Shield Changelog – Relution Customer Hub

Relution Shield 26.3.1

Wed, 04 Nov 2026 00:00:00 +0100

Updates

Connections without EAP or XAuth authentication are rejected. The device ID is determined exclusively from the EAP identity and no longer from the IKE identity. The example configurations for iOS and Android Enterprise use EAP and are not affected
Device IDs are checked against a fixed format before the access check (4 to 64 characters, letters, digits, - and _); other IDs are rejected
New environment variable ACCESS_CHECK_FAIL_OPEN (default true) defines whether devices with a valid certificate are accepted when their status cannot be determined. It replaces RELUTION_SERVER_NOT_REACHABLE_ALLOW_DEVICE; the previous name is still evaluated as long as ACCESS_CHECK_FAIL_OPEN is not set
New environment variable DEVICE_COMPLIANCE_DIR for the directory inside the container in which the compliance status is cached (default /opt/strongswan/compliance)
Control characters are removed from the peer identities before they are written to the log
Security improvements and hardening

Fixes

A response from the Relution server that cannot be evaluated, such as a proxy error page, is treated like an unreachable server and follows the ACCESS_CHECK_FAIL_OPEN setting
If the compliance status cannot be cached, the result returned by the Relution server still applies

Version 26.3.0 was not released on Docker Hub; its changes are included in 26.3.1.

Tue, 08 Sep 2026 00:00:00 +0200

Updates

The environment variables RELUTION_SERVER_NOT_REACHABLE_ALLOW_DEVICE and DEVICE_STATE_CACHE_DURATION_MINUTES are passed to the access check and take effect as of this version [REL-12795]
Update to strongSwan 6.1.0

Tue, 09 Jun 2026 00:00:00 +0200

Updates

Mon, 23 Mar 2026 00:00:00 +0100

Updates

Mon, 22 Dec 2025 00:00:00 +0100

Updates

Diagnostic tools (binutils) in the image for analyzing crash reports
Custom modifications to the strongSwan source code removed; the image uses strongSwan unmodified

Tue, 04 Nov 2025 00:00:00 +0100

Updates

Mon, 28 Jul 2025 00:00:00 +0200

Updates

Wed, 04 Jun 2025 00:00:00 +0200

New

Configuration via swanctl.conf with the charon daemon instead of the previous ipsec.conf [REL-7961]
Environment variable RELUTION_ACCESS_CHECK_SCOPE for access checks across all organizations (global) [REL-8252]

Updates

Update to strongSwan 6.0.1 and Ubuntu 24.04 [REL-8251]
Consistent names for the environment variables: REST_API_ACCESS_TOKEN is now RELUTION_REST_API_ACCESS_TOKEN, HEALTHCHECK_ID is now RELUTION_HEALTHCHECK_ID [REL-8252]
Docker tag 2-latest instead of latest

The procedure for switching from version 1.x is described in Upgrade from 1.x to 2.x →.