Security tab shows false negatives for UFW/SSH and JSON parse error (“Bad control character…”) on Ubuntu LTS 24.04

[fruggeri-fitup]

To Reproduce

Steps to Reproduce

• Add a new Remote Server (Ubuntu).

• Run Setup Server as root from Dokploy. In Validate, everything is green (Docker/RClone/Nixpacks/Buildpacks/Swarm/Network/Main dir/Railpack).

• Harden the server:

  • /etc/ssh/sshd_config:

    • PasswordAuthentication no
    • PubkeyAuthentication yes
    • PermitRootLogin no # (optionally) Match Address → PermitRootLogin prohibit-password

UFW installed and enabled; allow 22/tcp only on tailscale0 (or 100.64.0.0/10); default deny incoming.

Open Setup → Security and click Refresh.

Current vs. Expected behavior

Actual Result

Red banner:
Failed to parse output: Bad control character in string literal in JSON at position 176

UFW section shows Not Installed / Not Active / Default: undefined.

SSH section shows Enabled: Not Enabled, Key Auth: Not Enabled, Password Auth: Enabled, Use PAM: Enabled.

These reports are inconsistent with the real server state.

Expected Result

No JSON parse error.

Security tab reflects actual UFW/SSH state.

Provide environment information

Dokploy: (version from UI footer)
Remote server OS: Ubuntu 24.04 LTS
Network: Tailscale; SSH bound to tailscale0 only
Validate shows OK: Docker 27.0.3, RClone 1.71.0, Nixpacks 1.39.0, Buildpacks 0.35.x, Swarm initialized, network created

Which area(s) are affected? (Select all that apply)

Remote server

Are you deploying the applications where Dokploy is installed or on a remote server?

Remote server

Additional context

No response

Will you send a PR to fix it?

Maybe, need help

[wooddigital]

same issue here as well.

[hopsersmerk]

I can reproduce this on Ubuntu 26.04 too.
The SSH connection itself is fine:

• Validate passes
• passwordless sudo is working for the same user Dokploy uses
  I ran these on the target server:

sudo -n true && echo "passwordless sudo: OK" || echo "passwordless sudo: FAIL"
systemctl is-active sshd
systemctl is-active ssh
systemctl is-active ssh.socket
sudo sshd -T 2>/dev/null | grep -i '^configfile'
sudo ufw status
sudo ufw status verbose
sudo grep -i '^PermitRootLogin' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf 2>/dev/null
sudo grep -i '^PasswordAuthentication' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf 2>/dev/null
sudo grep -i '^UsePAM' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf 2>/dev/null

Output:

passwordless sudo: OK
active
active
active
Status: active
To                         Action      From
--                         ------      ----
666/tcp                    ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere
666/tcp (v6)               ALLOW       Anywhere (v6)
80/tcp (v6)                ALLOW       Anywhere (v6)
443/tcp (v6)               ALLOW       Anywhere (v6)
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip
To                         Action      From
--                         ------      ----
666/tcp                    ALLOW IN    Anywhere
80/tcp                     ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere
666/tcp (v6)               ALLOW IN    Anywhere (v6)
80/tcp (v6)                ALLOW IN    Anywhere (v6)
443/tcp (v6)               ALLOW IN    Anywhere (v6)
/etc/ssh/sshd_config:PermitRootLogin no
/etc/ssh/sshd_config:PermitRootLogin no
/etc/ssh/sshd_config:PasswordAuthentication no
/etc/ssh/sshd_config.d/50-cloud-init.conf:PasswordAuthentication yes
/etc/ssh/sshd_config.d/60-cloudimg-settings.conf:PasswordAuthentication no
/etc/ssh/sshd_config:UsePAM yes

So this does not look like an SSH or sudo issue.
My guess is the JSON in the Security audit is being built from shell output that is not normalized first. In this case PermitRootLogin appears twice, so Dokploy may be ending up with a multiline value there, which would explain the JSON parse error:
Failed to parse output: Bad control character in string literal in JSON
So this seems to affect Ubuntu 26.04 as well, not just 24.04.

[dylanvdmerwe]

Occurring for me now as well on a new build server setup.

[
    {
        "error": {
            "json": {
                "message": "Failed to parse output: Bad control character in string literal in JSON at position 150 (line 1 column 151)",
                "code": -32600,
                "data": {
                    "code": "BAD_REQUEST",
                    "httpStatus": 400,
                    "path": "server.security",
                    "zodError": null
                }
            }
        }
    }
]

Dokploy version: 0.29.8
Ubuntu: 24.04
Kernel: HWE 6.17.0-35-generic

I just installed dokploy on this server which was freshly formatted. Some edge case breaking the JSON?

[reikjarloekl]

Root cause found: duplicate active directives in sshd_config (e.g. two PermitRootLogin lines, as in a Match block or the outputs above) make the audit script embed a raw newline inside its JSON output, which breaks parsing — the false negatives are fallout from that failed request. Fix in #4889.