Introducing LiquidFiles v4.0
LiquidFiles v4.0 is a major LiquidFiles release with quite a few changes, most related to the change from CentOS 7 to Ubuntu 22.04 LTS.
New Operating System — Ubuntu 22.04 LTS
LiquidFiles v3.x used CentOS 7 as it's operating system. CentOS 7 is End of Life and End of Support in June, 2024 so a change was needed. We decided to move from the RedHat/CentOS family of Linux to Ubuntu for a few reasons. In short these included:
- RedHat moved CentOS from a stable, free alternative to RedHat to essentially an unstable, development version of RedHat.
- RedHat made changes to its licensing which causes a lot of concerns for the long term viability of alternatives such as Rocky Linux and Alma Linux that attempted to recreated what CentOS used to be.
- Ubuntu Server is a very stable Linux variant that is used and supported by many players, including being the reference Linux for FIPS certified OpenSSL modules.
- Ubuntu offers support for their LTS releases for 10 years.
- Ubuntu has better support for more auxilliary functions and libraries. With CentOS we used to maintain about 10 packages that wasn't distributed with CentOS. With Ubuntu the only package we maintain ourselves is Nginx and that's just because we have a couple of our own custom plugins for Nginx that's not publically available.
- Ubuntu has a Pro license which essentially turns the free version of Ubuntu server into a commercially supported version of Ubuntu server for those that wish to get official server support. Further, the Pro license will enable NIST-certified FIPS crypto-modules and other similar benefits.
So in a way, RedHat pushed us (and many others) away from their family of Linuxes and for us we landed on Ubuntu. So far we couldn't be happier.
General Changes
- Changed Duo Two-Factor Authentication to Universal Prompt. The previous Duo authentication method is also coming End of Life this year.
- Added Web Based Migration from another system, available during Getting Started.
- Added Web Based Restore from backup, available during Getting Started.
Security Related Changes
- Re-Architected the login session database structure. The actual sessions is now stored in
browser cookies meaning database sessions are not created until a user is logged in. This
increase performance. Further improvements include:
- Admin → System → User Sessions now holds all logged in sessions, and only logged in sessions. This means it's more transparent what goes on with logged in users.
- Admin → System → now lists when a users session will expire and why — it will highlight if a logged in user is using Remember me cookies, Session cookies or Secure Token sessions for external users.
- Admin → System → is also improved showing users location and system information in a better way.
- Previously it wasn't possible to manually expire an existing Remember Me cookie, now it is.
- Previously it wasn't possible to manually expire External Users, not it is.
- Added Permission Policy Header — securityheaders.com now gives a default LiquidFiles v4.0 system an A+ score.
- Added session limitations. By default users are permitted 2 active sessions and you can adjust between 1 and 3 sessions.