# changelog

author: Support <support@atomicorp.com> - 3.2.17-36
changelog:
  - Add detection for exim log files
  - Bugfix #1433, Rule manager, correct complex rule editing condition


author: Support <support@atomicorp.com> - 3.2.18-37
changelog:
  - Revoke monitoring exim rejectlog
  - Bugfix #XXXX, Update for WAF rule manager
  - Retire 71000 dynamic waf rule range


author: Support <support@atomicorp.com> - 4.0.8-19
changelog:
  - Update Aum, Add new update servers
  - Feature Request #1637, Suppress firewall errors on systems that dont support them
  - Feature Request #1638, Suppress ip_set loading messages
  - Bugfix #1631 -  Permissions wrong on clamav signatures files
  - Bugfix #XXX, fix for validation behind proxy with no port
  - Bugfix #XXX, for validation behind proxy with no l/p


author: Support <support@atomicorp.com> - 4.0.9-20
changelog:
  - Add Roll Back Configuration system
  - Update, firewall, add cidr handling to local-service-acl
  - Update, firewall, add new plesk ka server IP
  - Update, ASL Web, Remove geoblock buttons for EU
  - Feature Request #1630, installation, Detect if we can not connect to mysql during install
  - Bugfix #1597, firewall, Handle CIDR and ip-ip ranges in local-services-acl
  - Bugfix #XXXX, ASL Web, fixes line break bug in rule enable/disable
  - Bugfix #XXXX, HIDS, correct repeat offender logic for x2 and x3 conditions
  - Bugfix #XXXX, Core, remove hardcoded database name "tortix" from setup
  - Bugfix #XXXX, Aum, force waf module building on cpanel during configuration step


author: Support <support@atomicorp.com> - 4.0.10-21
changelog:
  - Update, AUM, add randomizer to hourly update check event.
  - Update, firewall, add new atomicorp IP's to update policy
  - Update, firewall, add FW_ENABLE_IPV6 (default yes), this enables/disables ipv6 support in the kernel
  - Update, web_check,add checks for HonorCipherOrder, add vulnerability tests for new Ciphers and Protocol settings
  - Feature Request #1518, allow stronger mod_ssl configuration
  - Feature Request #1656,  add rpmbuild as aum dependency
  - Bugfix #1614,  SecResponseBodyLimitAction set to: Reject would always report Fixed
  - Bugfix #1664, suppress cmd_system ERROR: '/bin/echo 1 > /proc/sys/kernel/mod ules_disabled
  - Bugfix #1682, custom_ssh_port missing from config and config.template
  - Bugfix #XXXX, fixes return value in ASLRBC in web;  fixes blacklist_remove from cli/web;   adds /etc/rkhunter.conf to core perms tests


author: Support <support@atomicorp.com> - 4.0.13-27
changelog:
  - Added ip_set_hash_ip to forced module load
  - Updated low level portscan detection to automatically exclude localhost
  - Modified syn scan engine to ignore half open requests on loopback
  - Updated ASL to support new fuzzy malware detection engine
  - Bugfix #1826 - fixes file read error in ASL Web when cl_clientapi is 0 bytes
  - Bugfix #1827 - fixes permissions issues for non-admin ASL Web users
  - Bugfix #1828 - fixes formatting error in memory and swap meters in ASL Web
  - Bugfix #xxxx - fixes asl/aum cli error output formatting
  - Bugfix #xxxx - fixes local ip lists in ASL Web


author: Support <support@atomicorp.com> - 4.0.14-29
changelog:
  - Enhanced IPS reporting for CVE-2015-5477
  - Bugfix #1873 - Adds SSLProxyEngine setting to twaf config when end point requires SSL
  - Bugfix #1872 - Changing tlsserverciphers and tlsclientciphers permissions breaks qmail


author: Support <support@atomicorp.com> - 4.0.15-30
changelog:
  - Enabled Malware Genome Scanner by default
  - Added new option to apply blacklist to WAF, for systems that are incorrectly configured or behind a NAT firewall or incorrectly configured Proxy
  - Update AUM,  config.template handling expanded to both HIDS and WAF updates
  - Bugfix #xxxx, ASL Web, corrects ampersand handling in WAF_REDIRECT_URL setting in ASL WEb
  - Bugfix #xxxx, ASL Web, allows wildcards in malware-detection
  - Bugfix #xxxx, ASL Web, Fixes mishanlding of unquoted comments in firewall rules in ASL Web
  - Bugfix #xxxx, ASL Web, Fixes waf category rule mapping in ASL Web
  - Bugfix #xxxx, Uninstaller, Make uninstaller exit if n is selected in yum


author: Support <support@atomicorp.com> - 4.0.2-12
changelog:
  - Add reputation system
  - Add AUM channel support (-testing)
  - Add domain blocking tab to blocking window in ASL Web
  - Update, ASL Web, allows modification of default asl web user group
  - Update, ASL Web, Adds alert in web if invalid config settings detected
  - Feature Request #1304, ASL Web, makes unapplied updates vuln open a window with contents of updates_pending.log
  - Bugfix #XXX, firewall, load whitelist before RBLs
  - Bugfix #XXX, aum, fix condition where a null waf_engine_versin would be detected creating a condition where rules from un-allowed versions would be copied in on an -u event.


