, and a clearer summary.
- 20261018-12: Add: in Artica, The AI assistant can check the Kerberos authentication of a HaCluster again at once, on the operator's request and after approval, to confirm an Active Directory fix without waiting up to 10 minutes.
- 20261018-12: Add: in Artica Proxy, The HaCluster Windows console has a "Check now" button on its Kerberos alerts: the load balancer keytab and the nodes in alert are checked again at once, instead of up to 10 minutes after a fix.
- 20261018-12: Fix: in Artica Proxy, The HaCluster Windows console no longer gives up after 4 seconds when the load balancer takes longer to apply the distribution rules.
- 20261018-12: Add: in Artica, The bricks step of the GlusterFS volume creation wizard shows which host is this appliance and which are the pool peers, tags every line as local, peer or outside the pool, checks each brick path as you type, and gains a step indicator.
- 20261018-12: Fix: in Artica, When the Artica daemon answers that an item does not exist (for example a GlusterFS volume deleted meanwhile), the console now shows that reason instead of a misleading "404 Not found, did you use the correct version of the Web API service?" error.
- 20261018-12: Add: in Artica, Bricks are added to a GlusterFS volume through a list: pick a node of the pool and a directory, review the bricks grouped by replica set, delete any line, then send them in one go.
- 20261018-12: Add: in Artica, The GlusterFS Usage tab now shows its period selector and its explanation in the page header, leaving the whole tab to the gauges and charts.
- 20261018-12: Add: in Artica, The GlusterFS Encryption tab is now a dashboard: setup progress, management encryption, pool nodes, volumes and external clients in tiles that open their own dialogs, and the certificate authority and node certificate in a settings card.
- 20261018-12: Add: in Artica, The GlusterFS client networks allowed through the firewall are now managed in a table: add one address or network at a time and delete any row, instead of editing a free-text list.
- 20261018-12: Add: in Artica, The GlusterFS Status tab is now a dashboard: service, version, pool nodes, volumes, storage used and self-heal in separate tiles, plus a firewall tile showing the open ports and the nodes and networks allowed to reach them.
- 20261018-12: Fix: in Artica Proxy, The HaCluster menu now shows "Windows console" instead of an untranslated label.
- 20261018-12: Fix: in Artica Proxy, The HaCluster Windows console certificate page now says that a certificate can also take a node out of Active Directory emergency mode and read the IT charter acceptances.
- 20261018-12: Fix: in Artica Proxy, The "Source IP address" label is no longer misspelled.
- 20261018-12: Fix: in Artica Proxy, The HaCluster Windows console names the web console page that issues its certificates as it appears in the menu.
- 20261018-12: Fix: in Artica Proxy, A cluster load balancer no longer ends up running two load-balancing engines after a reboot, and an existing duplicate is stopped automatically.
- 20261018-12: Fix: in Artica Proxy, With load balancer failover, the proxies now use the floating address of the active load balancer for DNS, time and reports, instead of an address that disappears after a failover.
- 20261018-12: Fix: in Artica Proxy, IT charter acceptances and charters now survive a load balancer failover and its return, and enabling the IT charter now also reaches the backup load balancer.
- 20261018-12: Add: in Artica Proxy, The HaCluster Windows console shows an "ITCharter" menu while the cluster IT charter is enabled, listing which user accepted which charter and when, with a filter, in every language of the console.
- 20261018-12: Add: in Artica, The AI assistant can now summarize the firewall configuration export and import a firewall configuration exported by another appliance into a draft, always with an administrator approval and without applying anything until the draft is applied.
- 20261018-12: Add: in Artica, The firewall configuration can now be exported to a file and imported on another appliance: interfaces are matched by hand, object groups are recreated, and the imported configuration opens as a draft to preview before it is applied with confirmation.
- 20261018-12: Fix: in Artica Proxy, IT charters created on a cluster load balancer are now copied to the proxies and shown to users; before, the proxies never displayed them.
- 20261018-12: Fix: in Artica SMTP, Volume alerts now count an IPv6 client as its /84 network block, like the Postfix per-client limits, so a sender rotating its IPv6 addresses can no longer escape the alert.
- 20261018-12: Fix: in Artica SMTP, Volume alerts refuse an ignored network covering every address (/0), which would have silenced all alerts while the page showed them active.
- 20261018-12: Fix: in Artica Proxy, Searching the WAF threats or CrowdSec decisions for a partial IPv6 address such as "fd00" or "2a01" no longer fails with an error, and network searches like "10.0.0.0/8" or "fd00::/64" are validated before being used.
- 20261018-12: Fix: in Artica Proxy, IPv6 clients recorded by the WAF are no longer rescanned and reported as errors every three minutes.
- 20261018-12: Fix: in Artica, AbuseIPDB reputation now flags IPv6 clients too, instead of keeping only the first IPv6 address of the blacklist.
