System behavior changes following Client Area security updates

Timeline

1. Nov 14, 2026, 03:57 AM UTC

   DMIT has recently deployed several security updates and patches to the Client Area.

   Please note the following changes to system behavior:

   1. DMIT has moved Private Key generation from the server side to the client browser. Keys automatically created during ordering are no longer temporarily stored on the server.
   2. A valid Public Key is now required when placing an order or performing a Reinstall OS action.
   3. Invalid Hostname entries will be reset to the default format.
   4. The DMIT Client Area no longer stores the root password for the Console. Due to password injection requirements, cloud-init still retains a salted password hash. DMIT continues to support changing the root password, but the new password will be displayed in plain text only once before being written directly to cloud-init.
   5. Stricter input validation and filtering rules have been implemented, which may block direct submission of code snippets in the ticket system. To include code in a ticket, please encode it in BASE64 before submitting and inform support staff in the ticket.