Fudo Enterprise 5.6 Documentation


Welcome!


The following are the enhancements and modifications introduced in version 5.6 of Fudo Enterprise. Remember to update to the latest available version to benefit from all improvements.


Version 5.6.1 (Latest)


  • ROLE-BASED ACCESS CONTROL

    In this Fudo Enterprise version we gladly introduce RBAC (Role-Based Access Control) - feature, which brings significant improvements in access management. List of improvements within RBAC:

    • Creating custom roles – Administrators can create roles with precisely defined permissions tailored to specific tasks, instead of relying solely on the predefined roles as before.
    • Managing selected object types – Roles can be narrowed down to manage only selected types of objects, such as Users, Listeners, Pools, Servers, or Safes.
    • Assigning action scope on objects – Permissions can be limited to specific actions, such as creating, modifying, exporting, deleting, or blocking particular types of objects.
    • Flexibility in assigning permissions – Permissions can be granted globally or selectively, e.g., to all objects of a certain type (e.g., Users, Accounts, or Servers) or only to selected, specific objects.
    • Access management by specific tabs – The ability to create roles with access limited to selected tabs within Fudo Enterprise.
    • Multi-role assignment – Users will be able to receive multiple roles, rather than just one of the six predefined roles as was the case before.

  • GROUPS

    We’re introducing a new object—Group—that adds an extra layer of control over resource access. Administrators can now create user groups to grant more precise permissions, ensuring that only authorized users can interact with specific Safes. Additionally, it is now possible to view which Safes a user has access to through the groups they belong to.

  • AI SESSION SUMMARY

    Fudo Enterprise 5.6 introduces a beta version of AI-powered summaries for SSH sessions. This feature allows administrators to quickly assess session context without replaying full recordings, improving audit efficiency and reducing manual review time. The feature can be easily configured with AI providers such as OpenAI, Anthropic, or a custom model using a local Ollama framework.

  • GRANULAR ACCESS TO REMOTE APPLICATIONS

    To improve access control and reduce surface exposure, this version adds support for restricting users to specific remote applications without granting access to the full desktop environment. This enhancement enables more granular permission management and helps ensure that users interact only with the resources necessary for their roles.

  • TUNNEL LISTENERS

    Fudo Enterprise 5.6 introduces a new Listener type that allows establishing an SSH tunnel for more secure connections. With this feature, administrators can safely enable access to protocols that are not encrypted by default, such as Telnet or VNC, while also adding an optional layer of encryption to other supported protocols.

  • ADDITIONAL NEW FEATURES AND IMPROVEMENTS:

    • Port Ranges: Added support for configuring Server objects with a port range, simplifying multi-port redirection and reducing manual setup.

    • Added support for configuring an outbound HTTP proxy for authentication-related traffic (OIDC, SMS, DUO). Also usable for timestamping services. Support for more integrations coming in future releases.

    • Added the ability to specify a remote application when establishing a session through the web client.

    • Enhanced MySQL protocol support:

      • Added support for Bastion connections

      • Enabled authentication against the MySQL server

      • Supported all authentication methods, including one-step multi-factor (e.g., password+token)

      • Supported authentication plugins:

        • for communication between Fudo and the database server: mysql_clear_password, mysql_native_password, caching_sha2_password;
        • for communication between the client and Fudo: mysql_clear_password.

    • Reorganized Interface Elements:

      • Export/Import Configuration options have been relocated from the user menu (top-right corner) to System > Configuration for improved visibility and accessibility.
      • The Timestamping settings have been moved from a standalone tab to Settings > System, aligning with other system-level configuration options.
      • The former LDAP Synchronization tab has been replaced with User Directory, reflecting its broader functionality and redesigned layout.
      • A new Object Rights subtab has been added to the editing views of Servers, Accounts, Pools, and Safes. This change, introduced with role-based access control (RBAC), enables administrators to define which users or roles are authorized to manage a given object—supporting more granular delegation of access rights.

    • User mapping in the User Directory has been redesigned — users are now assigned to groups instead of safes. This simplifies configuration and enables more flexible, centralized control over user permissions.

    • Nearly all configuration tabs in Fudo Enterprise have now been fully migrated to the new graphical interface. Each redesigned tab features improved clarity, faster navigation, and consistent behavior. Overview of Updated Tabs:

      • Sessions tab – Redesigned layout with labeled action buttons and a customizable column view. Less-used fields moved under a three-dot menu.
      • System tab – New Configuration subtab for export/import. Diagnostics split into focused subtabs for better clarity.
      • Network Configuration tab – Refreshed visuals and clearer layout for managing interfaces and routes.
      • Reports tab – Unified table view for all report types and schedules. Simplifies configuration and overview.
      • Cluster tab – Split into Create cluster and Join cluster tabs for more intuitive setup.
      • Notifications tab – Updated layout aligned with the new interface style. Improved readability.
      • User Directory tab – Formerly LDAP Synchronization. Restructured with modal windows for cleaner configuration.
      • External Storage tab – Updated to match the modernized UI. Minor usability enhancements.
      • Productivity tab – Updated to match the modernized UI. Minor usability enhancements.

    • The Session Player interface has been refreshed to enhance usability. Key control buttons have been repositioned for improved visibility and a more intuitive playback experience.

    • Enhanced Listener configuration for User Access Gateway. Administrators can now bind Listeners directly to the UAG address, simplifying native client connections and improving flexibility when UAG operates on multiple addresses.

    • Added support for clustered environments in Fudo ShareAccess. When Fudo Enterprise instances are configured in a high-availability cluster, they can now be connected to Fudo ShareAccess as gateway nodes, ensuring redundancy and seamless failover.

    • Added support for mapping OIDC configurations to Fudo domains. This allows assigning an OIDC configuration to a specific domain, resolving conflicts where users with identical user IDs originate from different LDAP/AD synchronizations.

    • Added support for custom TLS certificates in OIDC configuration. Administrators can now specify the CA certificate that signed the OIDC server certificate, provide a custom server certificate, or continue using the system root CA repository as before.

Warning

DISCONTINUED FEATURES:

  • Fudo Enterprise 5.6 no longer supports the DHCP.
  • Fudo Enterprise 5.6 no longer supports the APIv1. All scripts using this APIv1 should be rewritten to use APIv2.
  • API: Grant-related endpoints have been removed in this release. Please update your integrations accordingly. For more information, refer to the updated API documentation.
  • API: Disabled access to the /api/v2/diagnostics endpoint.
  • Fudo Enterprise 5.6 no longer supports the Application to Application Password Manager.
  • Fudo Enterprise 5.5 and 5.6 no longer supports the Mobile Token authentication method used to bind the Fudo Officer mobile application to a User. You must unlink all Fudo Officer bindings from Users configuration before the upgrade.

ANNOUNCEMENTS:

  • Fudo Enterprise 5.6 is the last version supporting the gateway and transparent modes in the listeners configuration. Listeners using these modes must be reconfigured to use proxy and bastion modes before upgrading to the next release.
  • Fudo Enterprise 5.6 is the last version to support bridge interfaces and network interface cards with bypass mode. These components are tightly coupled with the transparent and gateway modes, which will also be removed in version 5.7. We recommend reviewing your network configuration to ensure compatibility with future versions.
  • Support for the Telnet 3270 protocol is under review and may be removed in a release following version 5.6. If this protocol is critical to your environment, please contact Fudo Support for more information.


Table of contents