BitNinja Linux Agent 3.17.12 Improves Server Stability

BitNinja Linux Agent 3.17.12 is now available on the Frequent and Beta update channels. This release ships with BitNinja WAF3 1.1.3 and BitNinja Policier 1.0.4, and it focuses on keeping server protection reliable: tighter IP filtering, more accurate mail-login detection, safer malware scanning and quarantine, and stricter limits on memory use.

Hosting providers need a security agent that protects busy servers without destabilizing them. This build closes gaps in blacklist enforcement, reduces false positives on mail servers, and makes sure a failed download, a network change, or a service outage cannot leave a site unprotected or take it offline.

Stronger IP filtering

IpFilter now validates downloaded IP list files before it replaces the local cache. A truncated or corrupt download can no longer leave the greylist unloaded or overwrite a good backup, so servers keep using a known-good list until a complete file is in place.

This release also fixes eBPF IP filtering so blacklisted IP addresses are blocked as intended. Together, these changes make list updates safer and keep deny-list enforcement consistent.

More accurate mail-login detection

SenseLog can now let several detectors watch the same log file. Postfix SASL login failures are therefore detected even when another detector is already watching that file, closing a gap that could hide brute-force attempts against mail authentication.

The module also counts a log event only once when the same line is written to more than one log file, so a single failed login is not treated as multiple incidents. Aborted or unauthenticated Dovecot disconnects are no longer treated as failed logins, which reduces false positives on mail servers where clients drop the connection before authenticating.

More reliable WAF3 protection

The release includes WAF3 1.1.3. The web application firewall now restores the transparent-proxy routing policy after the host reconfigures its network, so proxied requests no longer time out in that situation. If the WAF3 service is down, the transparent proxy is not enabled, which keeps sites reachable instead of sending traffic into a proxy that cannot serve it.

WAF3 1.1.3 also pins its Coraza and Caddy dependencies to prevent memory exhaustion and reload hangs, and it adds a systemd memory limit so the firewall stays within predictable resource bounds on shared hosting servers.

CaptchaHttp memory safety

CaptchaHttp now bounds its TLS fingerprint session cache and avoids rewriting cache files on every request. The change prevents out-of-memory crashes when the cache grew without a cap or was rewritten too often under load.

Smarter malware detection and quarantine

The scanner no longer creates signatures for files that contain no PHP code, avoiding unnecessary work on content that cannot match those signatures. Cached malware verdicts are reused for unchanged files, and those files can be quarantined directly without being uploaded again. If a file is missing, stale cache rows for it are removed so the scan database does not keep pointing at paths that no longer exist.

The scan database is no longer deleted when a SQLite error occurs. BitNinja backs it up and attempts recovery instead, which is safer on servers that have already completed a large scan. Periodic maintenance also keeps that database in good shape.

Quarantined files are now compressed, with optional limits on size, count, and retention. Compressed entries can still be restored, so administrators can recover a file after it has been quarantined. Scan resume is also fixed: a missing last-scanned file no longer causes an endless loop, and remaining directories are still scanned.

Files are no longer marked as clean if the scanning worker crashes, which avoids a dangerous fail-open. The release also fixes the scanning worker lifecycle and releases detectors when configuration is reloaded.

Hardened credentials and cleaner process checks

The agent now stores SQL credentials encrypted instead of in plain text, reducing the impact of anyone reading local configuration files. This release also fixes false rogue-process detection of BitNinja’s own processes, so the agent is less likely to flag its own components as suspicious.

Smoother service lifecycle and resource limits

The server-load check now uses hysteresis, so it no longer flaps around the threshold when load hovers near the limit. The service stop timeout is longer, and a cleanup step runs after stop, which helps the agent shut down cleanly on busy hosts. PortHoneypot also stops faster, because it no longer removes redirection rules that have already been flushed.

Packaging adds systemd memory limits for the SAM and dispatcher services, in the same spirit as the WAF3 memory cap: keep security services inside predictable resource budgets on shared servers.

How to get BitNinja Linux Agent 3.17.12

This build is a Frequent and Beta channel release, not a Stable-channel release. If your servers use Reliable Auto Update (RAU), switch the update channel to Frequent or Beta in the BitNinja Console to receive it. If automatic updates are paused or blocked by a local policy, follow the BitNinja documentation for manual updates and RAU configuration.

You can also read the previous BitNinja Linux Agent 3.17.9 release notes.

Frequently asked questions

Is this a stable release?

No. BitNinja Linux Agent 3.17.12 is published on the Frequent and Beta update channels. Production servers that stay on the Stable channel will not receive this build until it is promoted.

Which components ship with this release?

The agent ships with BitNinja WAF3 1.1.3 and BitNinja Policier 1.0.4. WAF3 1.1.3 includes the transparent-proxy, dependency-pinning, and memory-limit changes described above.

Can I still restore quarantined files?

Yes. Quarantined files are compressed in this release, and compressed entries can still be restored. Optional size, count, and retention limits can also be applied to quarantine storage.

How does this release reduce mail-server false positives?

SenseLog no longer treats aborted or unauthenticated Dovecot disconnects as failed logins, and it counts a log event only once when the same line is written to more than one file. At the same time, several detectors can watch the same file, so real Postfix SASL login failures are not missed.