rConfig V8 Pro release notes

These notes cover changes that affect how you install, upgrade or run rConfig V8 Pro. The full list for each version, including smaller fixes, is under Release Notes on the update page in rConfig (see How to update rConfig V8 Pro).

V8.4.1

V8.4.1 stops rConfig running anything as root. Horizon, the scheduler and the SNMP trap receiver now run as the web server user (apache on RHEL family systems, www-data on Ubuntu), Redis requires a password, and storage is no longer readable by other local users. Most of this happens during the deploy. The items below need an admin.

Action needed

Work through these once after upgrading. The After upgrading to V8.4.1 checklist has the commands in order.

1. The Vector agent install command has changed. Copy a new command from Vector Agents. The old curl … /vector/install.sh?bootstrap_token=… | sudo bash command no longer installs anything; it prints where to find the new one and exits 1. Agents already installed are not affected. Update any automation that runs the old command: install_command from the API now uses sudo. See Installer SHA256.

2. Recreate the xFTP containers, then lock down the folder. Containers created before V8.4.1 need a folder every local user can write to, so the folder stays open until they are replaced. Run sudo php artisan rconfig:xftp-toggle, stop each running service, then run it again and start it. Saved credentials are reused. Then run sudo php artisan rconfig:xftp-toggle --fix-permissions. rconfig:xftp-toggle now needs sudo. See Upgrading from an earlier version.

3. Check scripts used by script connections. Script connections now run as the web server user, not root. Scripts that need root-only files or commands must be given that access explicitly. See Which user runs your scripts?

4. Check Redis has a password, and match it on shared Redis. Redis now requires a password, set during the deploy, including on Vector servers. If the Redis Auth health check still fails, run rconfig:redis-secure as described in Secure Redis. If several rConfig nodes or other apps share one Redis, every one of them needs the same password in its .env, or it is locked out. See Redis shared with other nodes.

5. Lock down configs saved before the upgrade. New configs are saved 0440, but configs from earlier versions stay readable by every local user until you run sudo php artisan rconfig:set-config-permissions (try --dry-run first). See Storage permissions.

6. Stop hand-editing the Horizon Supervisor config. The deploy now writes it on every run, as a root-owned file with user= set to the web server user, and replaces any symlink or edited copy. Hand edits are lost on the next deploy. See Horizon Queue Manager.

7. Turn on the SNMP trap receiver on Ubuntu, if you use it. On Ubuntu, a receiver set up with the old .ini file never ran, so the upgrade installs the new service but leaves it off. Turn it on with sudo php artisan rconfig:snmp-trap-service install. See After upgrading.

8. PRO Docker: follow the new update steps. Check your MariaDB version before you pull the new image, and pin the database image to that major version or later, never lower. The database port is no longer published; uncomment the 127.0.0.1:3360:3306 line in the compose file if a host tool needs it. Migrations stay manual. See Updating.

What changed

• Nothing runs as root. Horizon, the scheduler and the SNMP trap receiver run as the web server user. The scheduler stays in the web user’s crontab, and the deploy removes any schedule:run line from root’s crontab. The deploy also stops Horizon before it changes any files and starts it again at the end. See Scheduler and worker processes.
• Root-owned Supervisor config. The Horizon Supervisor config is a regular file owned by root:root with mode 0644, never a symlink into the rConfig folder, so the web user cannot change what root loads.
• SNMP trap receiver under systemd. The receiver is now the systemd service rconfig-snmptrap, run by the web server user. It binds UDP 162 through CAP_NET_BIND_SERVICE, so it no longer needs root or a redirect to 1162. Check it with systemctl status rconfig-snmptrap and read its log with journalctl -u rconfig-snmptrap. It no longer appears in supervisorctl status, and the community string is no longer visible in ps. The upgrade moves an existing Supervisor receiver across. See SNMP Trap Receiver Service.
• Storage is private to the web user. New folders are 0750, files 0640 and saved device configs 0440. The deploy no longer runs chmod 755 on storage. See Storage permissions.
• New worker check. sudo php artisan rconfig:check-worker-user checks Horizon, the Supervisor config, the scheduler, root’s crontab and the SNMP trap receiver, and the deploy runs it as its last step. The dashboard shows a Worker Privilege alert, and System Optimization has a Security & privileges card with the same results. See Worker Privilege and rconfig:check-worker-user.
• Horizon log in storage/logs. Horizon writes storage/logs/horizon.log itself, as the web server user, and /etc/logrotate.d/rconfig-horizon rotates it at 50 MB, keeping 10 compressed copies. The old root-owned storage/horizon.log is no longer written. See Horizon log.
• xFTP folder locked down. The xFTP folder belongs to root and the shared group with gid 2000, mode 2770, and the containers write as uid and gid 2000. The web user reads uploads through the group, and the sweep skips symlinks. A root-owned Docker helper reads container status, so the web user no longer needs to be in the docker group.
• Legacy host TFTP deprecated. rconfig:tftp-server on no longer installs anything. Use the xFTP TFTP service instead. See Legacy host TFTP.
• Verified Vector agent installs. The new install command downloads a fixed installer, checks its SHA256 and only then runs it with sudo. The installer accepts only published agent releases, never downgrades an agent and keeps TLS certificate checks on. The bootstrap token is no longer part of a URL. The provisioning API adds installer_sha256 and installer_docs_url. See Automated Agent Deployment.
• Vector Hub install helper. rConfig manages Vector Hub through a root-owned helper, which the Vector deploy installs. To install it by hand, run sudo php artisan rconfig:vector-hub-install-helper, then restart Horizon. The Skip TLS verification install option is removed. See Install helper.
• PRO Docker hardened. Horizon, the scheduler and the web server’s workers run as www-data, and Redis runs as redis with a password generated on first start and saved as REDIS_PASSWORD in data/.env. data/storage and data/.env have no access for other users. Service output goes to docker compose logs app, and docker compose ps shows container health. The database port is not published by default, and MariaDB is pinned to a major version. The SNMP trap receiver is optional; xFTP and Vector Hub are not supported in Docker. See How the container runs.

Agents installed before V8.4.1

Agents installed with the old command were never checked against a published release. To check one, see Check an agent installed before V8.4.1.