EFA-NG NEXT-GEN SECURITY
🇺🇦
Головна Документація Завантаження та Репозиторії Форум підтримки ↗ Telegram Support ↗ GitHub ↗
Вхід Реєстрація

Журнал змін (Changelog)#

All notable changes to the EFA-NG (Email Filter Appliance - Next Generation) project will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[6.0.7] - 2026-10-30#

Додано#

  • MailWatch-NG Filter Builder: AND / OR Condition Logic & Match Mode Switcher:
  • Interactive logic selector (AND / OR) added to the Add Filter criteria row (filter-col-logic), remembering user selection across subsequent conditions.
  • One-click interactive AND (slate badge) / OR (amber badge) toggle chips displayed directly between active filter criteria.
  • Global match-mode switcher (Match: [ALL (AND)] [ANY (OR)]) enabling instant bulk switching between conjunctive (AND) and disjunctive (OR) filtering.
  • Grouped SQL clause isolation: user filter conditions are strictly encapsulated in AND ( cond1 OR cond2 ... ), eliminating operator precedence conflicts and guaranteeing full isolation for domain/user access restrictions ($_SESSION['global_filter']).
  • Enhanced human-readable filter history tracking: correctly formats multi-clause filter summaries (e.g. To contains "help" OR To contains "abuse").
  • Database schema & migration support: added logic column to saved_filters table in create.sql and upgrade.php with backward-compatible fallback for legacy databases.
  • Cache-Busting & Web Asset Optimization:
  • Added automatic filemtime timestamp versioning (style.css?v=<filemtime>) in functions.php to ensure client browsers immediately load fresh CSS without manual cache clearing.
  • Security & Package Updates:
  • Updated PHP 8.4 runtime packages to 8.4.27-2 addressing CVE-2026-109618 and CVE-2026-109619.
  • Fixed cron automated rule updates (sa-compile and phishing feed synchronization).
  • Regression Testing:
  • Added new integration test suite (tests/Integration/MWFilterLogicTest.php) verifying logic connectives, SQL grouping, toggle badges, switcher controls, and persistence across 11 test cases and 63 assertions.

    • [6.0.6] - 2026-08-30#

    Додано#

  • EFA-NG Server Migration & Backup Wizard (eFa-Migrate):
  • Full automated or selective live server migration over SSH from source to target.
  • Automated SSH keypair generation (ed25519) and copy-pasteable oneliner command for authorization on source servers.
  • Integrated into eFa-Configure interactive console under option 12) Backup & Server Migration Wizard.
  • Local pre-migration snapshot created automatically before applying changes (/var/eFa/backup/pre-migration-TIMESTAMP.tar.gz).
  • Configuration Audit & Parameter Diff Engine (eFa-Migrate-Audit.php):
  • Deep inspection of non-default and custom parameters across conf.php, MailScanner.conf, Postfix main.cf, and SpamAssassin local.cf.
  • Interactive checklists enabling administrators to review and selectively merge specific parameters into target configurations.
  • Safe parameter merging preserving target database credentials, socket paths, and host identities.
  • Ultra High-Performance Dashboard Optimizations:
  • Direct non-blocking UDP PTR DNS lookup (dash_fast_ptr_lookup) with strict 150ms timeout, eliminating 10-second freeze caused by unresponsive spammer reverse DNS.
  • Persistent 24h reverse DNS cache (temp/dash_dns_cache.json).
  • High-speed widget HTML server-side cache (temp/dash_cache/) with instant bypass on manual or scheduled refresh (&force=1).
  • Warm dashboard render time reduced from 10.6 seconds to less than 1 millisecond (~11,600x speedup).
  • Cold execution with live DB aggregation reduced from 10.6 seconds to 126 ms.
  • Batched daemon status check (systemctl is-active) reducing service polling latency from 100ms to 14ms.
  • UI Enhancements:
  • Square refresh buttons with zero side padding for both top bar and widget controls.
  • Equalized 28px height across all top bar action controls.

    • [6.0.5] - 2026-08-28#

    Додано#

  • Official Telegram Support Integration:
  • Integrated official support channel (https://t.me/EFA_NG) and project portal (https://efa-ng.space.ua) across all documentation, GitHub repositories, RPM specs, CLI console, and Web UI.
  • Added dedicated support badges and community links in README.md for both EFA-NG and MailWatch-NG.
  • Added direct Telegram Support link to login page, footer, and tools directory in MailWatch-NG.
  • Integrated Telegram support URL in SSH banner and initial setup wizard (eFa-Init).
  • Interactive Multi-Mode Console Architecture (eFa-Configure):
  • Modern Dashboard: Live host metrics, colored service status badges (● OK / ○ OFF), and 4 categorized ANSI box-drawing cards.
  • Classic Mode: Original 2-column menu layout preserved.
  • TUI Dialog Mode: Native Ncurses-style dialog using whiptail.
  • Dynamic Mode Switcher (M): Persistent mode configuration stored in /etc/eFa/eFa-Configure.conf.
  • Modernized System Update Workflow (13) Update System & Packages):
  • Integrated dnf --refresh check-update preview before prompting to apply updates.
  • Automated safe reload of web and mail services (php-fpm, httpd, postfix) after transaction completion.

