1.7.1

Clavitor 1.7.1

Vault, gate, CLI and proxy move to 1.7.1 together. The headline is the audit log: it now shows what your vault refused, not only what it allowed. CLI and proxy users must enrol their clients again (see Breaking changes).

Audit log

• Refused requests are recorded: a client blocked by its IP whitelist, a locked or revoked client, a read outside the client's scopes, a read over its quota, a request over the rate limit, and an action that needs a hardware-key tap but came without one. Each entry names the client, the source address, the action and the reason.
• Repeated refusals within a minute are combined into one entry that carries the count, so a misconfigured agent cannot flood the log.
• A refused read no longer appears as a successful read. Before, a read outside a client's scopes or over its quota could be logged as a successful get even though nothing was returned.
• The filters on the Audit log page now work: client, IP address, action, outcome and entry, plus sorting and the outcome, action and client counts. A search covers the newest 20,000 events of the selected period.

Clients

• The client form now says what the IP whitelist accepts: IPv4 and IPv6 addresses, ranges (CIDR) and host names.

Vault

• Repeated failed attempts to open a vault (an unknown vault or a wrong key) are slowed down from the first miss, and the source address is blocked for a day after a few tries.

CLI and proxy

• Both now speak the vault's current credential format and 16-character vault IDs.
• A client works with a vault on any of our locations: the enrolment blob now carries that location's key. Before, the CLI and the proxy had one key built in and reached only the vaults at one location.
• New downloads for macOS, Linux, Windows and FreeBSD at clavitor.ai/downloads.

---

Breaking changes: CLI and proxy clients set up before October 4 no longer connect (the vault answers "This device was set up with an older version. Set it up again from your vault."). Create a new client blob in your vault (Clients), install 1.7.1 and run clavitor-cli init (or clavitor-proxy init) again.

Known issues: Agents that run behind a shared VPN exit, such as Cloudflare WARP, change address on almost every request. An IP whitelist that admits them must cover the provider's whole address range, which admits everyone else on that VPN too.