WatchZit 1.3.6 hardens the appliance and adds new automatic security tests.
Install or update: VM images (OVA, qcow2, VHDX, ISO) or install.sh — see the README. A running console offers the update under Settings → Updates and server; agents update themselves.
Security
- Appliance hardening (also applied to existing appliances by the update): SSH allows no TCP, agent or X11 forwarding, 3 password tries per connection and logs key fingerprints; kernel settings hide kernel addresses, turn off SysRq, restrict ptrace and BPF and ignore ICMP redirects; the unused network protocols DCCP, SCTP, RDS and TIPC are not loaded; PostgreSQL settings are no longer readable by every user.
- Fixed a data race on a remote collector's state when its connection ended, found by the new race-detector tests.
Tests
- Every change now also runs the whole test suite with the Go race detector and fuzzes every parser of untrusted input (watchzit:// links, enrollment codes, SSO state, SAML metadata, data source responses, allow-lists, web scenario steps). Release images are checked with Trivy, Lynis, testssl.sh and Nuclei. See SECURITY.md (github.com).