    • Змінено#

  • Mathematical Border Alignment & Extended Hostname/IP Formatting:
  • Allocated dedicated full-width rows for Hostname and IP Addr supporting up to 58 printable characters.
  • Fully compatible with long enterprise FQDNs and dual-stack IPv4/IPv6 without border overflow or awkward truncation.
  • Strictly aligned right-hand columns (Load and Version) starting at column 48 with guaranteed 75-column terminal boundary.
  • TUI Whiptail Compatibility:
  • Removed non-standard UTF-8 symbols from TUI menu entries to ensure clean ncurses/dialog rendering.

    • Виправлено#

  • Terminal UI Border Shifts:
  • Fixed ANSI escape sequence byte calculations in bash printf by isolating color tokens inside fixed-width brackets.
  • Eliminated variable-width string overflows caused by multi-word uptime outputs.
  • Configuration Helper Scripts (lib-eFa-Configure):
  • Fixed inverted CIDR netmask validation logic in func_ipsettings.
  • Fixed unescaped comment breaking admin email configuration in func_mailsettings.
  • Updated legacy branding in func_apachesettings to [eFa-NG].
  • Non-Interactive Execution Safety:
  • Added clean EOF exit handling to pause() and read choice in eFa-Configure to prevent infinite loops in piped scripts or background automation.

    • ---

    [6.0.4] - 2026-08-26#

    Додано#

  • Vector Country Flags (SVG Pack):
  • Added 271 high-resolution SVG country flag icons in images/flags/.
  • Added format_country_flag($countryCode, $countryName) helper function in functions.php.
  • Integrated flag icons into Message Details relay hop table (detail.php), Top Relay Countries & AS/ASN widget (dashboard.inc.php), and GeoIP reports (graphgenerator.inc.php).
  • Brand Identity & Favicon Overhaul:
  • New high-contrast vector favicon featuring Ukrainian national colors (azure shield and golden security check).
  • Modernized large main header logo matching UI theme button gradient (#1f6cb0).
  • Telegram Announcements Integration:
  • Automated dual-language (English + Ukrainian) release broadcasting via Telegram Bot to @EFA_NG Announcements topic (t.me/EFA_NG/3).
  • Secure credential isolation (.efa-telegram.env) preventing token leaks to Git.

    • Змінено#

  • KPI Summary Cards Single-Row Compact Layout:
  • Compacted all 6 KPI cards (Total, Clean, Spam, Threats, Queues, Health) into a streamlined single 6-column row with horizontal scroll support.
  • Search & Reports Sidebar Badges:
  • Right-aligned submenu count indicator badges and category pills alongside chevron accordions for improved visual hierarchy.

    • Виправлено#

  • Login & Auth Pages Logo Scaling:
  • Fixed logo image sizing and container bounds on login.php, password_reset.php, and auto-release.php to prevent 800px logo overflow.
  • TLS Certificate Multi-Domain SAN:
  • Expanded SSL/TLS certificate to cover both efa-test.ukrpack.net and efa-ng-test.ukrpack.net.