- 20261018-12: Fix: in Artica Proxy, The one-time IPv6 statistics conversion now stays fast on PostgreSQL versions older than 14, checks free disk space before rewriting a table, and waits for PostgreSQL when it is not started yet at boot.
- 20261018-12: Fix: in Artica Proxy, The nginx firewall watchdog now restores only the missing IPv6 blocking rule instead of rebuilding the whole firewall every ten minutes.
- 20261018-12: Fix: in Artica Proxy, Marking a bot as trusted and filling bot host names no longer scans the whole bots table for each address.
- 20261018-12: Fix: in Artica Proxy, Disabling the IT charter on a cluster load balancer now really removes it from the proxies, which re-enabled it by themselves a few seconds later, and stops the charter database on the load balancer.
- 20261018-12: Fix: in Artica, When the HaCluster failover master comes back online, it now takes the floating IP address back automatically even if its network was not ready at boot, without having to restart the failover service by hand.
- 20261018-12: Fix: in Artica, A GlusterFS mount that is slow to answer under heavy load is no longer restarted unless it stays unresponsive on two checks in a row.
- 20261018-12: Fix: in Artica, A GlusterFS node added while another node was disconnected now gains access to the encrypted volumes within minutes instead of up to an hour.
- 20261018-12: Fix: in Artica, Secondary text inside the light-coloured status widgets (failover state, floating IP address, cluster synchronisation details) is now displayed in a dark colour instead of white and is readable again.
- 20261018-12: Fix: in Artica Proxy, Visitors connecting over IPv6 now appear in the web statistics (Top IP, number of clients, countries and providers) with the same counters and geolocation as IPv4 visitors.
- 20261018-12: Fix: in Artica Proxy, Web Application Firewall reports are now recorded for IPv6 clients, and an audit file whose header cannot be read is kept in quarantine instead of being deleted.
- 20261018-12: Fix: in Artica Proxy, The "Deny access" button now really blocks an IPv6 address, and an IPv6 entry no longer prevents the IPv4 entries of the inbound block list from being applied.
- 20261018-12: Fix: in Artica Proxy, Access lists (stream access, WebDAV, directories) now accept a single IPv6 address.
- 20261018-12: Fix: in Artica Proxy, Searching for a full or partial IPv6 address now works in the Threats and CrowdSec pages.
- 20261018-12: Fix: in Artica Proxy, Bots seen from IPv6 addresses are now listed with their own address instead of being merged under 0.0.0.0.
- 20261018-12: Fix: in Artica Proxy, IPv4 /18 and /28 networks added to the inbound block list are now applied instead of being silently ignored.
- 20261018-12: Fix: in Artica Proxy, The Top IP counters no longer count a 10-minute window twice after a failed database insert.
- 20261018-12: Fix: in Artica Proxy, Enabling the central error page on a cluster load balancer now publishes the page immediately instead of up to ten minutes later, and refuses HTTPS without a certificate.
- 20261018-12: Fix: in Artica Proxy, Cluster proxies whose agent is older than 1.1.32 now also redirect blocked users to the load balancer's central error page.
- 20261018-12: Fix: in Artica Proxy, In a load-balancing cluster using the central error page, the web error page service of each proxy can no longer be disabled by a configuration replication or from the console, and it re-enables itself when the load balancer needs it.
- 20261018-12: Fix: in Artica Proxy, The web error page service no longer answers an internal error (500) on proxies where its page templates had never been generated.
- 20261018-12: Fix: in Artica Proxy, Blocked users of a load-balancing cluster are now redirected to the load balancer's central error page instead of each proxy's own page.
- 20261018-12: Fix: in Artica Proxy, Uninstalling the web error page service no longer leaves it running without supervision.
- 20261018-12: Fix: in Artica, A GlusterFS mount that has lost its connection to the volume is now remounted automatically within five minutes instead of staying broken.
- 20261018-12: Add: in Artica, GlusterFS now warns before the TLS certificates of the pool expire, and snapshots keep and restore the pool encryption material.
- 20261018-12: Add: in Artica, GlusterFS traffic can now be encrypted with TLS: a pool certificate authority is created on one node and imported on the others, management and data encryption are switched on from the console, and certificates can be issued for external clients.
- 20261018-12: Add: in Artica, Firewall changes can now be prepared in a draft, previewed (configuration changes, kernel rules added or removed, rules iptables would refuse) and then applied with confirmation or discarded in one step.
- 20261018-12: Fix: in Artica, Uninstalling a service on a system without systemd now also removes its boot links, and the leftover start script of the deprecated Tailon log viewer is removed.
- 20261018-12: Fix: in Artica, Service Pack rollback backups no longer pile up on the disk: only the three most recent rollback points of the current version are kept, checked every 4 hours.
- 20261018-12: Fix: in Artica, The capacity of a GlusterFS volume whose bricks have different sizes is now the size of its smallest copy, so fill alerts fire before the smaller disk is full.
- 20261018-12: Fix: in Artica, A GlusterFS brick that was replaced or removed no longer appears as offline in the usage view for an hour.
