Skip to main content
Enterprise Annual License: pay for 10 months, get 12.Claim the free months
HiTechCloudPanelDocumentation
Version: 4.1

4.0.1

Maintenance, Pure-Rust Migration & Security Milestone: Webmail and phpMyAdmin Single Sign-On (SSO), Cryptographic Release Signing, Core Hardening, Automated Accessibility Audits, and Submodule Synchronization.

HiTechCloud Panel 4.0.1 brings robust Single Sign-On (SSO) authentication across ports 2083 and 2087, full migration of legacy routes to our pure-Rust micro-engine, cryptographic signature verification for automated releases, comprehensive axe-core accessibility compliance across all UI themes, and full synchronization of all submodules.

1. Webmail & phpMyAdmin Single Sign-On (SSO) Hardening​

  • Port 2087 Administrator Webmail SSO: Implemented full cryptographic SSO link generation in hitechcloudadmin for both Roundcube (HMAC-SHA256 over "mailbox|expires|nonce") and MailFlow (/api/auth/panel-sso), eliminating unauthenticated redirect stubs and supporting both WEBMAIL_URL and ROUNDCUBE_URL.
  • Port 2083 Customer Webmail SSO: Multi-path discovery for Roundcube SSO secret (/etc/hitechcloud/native/roundcube/sso.secret, /etc/hitechcloud/roundcube/sso.secret, /etc/hitechcloud/mail/webmail-master.pass) with automatic whitespace trimming to ensure exact HMAC matching against PHP plugin verification.
  • Roundcube Plugin Action Registration: Registered plugin.hitechcloud_sso action in rcube_plugin::init to prevent Roundcube startup hook action errors.
  • Port 2087 Administrator phpMyAdmin SSO: Dynamic multi-path discovery of MySQL option files (/etc/hitechcloud/hitechcloud/mysql.cnf, /root/.my.cnf, /etc/mysql/my.cnf, /etc/my.cnf, /etc/mysql/debian.cnf) resolving missing option file errors on Ubuntu and Debian hosts; corrected protocol routing to plain HTTP port 8888 when SSL is not configured.
  • Port 2083 Customer phpMyAdmin SSO: Auto-detects user credentials across both my.cnf and hidden .my.cnf, provides administrative credential fallback for admin and root users, and routes through force_domain or server public IP to prevent browser loopback (127.0.0.1) connection failures.

2. Pure-Rust Panel Engine Migration (Wave B & nogo porting)​

  • Account Management: WebAuthn/passkeys, 2FA management, MCP token revocation, and session lifecycle.
  • Emails Engine: Autoresponders, forwarders, mail limits, DKIM/SPF/DMARC records, and webmail single sign-on.
  • Databases Engine: Export/import pipelines, phpMyAdmin ticket issuance, MySQL privilege grants, and database limit quotas.
  • Web & Runtime Engine: PHP version selector, PHP extensions management, WordPress detachment/staging, and background application tasks.
  • Infrastructure Routes: CSF/LFD firewall controls, dynamic DNS providers, SSL certificate provisioning, and FTP passive port ranges.
  • AI & MCP Services: Model Context Protocol (MCP) server endpoints, token revoking, and system prompt templates.

3. Cryptographic Release Signing & Integrity Verification​

  • Ed25519 Release Signing: All release packages and checksum files (SHA256SUMS.sig) are signed with release key e36116ab8dcff9ab.
  • Integrity Enforcement: hitechcloudcli update and installation scripts verify cryptographic signatures before extracting and running binaries.
  • Release Verification Gate: Dedicated CI gate enforcing passing signatures and artifact integrity prior to release publication.

4. Automated Accessibility Compliance (WCAG 2.1 AA)​

  • Axe-Core Audits in CI: Continuous integration checks customer and administrator pages in light and dark schemes across all themes.
  • Keyboard Navigation & Component Standardization: Mail log results table supports keyboard scrolling; actions menus migrated to design system dropdowns (ds-dropdown).
  • Dark Mode Contrast: Refined contrast ratios for cards, metrics, navigation items, and forms.

5. Security & System Hardening (§24 Review Fixes)​

  • Root I/O Protection: Hardened paths against customer symlink traversal.
  • Upload Safety & Body Limits: Streamed uploads and hardened proxy limits against SSRF.
  • Pure Rust CLI: Complete deprecation of legacy shell wrappers in favor of compiled hitechcloudcli.
  • WAF & Meet Services CI: Automated test coverage for hitechcloudwaf and hitechcloud-meet services.

6. Submodule & Architecture Parity​

  • Full Submodule Sync: Synchronized hitechcloudadmin (PRs #200-#206), hitechcloudcli (PRs #309-#314), hitechcloudmail, tests, translations, and all integrations to latest main.
  • CLI Replica: Synchronized hitechcloudpanel/hitechcloudcli-scripts with compiled CLI surface.
Previous
4.0.0
Next
4.0.2
Was this helpful?