    • ---

    [6.0.3] - 2026-08-26#

    Додано#

  • Interactive Customizable Dashboard Engine (dashboard.php, dashboard.inc.php):
  • Full-featured, responsive 12-column widget dashboard grid with intuitive HTML5 drag-and-drop reordering.
  • Per-user dashboard layout customization saved directly to database (user_dashboards).
  • Dynamic widget sizing options (25%, 33%, 50%, 66%, 100% column widths).
  • Add Widget catalog modal supporting 11 dynamic widgets: KPI Overview, 24h Traffic Trends, Security Threat Donut, Top Relay Countries & AS/ASN, Top Senders & Recipients, Recent Intercepted Threats, Recent Processed Messages, Core System Services & Memory/Swap, Top SpamAssassin Rules, Quarantine Health, and Quick Admin Actions.
  • Dynamic auto-refresh with configurable intervals (Off, 30s, 60s, 120s, 300s, default 60s), live countdown indicator, smooth opacity fade transitions, and calm refresh animations.
  • Integrated default system dashboard with comprehensive monitoring.
  • strato-do/ip-geo Integration & Autonomous System (AS / ASN) Tracking:
  • Replaced legacy MaxMind GeoIP with modern open-source strato-do/ip-geo database providing countries, cities, and Autonomous System details.
  • Added clickable ASN badges linking directly to https://ipinfo.io/AS<number> across message details, reports, and top relay widgets.
  • Zero-credential 1-click database updates in geoip_update.php and automated CLI cron update_geoip.php.
  • Intelligent Threat Signature Formatting & Hover Tooltips:
  • Smart shortening of long virus strings (e.g. Virus (ClamAV (Eicar-Test-Signature / Win32.Trojan.Gen-8912)) shortened to Virus (Eicar-Test-Signature)).
  • Modern CSS hover popups displaying the complete scanner signature and engine report upon cursor hover.
  • Enhanced System Services & Memory Monitoring:
  • Added active Swap memory usage tracking and progress bars (used / total (pct%)) in System Health.
  • Clarified embedded MailScanner SpamAssassin engine status (● ACTIVE).

    • Виправлено#

  • Message Detail Navigation (detail.php): Fixed session token validation so direct GET navigation from dashboards and reports does not trigger false timeout logouts.
  • Message ID Validation: Expanded validateInput(..., 'msgid') in functions.php to accept modern MTA and Postfix long queue ID formats.
  • Relay Drilldown Filtering: Fixed rep_message_listing.php?relay=... drilldowns to match both clientip and message header IP records.

    • ---

    [6.0.2] - 2026-08-24#

    Додано#

  • Interactive Monthly Quarantine Calendar (quarantine.php):
  • Replaced legacy text date list with a modern interactive 7-day monthly calendar grid with month navigation (◀, Today, ▶).
  • Monthly KPI overview bar (Total Quarantined, Viruses, Spam, Policy/MCP).
  • Date cells featuring quarantine count badges (🔒 count ›) and categorized threat sub-tags (🦠, ⚡, 🛡️).
  • Seamless date drilldown displaying the full message operations table directly below the calendar.
  • Next-Gen Apache ECharts Integration:
  • Migrated charting engine to high-performance Apache ECharts with modern design inspired by ip.space.ua.
  • Dual Y-Axis architecture in js/lineConfig.js enabling simultaneous display of message counts (0..500) and traffic volume (0..100MB) without scale distortion.
  • Interactive crosshairs, formatted tooltips with human-readable byte conversion, and responsive auto-resize listeners.
  • Kit4Mail-Inspired Accordion Dropdown Reports Sidebar:
  • Multi-level dropdown navigation across all rep_*.php pages with category badges and animated chevron transitions.
  • Ultra-compact 36px Mini Rail with 100% distinct, unique icons for every category (🗂️, 📈, 🌐, 👥, 🛡️, 📜, 🔍, 🕒).
  • Hover-to-expand overlay mode when sidebar is minimized.
  • Table Column Sorting & Pager Enhancements:
  • Enabled click-to-sort column headers with directional arrows (▲, ▼, ↕), removing legacy A/D letters.
  • Resolved table DOM nesting issue in generatePager() and dbtable() to keep message tables cleanly inside the flex layout.

    • Виправлено#

  • Localization: Added missing English translation keys for reports categories, filter builders, and message operations.
  • Traffic Graph Container: Fixed height and responsive resizing for #trafficgraph in top header bar.

    • ---

    [6.0.0] - 2026-08-21#

    Додано#

  • CentOS Stream 10 & Enterprise Linux 10 Support: Full native support for the Enterprise Linux 10 ecosystem (CentOS Stream 10, RHEL 10, AlmaLinux 10, Rocky Linux 10) leveraging GCC 14, modern RPM 4.20, and Linux kernel 6.12+.
  • MailScanner 5.5.3-2: Upgraded multi-threaded scanning pipeline with high-throughput multi-engine processing and updated virus database autoupdaters (f-prot-6-autoupdate, kse-autoupdate, freshclam).
  • MailWatch-NG Fork (1.2.27-efa1): Deep integration of quarantine and management web console kit400/MailWatch-NG with native support for PHP 8.3, relay services (postfix_relay, milter_relay), greylisting management, and Perl integration modules.
  • SELinux Hardening (eFa10.te): Modernized security policy profile tailored for EL10 with strict confinement and dedicated capabilities for greylist_milter_t and httpd_sys_script_t.
  • Unified Web Portal & Community Forum: New community web portal running on PHP 8.3 with single sign-on (SSO), comprehensive documentation knowledge base, and integrated community support forum powered by Flarum.