- 20261018-12: Fix: in Artica, Installing GlusterFS on Debian 13 no longer fails with "missing libraries": the libaio and liburing libraries required by the storage bricks are now installed automatically.
- 20261018-12: Add: in Artica AI, The assistant checks the Kerberos keytab of the HaCluster load balancer first and gives the right steps to rebuild a keytab that does not match the account of the service name.
- 20261018-12: Add: in Artica Proxy, The HaCluster Windows console shows the Kerberos state of the cluster keytab held by the load balancer, and explains how to rebuild it when it does not match the account of the service name.
- 20261018-12: Add: in Artica Proxy, The HaCluster load balancer now checks its own Kerberos keytab, the only one of the cluster, and shows a red alert on its Kerberos page and above the node list when browsers cannot use it.
- 20261018-12: Fix: in Artica Proxy, The Kerberos alert no longer suggests moving the service name between accounts: it explains that the keytab does not match the account owning the name and gives the commands to rebuild it on the load balancer.
- 20261018-12: Add: in Artica AI, The assistant can check the Kerberos service name of a proxy, read the Kerberos state of each HaCluster node and, with approval, take a node out of the Active Directory emergency mode.
- 20261018-12: Fix: in Artica Proxy, The load balancer shows the current state of a node right after its report, instead of a state up to 10 minutes old (for example a node that has just left the Active Directory emergency mode).
- 20261018-12: Add: in Artica Proxy, The HaCluster Windows console shows a red Kerberos alert on a node whose service name cannot get a usable ticket, with the steps to fix it.
- 20261018-12: Add: in Artica Proxy, The Active Directory status page shows a red tile when the Kerberos service name of the proxy cannot get a usable ticket (name held by another account, not registered, or keytab rejected), with the steps to fix it.
- 20261018-12: Add: in Artica Proxy, Each HaCluster node now checks its Kerberos service name and reports a failure to the load balancer, which shows it on the node in the web console.
- 20261018-12: Fix: in Artica Proxy, A Kerberos ticket error logged by the proxy now triggers an immediate check that tells the administrator why single sign-on fails.
- 20261018-12: Add: in Artica SMTP, A new SMTP protocol hardening page protects against SMTP smuggling, using the strongest protection the installed Postfix release supports and the official workaround on older releases.
- 20261018-12: Add: in Artica SMTP, The SMTP protocol hardening page controls command pipelining: unauthorized pipelining is rejected and the PIPELINING and CHUNKING extensions can be withdrawn from the EHLO reply.
- 20261018-12: Fix: in Artica, A RDS Proxy session pattern set to disconnect now really ends the session and shows the reason to the user, instead of only reporting it.
- 20261018-12: Add: in Artica Proxy, The HaCluster Windows console can take a node out of Active Directory emergency mode, after a confirmation explaining that its proxy currently lets everyone through without authentication.
- 20261018-12: Fix: in Artica Proxy, A Kerberos helper that reads the keytab while it is being rewritten no longer switches the proxy into Active Directory emergency mode.
- 20261018-12: Fix: in Artica Proxy, The Active Directory emergency mode caused by an unreadable keytab is now lifted automatically once the keytab is valid again.
- 20261018-12: Fix: in Artica Proxy, In an HaCluster, the nodes no longer alternate every three minutes between two different Kerberos keytabs, which reloaded the proxy twenty times per hour.
- 20261018-12: Fix: in Artica Proxy, The Active Directory emergency state of the cluster master is no longer replicated to the other proxies.
- 20261018-12: Add: in Artica Proxy, A node in Active Directory emergency mode can now be returned to normal authentication from the HaCluster nodes page.
- 20261018-12: Add: in Artica SMTP, A new Per-client limits page caps how many connections, messages and recipients one client address may submit per minute, including hosts of the trusted networks.
- 20261018-12: Add: in Artica SMTP, A new Volume alerts page warns when one client address submits an unusual volume of mail and when a provider such as Microsoft 365 or Gmail starts rate-limiting the server.
- 20261018-12: Add: in Artica, Trusted networks can now be declared in IPv6 and are honoured by the IPv6 firewall rules.
- 20261018-12: Add: in Artica, Country-based firewall rules now also apply to IPv6 traffic when the GeoIP database provides IPv6 ranges.
- 20261018-12: Add: in Artica, The firewall packet tester now evaluates IPv6 packets.
- 20261018-12: Fix: in Artica, Adding an IPv6 trusted network in the console no longer stores an empty network address.
- 20261018-12: Add: in Artica, The Service Pack update now displays a percentage while checking file integrity, while installing files and while compressing the backup.
- 20261018-12: Fix: in Artica, A corrupted Service Pack is now rejected before any file is replaced, so the system is never left partially patched.
- 20261018-12: Add: in Artica Proxy, Web-filtering database downloads now resume where they stopped after a network cut, instead of starting over, which makes large categories such as Malwares update reliably on slow or unstable links.
