Changelog
All notable changes to OxiPulse, most recent first.
July 23, 2026
Comprehensive Security Posture Suite: SSH Auditor, File Integrity Monitor (FIM), SUID Permission Auditor, Persistence Hunter, Process Sentinel, Firewall, and SSL/TLS Auditor.
- SSH Auditor module (`ssh_auditor.rs`): Audits sshd_config settings (PermitRootLogin, PasswordAuthentication, custom port, X11Forwarding, MaxAuthTries).
- File Integrity Monitor (`fim.rs`): Baseline SHA-256 integrity hashing for critical files (/etc/passwd, /etc/shadow, /etc/sudoers, /etc/hosts).
- Permission Auditor (`permission_auditor.rs`): Audits SUID/SGID binaries in temporary paths and world-writable configuration files in /etc.
- Persistence Hunter (`persistence_hunter.rs`): Scans system cron entries (/etc/crontab, /etc/cron.d) for unauthorized commands or external downloaders.
- Process Sentinel (`process_sentinel.rs`): Scans running processes for executions from /tmp and unlinked/deleted binary handles.
- Firewall Auditor (`firewall_auditor.rs`): Audits UFW status and default iptables ACCEPT policies.
- SSL/TLS Auditor (`ssl_auditor.rs`): Audits Let's Encrypt certificates and expiry dates.
- Enhanced security posture coverage and real-time detection capabilities across all 7 sensor modules.
July 21, 2026
Implement gRPC client communication to sb-agent / Nexus Agent via tonic and SecurityService.
- gRPC Client Output mode (`SbAgentOutput`) via tonic and `tunnel.proto` Protobuf definitions.
- Automatic finding streaming to Nexus Agent on port 4317 multiplexed into `TunnelEnvelope_SecurityEventPayload` envelopes.
- Enforced TLS 1.3 encrypted tunnel transmission for security event ingestion.
July 15, 2026
Fix TOML escape sequence bug on Windows operating systems.
- Normalized file path strings using forward slashes in `local_file_path` configuration parsing to prevent TOML escape character panics.
July 8, 2026
Implement Windows Service controller and fix installer path mismatches.
- Native Windows Service wrapper using the `windows-service` crate for silent execution under Windows Service Control Manager (SCM).
- Corrected binary installation directory path mismatches in `install.ps1` for Windows SCM registration.
July 2, 2026
Fix SecureString decoding in install.ps1 and update REST API endpoint.
- Fixed `SecureString` decoding in PowerShell installer script (`install.ps1`) by avoiding improper string type coercion.
June 25, 2026
Update direct REST API output endpoint path.
- Updated direct REST API output ingestion endpoint to `/agents/me/security-events`.
June 10, 2026
Fix cross-compilation build target issues.
- Disabled default OpenSSL features in `reqwest` and enabled `rustls-tls` for smooth cross-compilation across Linux and Windows targets.
May 15, 2026
Initial release of Ferro Sentry security agent and GitHub Actions release workflow.
- Core Event Engine with deduplication, severity scoring, and rate-limiting throttles.
- Port Scanner module (`port_scanner.rs`) for detecting listening interfaces and unauthenticated database exposures.
- Vulnerability Scanner module (`vuln_scanner.rs`) for SSH configuration checks and SUID permission auditing.
- GitHub Actions workflow for automated cross-compilation of Linux (x86_64, arm64) and Windows (x86_64) binaries.
OxiPulse project started