author: Support <support@atomicorp.com> - 4.0.3-13
changelog:
  - Add debian jessie detection to AUM
  - Update cpanel build events, add  rpmbuild dependency into templates
  - Update AUM, RULES_PATH support to the fixed vhost & global file creation (this is needed for planned apache 2.4 support)
  - Feature Request #1519, ASL Web, Add snat,dnat,masquerade,redirect handling to ASL Web firewall interface
  - Feature Request #1568, generate vhost php.ini files from master file (PSA_PHP_DOMAIN_POLICY)
  - Bugfix #1571, waf_check,  waf_check error on asl -s -f when MODSEC_ENABLED=no
  - Bugfix #1573, AUM, fix validate_asl Nothing from request condition
  - Bugfix #XXX, ASL Web, Fixes event detail viewing on blocked ips


author: Support <support@atomicorp.com> - 4.0.4-15
changelog:
  - Add suport for Plesk 12
  - Removed support for asl -u and asl -uf, this is now exclusively handled by aum
  - Update genera_checks, Add abrt to service disable configuration
  - Update database-setup, Add warning on skip-name-resolve
  - Update ASL web to handle long report names in menus
  - Update Firewall, Changed advanced port scan so it wont alarm on loopback
  - Update Firewall, add IP validation to blocklist event
  - Update asl_db_rotate, aslw_archive_tmp cleanup when db archiving is disabled
          - added force_archive option to db rotate
          - added force_clean option to db rotate
  - Update cpanel templates to detect if the module directory has been deleted
  - Feature Request #1576, add syslog & rsyslog to watchdog
  - Bugfix #1580, ASL Web, omits ASL-ACTIVE-RESPONSE from running.fw
  - Bugfix #XXX, ASL Web, fixes web display issue when rules are disabled/enabled from cli
  - Bugfix #XXX, ASL Web, fallback data on waf event detail to be full_log rather than [msg ..]
  - Bugfix #XXX, ASL Web, suppresses netstat error in web
  - Bugfix #XXX, ASL, Fixes ALLOW_escapeshellarg typo in config.template


author: Support <support@atomicorp.com> - 4.0.6-17
changelog:
  - Add Threat Intelligence Engine
  - Add ipset support to the ASL Firewall
  - Add Apache 2.4 support for cpanel
  - Update, ASL Web, Adds confirmation to geoblocking from report windows;
  - Update, ASL Web, Updates to reporting engine
  - Update, ASL Web, adds fallback to tld trigger; cleaned up mysql during web validate
  - Update, AUM, Add all blacklists to update event
  - Update, AUM, Add Timestamp checking to download event for files
  - Update, Core, Add TSA dir for dynamic data tracking to tortixd
  - Update, Firewall, Added in logic to prevent 127/localhost from ever being shunned to the active-response table
  - Update, Firewall, Changed active-response asl-firewall init script to use its own chain
  - Update, Firewall, Updates to Firewall Intrusion Protection System
  - Update, Firewall, Move whitelist to load before other firewall elements
  - Update, Firewall, IP's on the whitelist will always be excluded from the blacklist rules
  - Update, Firewall, Move service acl's ahead of blacklists
  - Update, Firewall, Move blacklist to load ahead of RBL lists
  - Update, Firewall, Added in logic to check for firewall comment support and to not use comments on systems that dont have the module loaded
  - Update, Firewall, Added in legacy ip tracking modules to asl-kernel startup script for really really old kernels
  - Update, FIM, Ignore /usr/src by default
  - Update, hids_check, add option to enable/disable tcpwrappers active response
  - Update, installer, Add logging to uninstaller
  - Update, mod_evasive, Add more MSN/Bing ranges to mod_Evasive
  - Update, mysql_check, Add detection for wait_timeout, skip-networking, skip-name-resolve
  - Update, psa_check, add support for new proftpd.d/ structure.
  - Update, psa_check, use the new plesk 12 API to manage ssl settings. Move TLS files under /etc/proftpd.d/ structure. Retire the proftpd-tls.conf file and the fixed includes used in proftpd.conf
  - Update, T-WAF, Add ACL support
  - Update, waf_check, add vulnerability checks for disabled rules by domain and globally
  - Feature Request #115, malware blacklist using ipset
  - Feature Request #900, add mod_qos support
  - Feature Request #1208, ASL Web: Add in firewall whitelisting
  - Feature Request #1532, use swap in ipsets to eliminate outage window caused by loading the
  - Feature Request #1570, Add in "this may make several minutes" warning to "Checking versions ... "
  - Feature Request #1589, Flush all firewall rules on uninstall of ASL
  - Bugfix #1594, fixes force mode when enabling a rule
  - Bugfix #1600, lint whitelist entries in asl-firewall
  - Bugfix #XXX, ASL Web, corrects check against archive tables when searching the last week
  - Bugfix #XXX, ASL Web, fixes bug in geo lookup in report windows
  - Bugfix #XXX, ASL Web, corrects handling of garbage results when fetching scan/aum log updates
  - Bugfix #XXX, ASL Web, fix parent tags in asl-web for non string types
  - Bugfix #XXX, Core, handling for 0 byte rules file
  - Bugfix #XXX, hids_check, fix ossec-execd check is still made if ACTIVE_RESPONSE is disabled
  - Bugfix #XXX, psa_check, Minor fix to exclude plesk 9 configs from plesk 12 and up
  - Bugfix #XXX, rblcheck, fix email reporting for rbl check subsystem
  - Bugfix #XXX, T-WAF, remove t-waf configs if waf is disabled