- 20261018-12: Add: in Artica, The RDS Proxy pattern detection now reads window titles on Windows 10, Windows 11 and Windows Server 2016 and later.
- 20261018-12: Fix: in Artica Compilator, Stopping the build daemon during a kernel module rebuild no longer sends a false failure report, and the interrupted rebuild is retried as soon as the daemon restarts instead of a day later.
- 20261018-12: Add: in Artica, The firewall now filters IPv6 with the same rules and interface policies as IPv4; each rule can apply to IPv4, IPv6 or both, and IPv6 filtering is enabled on update once the administrator confirms it.
- 20261018-12: Fix: in Artica Proxy, The HaCluster source-IP distribution rules page now says that a rule name is already used instead of showing an internal error.
- 20261018-12: Fix: in Artica Proxy, The HaCluster source-IP distribution rules page can save a rule again when the list of nodes cannot be loaded and the node identifiers are typed by hand.
- 20261018-12: Add: in Artica Proxy, The HaCluster Windows console has a new Distribution menu to write, order, enable and apply the source-IP distribution rules of the load balancer, with a confirmation listing the rules before HAProxy reloads.
- 20261018-12: Fix: in Artica Proxy, Applying the source-IP distribution rules from the HaCluster Windows console reports whether the load balancer accepted the new configuration, and refuses rules targeting nodes that do not exist.
- 20261018-12: Add: in Artica Proxy, The node dialog of the HaCluster Windows console is split into a Proxy tab (traffic and service) and a System tab (CPU load, load average and memory of the node).
- 20261018-12: Add: in Artica Proxy, The node dialog of the HaCluster Windows console shows live charts of traffic, requests, CPU load, load average, memory and proxy clients, updated at each refresh.
- 20261018-12: Add: in Artica, Published servers (destination NAT) can now be reached from the internal network with their public address (NAT reflection), enabled by default and adjustable per publication.
- 20261018-12: Add: in Artica, Firewall objects can now hold host names, resolved every 5 minutes so that a rule follows the addresses of a partner's site or service.
- 20261018-12: Add: in Artica, The firewall rules list now shows when each rule was last used, and flags rules unused for 30 days or hidden by a rule placed above them.
- 20261018-12: Add: in Artica, The firewall can automatically ban, for a configurable time, sources outside trusted networks whose packets to the appliance are rejected too often, with a list of banned addresses and an unban button.
- 20261018-12: Add: in Artica Proxy, The HaCluster Windows console shows the proxy nodes as tiles; clicking a node opens a dialog with its traffic, cache, service times, resources and versions.
- 20261018-12: Add: in Artica Proxy, The HaCluster agent of each proxy node now sends to the load balancer, every minute, the proxy metrics already collected on the node, so the HaCluster Windows console can display them.
- 20261018-12: Add: in Artica Proxy, The HaCluster Windows console program and window now carry the Artica web console icon.
- 20261018-12: Add: in Artica Proxy, The HaCluster Windows console shows the nodes running in Active Directory emergency mode with the same red label as the web console.
- 20261018-12: Add: in Artica Proxy, The HaCluster Windows console has a new Settings menu that shows, read only, a summary of the general parameters of the load balancer.
- 20261018-12: Fix: in Artica Proxy, Node operations performed from the HaCluster Windows console are recorded in the administrators journal under the same conditions as every other administration operation, and name the certificate holder.
- 20261018-12: Fix: in Artica Proxy, The events journal of the HaCluster Windows console no longer overlaps the event code with the node name.
- 20261018-12: Add: in Artica Proxy, The HaCluster Windows console is now available in every language of the Artica web console: French, English, German, Spanish, Italian, Polish, Portuguese and Brazilian Portuguese.
- 20261018-12: Fix: in Artica Proxy, Empty rotated web-filtering log files are now purged automatically, instead of piling up by the hundreds of thousands in the log directory.
- 20261018-12: Fix: in Artica, A disabled Dynamic DNS agent no longer leaves the system monitor trying to start it every minute and a half.
- 20261018-12: Fix: in Artica Proxy, A leftover IDS monitoring rule from an earlier version is now removed when the IDS is disabled, instead of failing to start the IDS every minute and a half.
- 20261018-12: Fix: in Artica Proxy, Re-enabling a load-balancing node that was disabled now puts it back into service even when source-based routing rules still use it.
- 20261018-12: Fix: in Artica Proxy, A load-balancing node put back into service without restarting the load balancer is no longer reported down by its health checks until the next reload.
- 20261018-12: Fix: in Artica, The firewall events page no longer shows a wrong date (such as the 6th instead of the 16th) for firewall log lines written after the 9th of the month.
- 20261018-12: Fix: in Artica, Reloading or sharing the address of the firewall interface connectors page now opens that page instead of the network interfaces page.
- 20261018-12: Add: in Artica Proxy, A new "HaCluster Windows console" page issues certificates that let a Windows workstation supervise the load-balancing cluster in real time and drain, disable, take out of service or re-enable its nodes, and nothing else.
