RemotePower 8.0 adds setup wizards and fixes 19 security findings

RemotePower 8.0.0 launched on November 11, marking the first major release of this self-hosted monitoring and fleet management platform. The update introduces ten new setup wizards to simplify complex configurations and addresses 19 security findings from a comprehensive review, including one rated as High severity. This release, codenamed Pil0tMatters, aims to reduce administrative friction while hardening the system against configuration errors and potential data leaks.

What happened

The most visible change in version 8.0.0 is the addition of guided setup workflows for ten critical areas, including host registration, email configuration, single sign-on (SSO), and SSH gateway setup. These wizards replace multi-screen forms with step-by-step interfaces that validate settings in real time before saving them. For example, the notification wizard sends a test message and displays the response status code immediately, ensuring that administrators do not save broken configurations. The SSO guide specifically accounts for quirks in providers like Authentik, Keycloak, and Zitadel, warning users when specific claims, such as group memberships, are missing.

Alongside these usability improvements, the development team published a full security review detailing 19 findings. One High-severity issue involved a host settings form that would inadvertently clear critical configuration fields, such as command allowlists and log rules, if a user only intended to change the host group. Nine Medium-severity issues were also resolved, including bugs that allowed data leakage between organizations in multi-tenant setups and vulnerabilities where spreadsheet formulas could execute upon CSV export. Every finding was reproduced, fixed, and covered by new tests before the release.

Key details

• Ten new setup wizards guide users through configuring hosts, notifications, SSO, email, syslog, network flows, relay satellites, agent push channels, SSH gateways, and integrations.
• A High-severity bug was fixed where editing a host group would unintentionally clear other host settings due to empty fields being interpreted as "clear" commands.
• The interface now supports text scaling from 80% to 300%, with responsive adjustments ensuring dialogs remain usable on smaller screens.
• New handshake monitors check SMTP, IMAP, SSH banners, and NTP services to verify they respond correctly without sending actual mail or logging in.
• A read-only Model Context Protocol (MCP) endpoint allows AI clients to query server data using existing API key scopes and rate limits.
• Image updates now support a shadow mode for testing and automatic rollback if health checks fail after an update.

Background

RemotePower is a self-hosted tool designed to monitor and manage fleets of Linux, Windows, and macOS machines. It operates using a central server and small agents installed on each host. These agents poll outbound only, meaning no incoming ports need to be opened on the managed machines, which simplifies firewall rules and improves security posture. The platform provides a web interface for monitoring, alerting, vulnerability scanning, patch management, and remote access.

The concept of "setup wizards" in this context refers to interactive guides that break down complex configuration tasks into smaller, validated steps. Unlike traditional forms that submit all data at once, these wizards check each input as it is entered and often perform live tests, such as verifying an email server connection, before allowing the user to proceed. This approach reduces the likelihood of misconfiguration, which is a common source of downtime and security gaps in self-hosted environments.

Why it matters

For teams running their own infrastructure, configuration drift and human error are significant risks. The High-severity bug fixed in this release illustrates how easily critical security controls, such as command allowlists, can be accidentally removed during routine maintenance. By introducing wizards that validate settings before saving, RemotePower reduces the cognitive load on administrators and prevents simple mistakes from becoming outages. This is particularly valuable for small IT teams who may not have dedicated DevOps engineers to review every configuration change.

The security review process itself sets a strong example for self-hosted software consumers. By publishing the full review and detailing how each finding was addressed, the developers provide transparency that is often missing in proprietary tools. The fix for multi-tenant data leakage ensures that organizations using RemotePower to manage separate customer environments or departments can do so with greater confidence. Additionally, the new accessibility features, such as adjustable text sizes and screen reader support, make the tool more inclusive for diverse teams.

What you can do

• Review the published security review document to understand the specific risks addressed in version 8.0.0 and assess if similar patterns exist in your other self-hosted tools.
• Test the new setup wizards in a staging environment before upgrading production systems, paying close attention to the SSO and email configuration steps.
• Verify that your host configurations remain intact after upgrading, especially if you use custom command allowlists or log rules, to ensure the High-severity bug did not affect your existing setup.
• Enable the new handshake monitors for critical services like SMTP and NTP to gain deeper visibility into service health beyond simple uptime checks.
• If you use multi-tenant setups, confirm that organization-specific data is properly isolated by checking compliance evidence and alert summaries for cross-tenant leakage.
• Update your agents and server to the latest version to benefit from the OpenSSL compatibility fixes, ensuring connectivity for hosts using Python 3.13 or later.