PacketFence 15.2 introduces cluster-wide live log streaming and historical log viewing, pftest in the admin GUI, RADIUS authentication and accounting through pfconnector, connector-backed Active Directory domains, VoIP dACL support, per-connection-profile captive portal theming, SQL query tagging for ProxySQL, and security hardening including removal of the default admin password and LDAP injection prevention.
New Features
Cluster-wide live log streaming — the admin UI now tails log files from every cluster node in parallel and merges events client-side with hostname/filename attribution (#9091)
Historical log view — query active and rotated .log.*.gz files across the cluster with a time-range picker, served by the Go log-tailer plugin (RE2 filters, bounded scans, lossless byte-offset pagination) (#9091)
pftest in admin GUI — the authentication and profile_filter subcommands are exposed under Auditing > pftest, guarded by the new PFTEST_CREATE admin-role action, rate-limited per tested user, and fan out across the cluster on request (opt-in) (#9091)
RADIUS authentication and accounting through pfconnector — remote sites can proxy RADIUS to the cloud over pfconnector tunnels, with a dedicated accounting tunnel, routing by packet code and a unified shared secret (#8963)
Connector-backed Active Directory domains — AD join and DNS resolution now work through the pfconnector, with automatic tunnel provisioning on domain commit and an Active Directory Domains menu in SaaS mode
VoIP dACL — new VoIPDACL switch toggle merges the full Access-Accept (including downloadable ACLs) with the Voice VSA instead of returning only the Voice attributes (#9068)
Captive portal theming — per-connection-profile theme.css support and refreshed default styling (#9071)
Record the node computername directly from DHCP server traffic (#9124)
SQL query tagging — all MySQL queries from Perl and Go services carry a /* pf:[:] */ comment for ProxySQL routing and troubleshooting (#9097)
Files uploaded through the admin UI (PathUpload fields) are now synced to git storage (#9213)
Enhancements
- New auth_log.source_type column recording the authentication source type (AD, LDAP, SQL, Email, SMS, …) alongside the source id, so portal authentication reports survive a source being renamed or deleted
- Per-zone VRRP router id — in a multi-zone (layer 3) cluster, the keepalived virtual_router_id can now be set per zone in the zone’s CLUSTER section of cluster.conf (#9159) @casdr
- pfdhcplistener performance — external DHCP events hashed by client MAC across dedicated workers, Fingerbank lookups skipped when the signature is unchanged, firewall SSO updates gated by a half-lease cache, and notifications run in-process (#9054)
- pfacct no longer drops RADIUS accounting under load — larger UDP receive buffers with backpressure, and the node session cache is bounded with an idle TTL to stop a memory leak (#9166)
- Faster RADIUS audit-log statistics — per-switch and per-connection-type metrics rewritten as GROUP BY queries (#9164)
- MySQL connection compression enabled on TCP connections from both the Perl and Go database layers (#9047)
- Fix pfcmd configreload hang and slow switch-config admin UI rooted in unbounded per-role switch mappings, plus clearer UX for blocked role deletions (#9078)
- Removed the SCEP PKI provider (#9051)
- Update Go to 1.26.4 (#9083)
- Bump Fingerbank package to 4.3.4 (#9104)
- Faster admin login — only authentication sources that define admin rules are queried, while match-time rule sources are still evaluated (#9215, #9218)
- New pfcron task switch_observability_acls_cleanup to purge old switch observability ACL entries (#9196)
- pfconnector: chisel pprof profiling can be enabled with the CHISEL_PPROF environment variable (#9210)
- pfpki: SCEP requests are logged with the device CN in CA.Verify
Bug Fixes
- Self-heal the missing locationlog_history table when upgrading from 15.0 to 15.1 (#9121, #9069)
- Fix switch NAS configuration not expiring in pfconfig after changes (#9134)
- Fix non-deterministic RADIUS filter merge when using the reply: prefix (#9063)
- Refresh the Fingerbank collector authorization header at request time so a changed API key is picked up without a restart (#9105)
- Nightly backup: skip triggers in the dump so the pf-user backup isn’t truncated, and reapply DB triggers on import (#9136)
- Don’t clobber existing rows in find_or_create when the database read fails (#9167)
- pfflowjob: don’t reconnect to Kafka on idle read timeouts (#9168)
- Mask mariadb.socket so it cannot hold port 3306 from pf-mariadb (#9161)
- Make a multi-node Kafka cluster reachable for PF-listener clients (#9089)
- Entra ID: resolve sponsor group membership by email when the username is absent (#9144)
- Allow disabling the AUP for sources under Authentication::Choice (#9079)
- pfconnector: bind DNS tunnels on all interfaces and make Kubernetes port patching idempotent (#9149)
- pfconnector: serve the local ntlm_auth host to remotes, validate that connector networks are not defined more than once, and pin the remote install URL to the PacketFence release
- pfconnector-remote: remove the legacy fingerbank-collector on install/upgrade and restart Docker so the bridge picks up its address
- pfacct: use webservices.aaa_host for the AAA client instead of the generic host
- DHCP processor: fix the firewall SSO refresh gate and the Fingerbank DHCPv6 signature
- IPv6 firewall rules are now actually applied — ip6tables rules are generated at monitor startup to close an inotify race, with CI validation (#9183)
- pfcron: stop the panic when the management network is empty and self-heal on boot (#9181)
- pfconnector: stop leaking UDP exit-node connections in the chisel tunnel (#9211)
- RADIUS: fail the request when the node cannot be read from the database instead of fabricating an unregistered node (#9214)
- httpd.aaa: fix a Fingerbank config memory leak and make mod_perl child recycling effective (#9217)
- Fingerbank: restore the rate-limited query cache and fix cache hygiene (#9216)
- Non-SQL (abstract) reports work again through the v1.1 report API — searching one returned a 400; those requests are now proxied to the Perl dynamic_report endpoint (#9207)
Security Updates
- The default admin password has been removed — the admin password must now be set during initial configuration (#9118, #9148)
- Replace shell command execution with safe_pf_run to prevent command injection (#9094)
- Drop CBC/LUCKY13 ciphers on haproxy and apache listeners (#9052, #9162)
- Improve the randomness of secrets generated at package installation
- Escape user input in LDAP filters to prevent LDAP injection (#9119)
- Restrict Sereal deserialization (THAW) to an allow-list of classes (#9155)
PacketFence 15.2 is a minor release that is considered ready for production use, and upgrading from previous versions is strongly advised. This release focuses on cluster-wide observability and cloud connectivity through pfconnector. Operators gain live, cluster-wide log streaming and a historical log viewer in the admin UI, pftest diagnostics under Auditing, RADIUS authentication and accounting proxied to the cloud over pfconnector tunnels, connector-backed Active Directory domains, VoIP dACL support, per-connection-profile captive portal theming, and SQL query tagging for ProxySQL routing — alongside a broad set of performance, stability, and security improvements, including the removal of the default admin password.
Upgrade Notes
Upgrading from previous versions is strongly advised. Please review the upgrade guide before proceeding.
Download
Release Info
- Version
- 15.2
- Released
- Aug 25, 2026
- Type
- Minor