    • Змінено#

  • Postfix LMDB Migration: Migrated all routing and lookup tables (transport, virtual, helo_access, sender_access, recipient_access, sender_canonical, recipient_canonical, aliases) and TLS session caches from deprecated Berkeley DB (hash:, btree:) to high-performance LMDB (lmdb:).
  • Session & Performance Tuning: Modernized session lifetimes across web management tools, optimized queue spools permissions (mtagroup), and refreshed systemd services (sqlgrey.service, msmilter.service).

    • ---

    [5.0.0-12] - 2026-08-19#

    Додано#

  • CentOS Stream 10 / EL10 Support: Full support for building and running on Enterprise Linux 10 with GCC 14, modern RPM 4.20, and Linux kernel 6.12+.
  • MailScanner 5.5.3-2: Upgraded MailScanner to the latest upstream release (5.5.3-2) with updated antivirus definitions autoupdaters (f-prot-6-autoupdate, kse-autoupdate).
  • MailWatch-NG Fork (1.2.27-efa1): Created dedicated fork repository kit400/MailWatch-NG natively incorporating all eFa branding, relay services (postfix_relay, milter_relay), Greylisting navigation, and Perl integration modules (MailWatchConf.pm), replacing brittle spec-level sed patches.
  • SELinux Module (eFa10.te): Created EL10 SELinux module tailored for modern distributions (removed obsolete ntpd_t, granted proper runtime directory permissions for greylist_milter_t and httpd_sys_script_t).

    • Змінено#

  • Postfix LMDB Migration: Switched all Postfix lookup tables (transport, virtual, helo_access, sender_access, recipient_access, sender_canonical, recipient_canonical, aliases) and TLS session caches from deprecated Berkeley DB (hash:, btree:) to high-performance lmdb:.
  • MailWatch & PHP Session Timeout: Configured global SESSION_TIMEOUT in MailWatch and PHP session parameters (session.gc_maxlifetime, session.cookie_lifetime) to 3 days (259,200 seconds) and removed the legacy 99,999-second upper bound.
  • Group & Spool Permissions: Added user postfix to mtagroup and set 0775 permissions on MailScanner queue spools (milterin, milterout, quarantine, incoming) to ensure reliable end-of-data milter transactions.
  • Systemd Unit Modernization:
  • sqlgrey.service: Configured User=sqlgrey, Group=sqlgrey, and RuntimeDirectory=sqlgrey so runtime PID files are managed and cleaned up without permission issues.
  • msmilter.service: Updated startup dependencies and permissions.

    • Виправлено#

  • eFaInit Web Wizard:
  • Netmask Validator: Added support for dotted-decimal netmasks (e.g. 255.255.255.224) alongside CIDR prefix lengths.
  • CLI Username Validator: Replaced brittle sudo cat /etc/passwd process spawning with native PHP user lookups and system account collision guards.
  • MariaDB Initialization (configuredo1): Made database creation, table migrations, and SQL user grants fully idempotent for MariaDB 10.11+.
  • Razor Registration (configuredo7): Added error handling and timeouts around razor-admin Cloudmark registration.
  • Cyrus SASL Configuration (configuredo12): Unified /etc/sasldb2 and /etc/sasl2/sasldb2 paths.
  • SSH Hostkey Generation: Removed obsolete DSA key generation for modern OpenSSH.

    • ---

    [5.0.0-11] - 2024-07-27#

    Виправлено#

  • Quoting for MailWatchConf.pm configuration.

    • [5.0.0-10] - 2024-07-26#

    Додано#

  • Cron task checkqueues for automated queue permissions recovery.

    • [5.0.0-9] - 2024-07-20#

    Виправлено#

  • Migration scripts to facilitate upgrades from eFa v4 appliances.

    • [5.0.0-8] - 2024-06-11#

    Виправлено#

  • MailWatchConf.pm configuration updates during system upgrades.

    • [5.0.0-7] - 2024-06-09#

    Змінено#

  • Updated MailWatch and improved MariaDB recovery procedures.

    • [5.0.0-6] - 2024-05-12#

    Додано#

  • Certbot dependency for automated SSL certificate management.
  • Enabled FreshClam antivirus database updater by default.

    • [5.0.0-5] - 2024-04-13#

    Виправлено#

  • OpenDKIM and OpenDMARC socket configurations.
  • Upgraded SpamAssassin to 4.0.1.

    • [5.0.0-4] - 2024-04-06#

    Змінено#

  • Updated MailScanner and MailWatch.
  • Switched network management stack to NetworkManager.
    • Попередній розділ RPM Репозиторій та Розробка