Impex release information
Release Type: General
Release date: 2026-10-22
The IMPEX 6.3.0 release
IMPEX 6.3.0 moves all components to Sysctl Linux 44. The release focuses on making the system easier to configure correctly and on better visibility for administrators and users:
- Safer configuration: the ICC configuration card and the USBProtect System Settings now prevent conflicting choices.
- Better ICC feedback: NTP, DNS and Syslog settings can be tested from the ICC before saving. Syslog supports TLS and mutual TLS. Operation views update automatically, administrators can get an email when an operation fails, and the ICC shows a message and reconnects if its backend is unreachable.
- DataLock: uploaders can see the status of their queued scans (off by default). The ssh logins are hardened, and the ICC Task for system and AV engine updates works again.
- USBProtect: USB port mapping is now per machine, ExFAT is picked automatically when a file is too large for FAT32, Signify bundle failures are audit logged, Italian is added as a language, and BitLocker on multi-partition drives is fixed.
- XTransfer: a realm can be served by several KDCs, shares are only listed after the user has authenticated, and failed Kerberos logins give more detail.
Important information for Offline USBProtect users
You need to apply the 6.2.1 software.tgz offline upgrade before applying the 6.3.0 software.tgz upgrade. The 6.2.1 software.tgz is the one containing the information that the next upgrade will be an operating system upgrade. It also contains an important fix to the upgrade scripts that is vital for the 6.3.0 upgrade.
ICC changes
- Changed the GUI for Configuration card settings so that one cannot accidentally choose conflicting settings, like disabling Temporary Storage when File Selector is enabled.
- Added an ICC backend being offline detector which popups a modal window if the backend is no longer reachable. It then tries to re-establish a connection to the ICC.
- Added testing buttons to the NTP, DNS and Syslog cards in Server Settings. With these an admin can validate existing settings or try new settings and get valuable feedback.
- The Syslog card now has a list of allowed ports one can syslog to on the remote syslog server instead of allowing any port which did not play well with SELinux anyway.
- The syslog card and ICC now supports TLS and mTLS syslog servers including verifying the remote server’s certificate
- A “Uploader Queue View (DataLock)” setting was added on the configuration card. It is off by default. See the DataLock section for the functionality it enables.
- The operation views now show if a Datalock upload failed to be delivered to its destination.
- The operation views are now automatically polling status on running scans and looking for new operations automatically.
- Added Error Alerts on the configuration card. A comma-separated list of email addresses gets an alert email when an operation or a DataLock flow reports an error to the ICC. This uses the SMTP settings under “Server Settings”. Note that a DataLock flow still retries after a failure, so the operation may still succeed after the alert on temporary network failures.
- Fixed a broken link in the offline station alert email.
Repo changes
- The repo server now syncs the new Comodo signature format.
USBProtect changes
- Changed the GUI for System Settings so that one cannot accidentally choose conflicting settings, like disabling Temporary Storage when File Selector is enabled or vice versa.
- Audit logging has been added for Signify bundles that do not validate because of mismatched checksums on files or was signed by an unknown key
- Fixed the file scroller in the scan result to properly show the next 50 malware findings when scrolling if more than 50 were found.
- The default target filesystem will automatically change from FAT32(vfat) (if configured) to ExFAT if the source drive has files larger than 4GB.
- The USB port mapping to left/right side has been changed so it is now keyed on machine id. This means a live disk with Impex installed can be moved around between machines and the mapping will be per machine. Existing mappings are kept on upgrade, and a new button resets the mapping.
- Added Italian language support to the frontend. This was done during the RomHack Camp 2026 so it has been vetted by real Italians.
- Default view changed to show “hidden” files, i.e. files that start with a dot.
- The AV engine information now shows both when the signatures were released and when they were installed on the station.
- BitLocker volumes are now found on drives with several partitions, for example a FAT32 partition followed by a BitLocker partition, and unlocked BitLocker volumes are no longer skipped when scanning several partitions.
- Fixed the copy progress status, which could show a higher value than the actual progress.
- Fixed transfers to very small target drives failed because the target partition was too small. Filesystem overhead is now calculated from measurements instead of estimated.
- Fixed the battery status indicator on laptops.
- Fixed a workaround for a bug in the ESET engine.
XTransfer changes
- A Kerberos realm can now be served by several KDCs. The station tries them in the order they are listed in the ICC. The PKINIT KDC hostname is now optional per KDC and can be left empty if the KDC certificate carries the id-pkinit-san.
- The station only lists the shares of a realm after the user has authenticated to it.
- If the Kerberos login fails, the station now diagnoses the KDC connection and gives the operator and the ICC more detail on what went wrong.
DataLock changes
- The DataLock ssh logins are hardened. They no longer get a shell, run in near-empty chroots, and run in their own SELinux user, role and domain.
- Running a Task via the ICC station card on a DataLock to check for system and AV engine updates did not work in 6.2.0 but has now been fixed.
-
Queue status functionality was added so that a user that uploads can see status on their queued scans. It is off by default but can be enabled in the ICC on the configuration card under advanced settings: “Uploader Queue View (DataLock)”. This is an example output:
$ ssh -i privkey.key datalock-status@datalock-ip Your uploads on this DataLock at 16:31:30 UPLOAD STATE 1 file, 806.9 kB scanning 1 file, 806.9 kB waiting since 16:31 1 file, 806.9 kB waiting since 16:31 2 other uploads are in the queue.
If a customer wants to enable throttling of uploads to the DataLock this could be one way of doing it. Check datalock-status for “waiting” and do not submit if there is a queue.
Documentation changes
- Added more details on username mapping for OpenID Connect.
Information
Operating system packages
All system components have been updated to their latest respective version.
Online Documentation
Further details and configuration guidance are available in the official documentation:
https://sysctl.se/impex/documentation/
SBOM
Each ISO and VHD release has a software bill of materials (SBOM) to make introspection of the release easy to integrate with a number of security tools. Current and historical SBOMs are available for download at the customer portal.
Update Instructions
For networked Impex stations, this release will be automatically installed as part of the regular update process. No manual steps are required from administrators or users. The system will apply the update seamlessly in the background, ensuring that the latest fixes are in place without any interruption to normal operations.
For standalone Impex stations, your organisation needs to download the update from portal.sysctl.se in accordance with the update instructions in the chapter “USBProtect in offline mode” in the Impex USB Protect user manual.
Links
Sysctl web page
https://www.sysctl.se
Sysctl page for Impex releases
https://sysctl.se/impex/releases/
Sysctl documentation for Impex
https://sysctl.se/impex/documentation/
Sysctl customer portal
Sysctl rss/atom