- 20261018-12: Add: in Artica, The firewall can reject and log traffic routed between interfaces when no connector allows it; published NAT services, replies and WireGuard tunnels stay allowed.
- 20261018-12: Add: in Artica, Firewall rules can carry a description and be grouped into collapsible sections.
- 20261015-17: Fix: in Artica, The HaCluster agent settings page no longer resets the emergency load threshold to 3 when "test every URL" is enabled, which made busy proxies leave the load-balancer every few minutes.
- 20261015-17: Add: in Artica, A GlusterFS brick can now be replaced from the volume details, for example after a disk failure: the new brick is picked among the server's disks, the volume keeps serving and the self-heal refills it from the other copies.
- 20261015-17: Fix: in Artica, The HaCluster load-balancer no longer crashes in a loop with HAProxy 3.4.5 and later: the TLS session cache workaround now applies to every affected HAProxy version, not only 3.4.4.
- 20261015-17: Fix: in Artica, Attaching or renewing the RDS Proxy certificate from the Certificate Center no longer disconnects the open RDP sessions.
- 20261015-17: Fix: in Artica, Removing the certificate chosen for the RDS Proxy now switches the gateway back to its self-signed certificate instead of keeping the previous one.
- 20261015-17: Fix: in Artica, The self-signed certificate of the RDS Proxy can now be loaded by the gateway, and the private keys of its certificates are no longer readable by other local users.
- 20261015-17: Fix: in Artica, Starting the Synology Active Backup agent now removes any snapshot kernel module left over from a previous agent version and rebuilds the module index, so after a Linux kernel update a backup no longer loads an incompatible module and crashes the server.
- 20261015-17: Fix: in Artica, The RDS Proxy TLS settings, certificate and session options now apply to the next connection as soon as they are saved, instead of waiting for the next service restart.
- 20261015-17: Add: in Artica, Each network interface linked to the firewall now has an outgoing default policy: with Finally deny all, only the connections accepted by outgoing rules can leave, while replies to established connections keep working.
- 20261015-17: Add: in Artica, A packet rejected by a Drop firewall rule is now logged with the name of the rule, so the firewall events page shows which rule blocked it instead of Default.
- 20261015-17: Add: in Artica, The firewall events page has a new Top tab listing the most active rules and the most rejected sources and ports over the last hour, 24 hours or 7 days.
- 20261015-17: Fix: in Artica, The source networks and excluded destinations of a masquerade entry are now applied and can be edited from the masquerade page; until now all the traffic of the interface was masqueraded.
- 20261015-17: Fix: in Artica, The packet counters of a firewall rule that logs its traffic no longer count each packet twice.
- 20261015-17: Add: in Artica, The GlusterFS status page now graphs the space used, the files waiting for self-heal and the connected clients of each volume over a day, a week and a month, and Artica warns when a volume or brick passes 85 % and 95 %, when a brick goes offline and when a self-heal stops progressing.
- 20261015-17: Fix: in Artica Proxy, The Web-filtering database update now shows the megabytes downloaded for large categories such as Malwares, its progress bar no longer stays at 90% for most of the update, and a download that stops receiving data is abandoned after two minutes instead of blocking the update for up to five hours.
- 20261015-17: Add: in Artica, A GlusterFS disk wizard lists the blank disks of this server, formats the chosen one in XFS with a single partition, mounts it, creates its brick directory and opens the volume wizard with that brick.
- 20261015-17: Fix: in Artica, Appliances running a Gold license no longer send the post-installation welcome notification to Artica Tech, so they no longer send any license, statistics or contact data to Artica Tech.
- 20261015-17: Fix: in Artica, A new RDS Proxy target now defaults to the RDP protocol, and the default error messages shown to refused users are spelled correctly.
- 20261015-17: Fix: in Artica, Outgoing firewall rules are now applied; until now every new outgoing connection was accepted before reaching them, so an outgoing Drop or Log only rule was shown active but had no effect.
- 20261015-17: Fix: in Artica, The firewall events page now shows the packets rejected by the firewall and the events of Log only rules, right after an update, and ping events no longer display the ports of the previous event.
- 20261015-17: Fix: in Artica, The Anti-DDoS option of a network interface, the DNS amplification protection and the Mark packets firewall rules are applied again; private source networks are now only dropped on interfaces set to act as WAN.
- 20261015-17: Fix: in Artica, Source NAT entries and Route packets to a node NAT entries are applied again by the firewall.
- 20261015-17: Fix: in Artica, A masquerade entry used by firewall rules now only masquerades the traffic of these rules and respects their exceptions.
- 20261015-17: Fix: in Artica, Firewall rules using a service whose ports are defined by a variable are applied with the right ports, and a rule whose service has no port is no longer applied to all traffic.
- 20261015-17: Fix: in Artica, The options, published servers and time restriction tabs of a firewall rule open again, and the time restriction tab no longer accepts malformed input.
