ulaknode changelog

Release history grouped from the itefix master release export.

Back to software index

Latest release summary

Latest release components

Output of ulaknode-version:

ulaknode 2.5.0

Components:
  postfix              3.10.13
  dovecot              2.4.4-5+debian13
  opendkim             2.11.0
  opendmarc            1.4.2-5
  spamassassin         4.0.1
  postgrey             1.37-2.1
  clamav               1.5.4
  openssl              3.5.6

Platform:
  os                   Debian GNU/Linux 13 (trixie)
  kernel               6.8.0-138-generic
  arch                 x86_64

Changelog history

2026-08-25 ulaknode 2.5.0

Changed

• ClamAV is now built from verified upstream source (1.5.4) instead of Debian’s packaged version, which lags behind on security fixes. Drop-in replacement — no config or volume changes needed.

Security

• Hardened clamd, freshclam, clamav-milter, spamass-milter, opendkim, and opendmarc to run with no Linux capabilities and no ability to gain new privileges, limiting the blast radius if any one of them is ever compromised. clamd and spamass-milter previously ran fully as root.
• Fixed a bug where a specially-crafted email address sent to ulaknode-agent could delete every mailbox on a domain. Email/domain validation is now stricter and values are properly escaped before use.
• ulaknode-agent now requires a shared-secret token (ULAKNODE_AGENT_TOKEN) on every request. Previously, any process able to reach it on the network could change mailbox passwords with no authentication at all. Opt-in feature, off by default; requires a matching update on ulaknode-web (1.3.0).

Fixed

• clamd could fail to start on a container’s very first boot, before any virus signatures had been downloaded yet.
• clamav-milter could fail to write its log file, and restarting it was unreliable.
• Restarting opendkim/opendmarc could leave the daemon running without a working socket.
• opendkim/opendmarc were not logging anything at all, including real errors, because their syslog output had nowhere to go in this container.

Config and scripts are baked into the image, so a plain image upgrade picks up everything above automatically — except the last item, which needs one manual step for existing deployments. See docs/upgrading.md .

2026-07-27 ulaknode 2.4.1

Fixed

• clamav-milter was not writing to its log file at all, even while actively rejecting infected mail. A plain image upgrade picks this up, no migration steps.

2026-07-27 ulaknode 2.4.0

• Fixed greylisting clobbering postgrey’s maintained sender whitelist with our near-empty one, greylisting all senders including Gmail/Microsoft 365/ESPs; whitelist files are now .local companions merged alongside the package’s. Existing deployments need a manual step, see docs/upgrading.md.
• Changed greylist delay from 300s to 60s.
• Changed whitelist_clients.local to seed exemptions for OTP-heavy ESPs (SES, SendGrid, Mailgun, SparkPost, Postmark, Microsoft 365, Mandrill, Mailchimp).

2026-07-27 ulaknode 2.3.1

• Fixed clamd’s default ConcurrentDatabaseReload roughly doubling peak RSS on freshclam reloads, tripping memory caps and getting clamd OOM-killed; reloads now happen in place.

2026-07-26 ulaknode 2.3.0

• Added ulaknode-agent SHOW <email> command to read a mailbox’s maildir/quota settings.

2026-07-18 ulaknode 2.2.0

• Added ulaknode-agent, a loopback TCP listener (via socat) so a sidecar web UI can drive ulaknode-mailbox passwd/quota-set without shared filesystem or exec access; opt-in, port 8787 by default.

2026-07-15 ulaknode 2.1.0

• Added Fail2ban as a supervised service, banning brute-force SMTP/IMAP clients at the Postfix/Dovecot layer instead of iptables; new ulaknode-ban script and ulak_fail2ban volume.
• Added DNSBL blocklist checking via postscreen, backed by a dedicated recursive resolver (Unbound) so Spamhaus doesn’t see it as an open/shared resolver; new ulak_unbound volume.
• Fixed master.cf missing the error/retry/showq services, which broke local delivery bounces and mailq/postqueue -p.
• Fixed ulaknode-service start/restart not cleaning up stale sockets for opendkim/opendmarc/spamass-milter/clamav/clamav-milter/fail2ban (“Address already in use”).
• Fixed ulaknode-service reload opendkim/opendmarc sending SIGHUP and sometimes failing to rebind, silently dropping DKIM/DMARC; reload now falls back to stop/start.
• Fixed the Fail2ban SMTP filter regex missing reject lines that log a hostname before the IP bracket.
• Fixed the ClamAV database volume sometimes losing clamav:clamav ownership, breaking freshclam.
• Fixed SpamAssassin’s skip_rbl_checks not covering URIBL_* DNS lookups; use_dns 0 now disables all of them.
• Documented that clamd needs ~3GB memory headroom to avoid OOM kills.

2026-07-09 ulaknode 2.0.1

• Removed RBL/DNSBL blocklist checking (reject_rbl_client, added in 2.0.0): Spamhaus flagged this deployment’s resolver as a shared/open resolver and returned its “open resolver” error to every query, which was indistinguishable from a real match and silently rejected all inbound mail. May return later via postscreen with a dedicated resolver, or a self-hosted list.
• Fixed opendkim failing to rebind its milter socket after docker stop/docker start (“Address already in use”); docker-init now clears known milter/AV sockets at boot.
• Fixed spamass-milter’s socket being created mode 755, causing Postfix “Permission denied”; scoped umask 007 to that command.
• Noted a stray Radicale-related Dovecot config block (not shipped by this image) that can prevent Dovecot from starting on existing volumes.

2026-07-09 ulaknode 2.0.0

• Breaking: replaced rspamd + Redis with OpenDKIM, OpenDMARC, policyd-spf, Postgrey, and SpamAssassin + spamass-milter. ClamAV now fronted directly by clamav-milter. Existing deployments need manual migration steps, see docs/upgrading.md.
• New persistent config volumes (ulak_opendkim, ulak_opendmarc, ulak_spamassassin, ulak_policyd_spf, ulak_postgrey) replacing ulak_rspamd.
• ulaknode-dkim rewritten for OpenDKIM’s KeyTable/SigningTable format.
• ulaknode-service/ulaknode-errlog updated for the new daemon set.
• Added ulaknode-service <action> all to act on every managed service at once.
• Fixed dovecot/opendkim/spamd status reporting bugs in ulaknode-service/ulaknode-version, and clamd status always showing STOPPED.

2026-05-25 ulaknode 1.2.1

• ulaknode-service: reload option
• ulkanode-service: fix rspamd restart option

2026-05-23 ulaknode 1.2.0

• dovecot 2.4.4-5+debian13
• redis 8.6.3
• openssl 3.5.6

2026-05-01 ulaknode 1.1.0

• rspamd 4.0.1
• redis 8.6.2
• remove license logic (not in use)
• handle version via environment
• remove fail2ban support in ulaknode-errlog (external now)

2024-07-04 ulaknode 1.0.0

• Initial version

Output of ulaknode-version:

Components:
  postfix              3.10.5
  dovecot              2.4.1-4
  rspamd               3.12.1
  redis                8.0.2
  clamav               1.4.3
  openssl              3.5.5

Platform:
  os                   Debian GNU/Linux 13 (trixie)
  kernel               6.8.0-107-generic
  arch                 x86_64