- 20261015-17: Fix: in Artica, The firewall menu no longer shows duplicate entries, its configuration entry is no longer labelled imapd.conf, and the NAT, objects and bandwidth pages no longer display PHP warnings.
- 20261015-17: Fix: in Artica, The firewall parameters page shows the date of the last configuration in a readable format, and the maximum size of the firewall events log is kept when saved.
- 20261015-17: Fix: in Artica, The RDS Proxy now applies the handshake timeout, inactivity disconnection, keep-alive, minimum client TLS version, client cipher suites, legacy TLS fallback, ignore-logon-password and disconnect-on-user-change settings of the web console; they were saved but never used.
- 20261015-17: Add: in Artica, The RDS Proxy settings now offer the interactive login screen option and the option to close refused connections without showing the error, and reject out-of-range timeout values instead of silently ignoring them.
- 20261015-17: Add: in Artica, The RDS Proxy events page has a new Access events tab listing refused connections and detected patterns with the reason, user, client address and policy, filterable by user and reason.
- 20261015-17: Fix: in Artica, The RDS Proxy patterns tab now warns that window-title detection only works on Windows 2008 and 2012 targets with the classic theme, not on Windows Server 2016 and later.
- 20261015-17: Fix: in Artica, Formatting a disk now refuses the system disk, a mounted disk and a disk in use by LVM or RAID before anything is erased, and preparing a GlusterFS disk only proceeds if the disk is still completely blank.
- 20261015-17: Add: in Artica, The GlusterFS volume wizard now lists the disks of this server: a mounted disk fills the brick path in one click, and a blank disk can be prepared for GlusterFS (formatted in XFS and mounted) from the wizard itself.
- 20261015-17: Fix: in Artica, A GlusterFS brick is no longer created on the system disk when the disk declared for it in /etc/fstab is not mounted: the request is refused with the mount point to fix.
- 20261015-17: Fix: in Artica, Formatting a new disk no longer reports a success when the file system could not be created, and a freshly partitioned disk is no longer formatted before the system has made its partition available.
- 20261015-17: Fix: in Artica, XFS disks can be mounted again on servers where the system optimization had disabled the XFS driver, as soon as GlusterFS is installed or an XFS disk is declared.
- 20261015-17: Add: in Artica, When the AI assistant proposes to open GlusterFS to a client network wider than /8, such as 0.0.0.0/0, the approval screen now warns that every address in it will reach GlusterFS.
- 20261015-17: Fix: in Artica, GlusterFS requests refused by GlusterFS itself (volume already existing, brick on the system partition, volume still started) now return a clear refusal instead of an internal error, and deleting a busy GlusterFS mount no longer removes it from the boot sequence.
- 20261015-17: Fix: in Artica Proxy, Installing the proxy no longer schedules a removed notification script to run every minute.
- 20261015-17: Add: in Artica, Each RDS Proxy policy can now allow or block the clipboard (each direction and files), drives (read and write), printers, smart cards, serial ports and sound.
- 20261014-02: Fix: in Artica Proxy, Clients connected to a port without authentication, a transparent port or a cluster port can no longer reach the services the appliance only exposes on its loopback address through the proxy.
- 20261014-02: Fix: in Artica, Saving a CognixSys rule can no longer crash the management service.
- 20261014-02: Fix: in Artica, Firewall services, bandwidth limits, published addresses and CognixSys rules are now checked before being saved and applied immediately, without an Apply or Compile button.
- 20261014-02: Fix: in Artica, A firewall service still used by a rule can no longer be deleted.
- 20261014-02: Fix: in Artica Proxy, Access rules that are not tied to a specific listening port apply again to every port, including ports without authentication, instead of being ignored since the update.
- 20261014-02: Fix: in Artica Proxy, Access rules restricted to the standard or transparent method, or placed in a rule folder bound to a port, are applied to the right port again instead of being ignored.
- 20261013-21: Add: in Artica, The RDP bastion can be connected to an Artica SIEM with its own certificate, renewed automatically, from the new RDS Proxy SIEM page, which can test the link before connecting.
- 20261013-21: Fix: in Artica, Messages held for a dangerous link are labelled as such in the mail quarantine, can be filtered, and show the dangerous domains in their details.
- 20261013-21: Fix: in Artica, The URL threat scan settings dialog shows the security categories heading at its place instead of above the first switch.
- 20261013-21: Fix: in Artica, NAT and masquerade rules are now checked before being saved and applied automatically, without an Apply button.
- 20261013-21: Fix: in Artica, A NAT rule or a masquerade still used by firewall rules can no longer be deleted, and changing the type of a NAT rule keeps its firewall rules attached.
- 20261013-21: Fix: in Artica, The destination of a local redirection NAT rule is displayed correctly in the firewall rules page.
- 20261013-21: Add: in Artica, The Postfix log explorer shows its search, status and instance filters in the page header.
- 20261013-21: Fix: in Artica, The Postfix log explorer no longer shows an untranslated label when the live feed is unavailable.
- 20261013-21: Add: in Artica, The URL threat scan status tab summarises the service health, its prerequisites, the cloud state and lost events, with a link to the log explorer.
- 20261013-21: Fix: in Artica, Firewall rules, their options, schedules, deep packet inspection protocols and services are now checked before being saved and are applied automatically, without an Apply button.
- 20261013-21: Fix: in Artica, Deleting a firewall rule no longer leaves its deep packet inspection entries behind.
- 20261013-21: Add: in Artica, Firewall rules can use the Log only and Return actions, and the rules page shows why a rule cannot be applied.
- 20261013-21: Add: in Artica, The URL threat scan statistics show their period and category filters in the page header, with summary cards and ranked tables.
- 20261013-21: Add: in Artica SIEM, The SIEM now receives and keeps for one year the access events of the RDP bastion (authentications, second-factor challenges, session openings and closings), searchable by user, address, target or session.
- 20261013-21: Add: in Artica, The URL threat scan parameters show today's activity, the cloud state and each setting as a readable card.
- 20261013-21: Fix: in Artica, Without a licence, the URL threat scan settings dialog shows a single switch that saves on click.
- 20261013-21: Fix: in Artica, Firewall rules with the Log or Return action, and rules attached to a masquerade, are now applied instead of being silently ignored.
- 20261013-21: Fix: in Artica, The firewall watchdog no longer rebuilds the whole firewall when a rule is refused by the kernel; the administrator is notified with the kernel error instead.
- 20261013-21: Add: in Artica, The firewall rules page shows whether changes are waiting, being applied or applied, and lists the rules refused by the kernel.
- 20261013-18: Fix: in Artica, RDS Proxy policies created with an older version of the console, whose session time was saved empty, are listed again instead of failing with a database error.
- 20261013-18: Add: in Artica, Every change to RDS Proxy members, targets, policies, their networks and time slots, the login page logo, session disconnections and recording deletions is now recorded in the administrators activity log.
- 20261013-18: Fix: in Artica, The periodic check of the local databases no longer releases the locks of the Artica service on them, which could let another program delete pending changes and make recently saved settings (such as RDS Proxy members) disappear.
- 20261013-18: Fix: in Artica, RDS Proxy members, targets and policies are now saved through the Artica service with full validation, so duplicate names and invalid networks or time slots are refused with a clear message instead of being silently ignored.
- 20261013-18: Fix: in Artica, Deleting an RDS Proxy policy, member or target now removes all of its links in a single operation.
- 20261013-18: Fix: in Artica, Several firewall pages of the web console no longer allow database or system command injection through crafted requests, and they now verify the firewall administrator privilege on the server side.
- 20261013-18: Fix: in Artica, Firewall rules that send traffic to another gateway (next hop) or to a transparent proxy use the configured port again instead of always falling back to 8080.
- 20261013-18: Fix: in Artica, Firewall rules defined for all interfaces are no longer copied into every NAT rule, and redirect NAT rules are accepted by the kernel firewall again.
- 20261013-18: Fix: in Artica, The trusted network is now accepted on the default firewall chain, and rules defined for all interfaces are no longer inserted twice.
- 20261013-18: Fix: in Artica, The firewall watchdog no longer rebuilds the whole firewall in a loop because of rules whose action cannot be applied (link balancing, log, return, masquerade rules); the administrator is notified instead, and simultaneous rebuilds are now serialized.
- 20261013-18: Fix: in Artica, Bandwidth limits changed in the traffic shaping page are applied and removed immediately again, including when an entry is deleted.
- 20261013-18: Fix: in Artica, Disabling an RDS Proxy policy now actually prevents the connections it allowed.
- 20261013-18: Add: in Artica, Each refused RDS Proxy connection now records the precise reason, such as a network or time slot not allowed by the policy.
- 20261013-18: Fix: in Artica, RDS Proxy targets now use NLA with NTLM by default, so connections to Windows servers no longer end with "CREDSSP Kerberos authentication failed, NTLM not allowed"; each target offers a Network Level Authentication choice: NTLM, Kerberos then NTLM, Kerberos only, or no NLA.
- 20261013-18: Add: in Artica, Links in incoming mail are now checked against the Artica cloud categories, short links are followed to their final site and random-looking domains are flagged; a message with a phishing, malware or spyware link is tagged or held in quarantine, and the domains and categories found appear in a new statistics page and in the daily report (Corporate license).
- 20261013-13: Fix: in Artica, Task progress bars now show the action being performed (restarting, installing, reconfiguring a service…) instead of a generic "Running" title.
- 20261013-13: Fix: in Artica Proxy, A cluster master no longer publishes a proxy configuration that the proxy itself refuses; the nodes keep the last valid package until the configuration is repaired.
- 20261013-13: Fix: in Artica Proxy, A cluster node now checks a received proxy configuration before keeping it and restores its previous configuration if the proxy refuses it, instead of losing its workers one by one and being unable to restart hours later.
- 20261013-13: Fix: in Artica Proxy, A proxy reload is no longer reported as successful when the automatic repair left a configuration the proxy still refuses, and a repaired configuration is now actually loaded.
- 20261013-13: Fix: in Artica, Phishing sites hosted on website builders such as weebly.com or godaddysites.com are now filed under Phishing, including when the platform carries several categories.
- 20261013-13: Fix: in Artica, Phishing sites hosted on shared platforms such as vercel.app, github.io or blogspot.com are now filed under Phishing instead of being skipped because the platform itself is already categorized.
- 20261013-13: Fix: in Artica, On the DNS servers page, the progress bar of a service restart is no longer erased by the automatic status refresh before the task ends.
- 20261013-13: Fix: in Artica, The quarantine report now tells users to click Release or Receive when it lists newsletters and notifications, matching the button shown on those messages.
- 20261013-13: Fix: in Artica, The mail quarantine list labels the source of held messages Anti-spam instead of Spam, so a held newsletter is no longer shown as spam.
- 20261013-13: Add: in Artica, Task progress bars now show a card with the task name, the current step, a large percentage and a clear success or failure state.
- 20261013-13: Fix: in Artica, The audit service no longer switches the whole appliance to single-user mode when the disk is nearly full: it now suspends audit logging and the appliance keeps running, and an audit service found stopped is started again automatically.
- 20261013-13: Fix: in Artica, A Service Pack refused during installation because one of its files is missing or corrupted now restores the files it had already replaced and removes its temporary copies, and the files left by an interrupted installation are cleaned up automatically.
- 20261013-13: Fix: in Artica, Old audit logs are now purged automatically, keeping only the two most recent archives, instead of accumulating in /var/log/audit until the disk is full.
- 20261013-13: Fix: in Artica, The RDS Proxy now reads its generated configuration, so users are no longer refused with "authentication service unavailable" at the login screen.
- 20261012-17: Add: in Artica, The Web console skin settings have a Reset button that, after confirmation, removes every design customization and restores the factory look.
- 20261012-17: Add: in Artica, The OpenLDAP API can now rename a group, list its members, change an account's primary group and delete a group while deleting or moving its accounts, never leaving an account without a primary group.
- 20261012-17: Fix: in Artica, The mail log tracker now recognises the classification lines written for messages screened by the Rspamd filter, so newsletter and notification counts and learned-correspondent bypasses are recorded instead of being mistaken for delivery attempts.
- 20261012-17: Add: in Artica Proxy, A web categories console certificate can now be issued without compilation rights: its holder feeds the categories and the scheduled task compiles them.
- 20261012-17: Add: in Artica Proxy, The Timeouts tab of the general settings now shows each value as a tile and opens the settings in a dialog when a tile is clicked.
- 20261012-17: Fix: in Artica, Durations of exactly one minute, hour or day are now translated instead of showing a raw placeholder.
- 20261012-17: Fix: in Artica, Clicking the edit icon on the right of a settings tile no longer opens the same dialog twice.
- 20261012-17: Add: in Artica, The mail quarantine can classify newsletters and automatic notifications as Infomail and deliver, tag or hold them per domain, with a dedicated section in the quarantine report.
- 20261012-17: Add: in Artica, The categories catalogue service can now tell when the next compilation of the web-filtering and DNS category databases is scheduled.
- 20261012-17: Add: in Artica, Every change made through the categories catalogue service (sites, categories, certificates, peers, licence, manual tasks) is now recorded in the administrators' activity log with the name carried by the client certificate.
- 20261012-17: Fix: in Artica, The statistics database (PostgreSQL) no longer stops for good one year after installation on hardened systems: its service account is no longer subject to password expiry, and an already expired account is repaired automatically.
- 20261012-17: Fix: in Artica, The daemon no longer freezes when the statistics database is down: connections through PgBouncer now give up after 5 seconds, so the automatic restart of PostgreSQL is no longer blocked.
- 20261012-17: Add: in Artica, The categories catalogue service now accepts the Windows categories console over its secure port, and an operator holding the AI privilege can manage the sites of the official categories from it.
- 20261012-17: Add: in Artica, The categories catalogue can issue a password-protected certificate bundle for the Windows categories console from the command line, the API or the Web console.
- 20261012-17: Add: in Artica Proxy, The global rules page shows each permanent authorization as a tile with its own switch, summary tiles, and category and text filters; a switch takes effect immediately.
¶ List of available Hot Fixes
Get the Hot Fixes here:
https://www.articatech.com/hotfixes.php?main=4.50.000000&sp=10
¶ Apply the HotFix
- On the left menu, click on “
Your System” > “Update” - Click on the button “Manual update” and upload the artica-4.50.000000.tgz downloaded file
- Click on the Artica tab
- You will find a “Current Hotfix" row with the applied version.
