Fudo Enterprise 6.1 - System Documentation


Welcome!


The following are the enhancements and modifications introduced in version 6.1 of Fudo Enterprise. Remember to update to the latest available version to benefit from all improvements.


Version 6.1 (Latest)


In this release, the improvements focus on

  • Added support for sudo command control:

    • Added a new sudo policy type for defining allowed sudo command execution rules.

    • Added a sudo plugin that checks sudo commands against the configured policy before execution.

    • Added Fudo Officer notifications for executed sudo commands, available in Fudo Officer 2.3.32 and later.

  • Improved Password Vault capabilities:

    • Added password audit for compromised passwords, allowing administrators to upload a password list and warn users when a Password Vault password is found on that list.

    • Added support for SSH key rotation with Secret Changers, including SSH key target configuration and SSH key type selection in Secret Change Policies.

    • Updated related UI terminology from Password Changer to Secret Changer to better reflect support for different secret types.

  • Added the Password Vault browser extension for desktop versions of Chrome, Firefox, Edge, and Safari. The extension lets users access and search Password Vault secrets, autofill recognized login forms, request access to restricted secrets, and use granted exclusive checkout directly from the browser.

  • Expanded Kerberos authentication support:

    • Added Kerberos authentication for Discovery, Secret Change, and Secret Verification operations.

    • Added support for Kerberos authentication in multi-domain Active Directory environments.

    • Added separate configuration switches for RDP, external authentication, and LDAP synchronization.Added options to disable fallback to NTLM and LDAP simple bind for stricter authentication control.

  • Added LDAP channel binding support for User Directory, LDAP Discovery, and LDAP-based Secret Changers.

  • Added SCIM 2.0 provisioning support with Fudo as a service provider:

    • Renamed User Directory to User Sources and added a dedicated SCIM Provisioning tab for configuring SCIM integration with external identity providers.

    • Added SCIM API key generation, rotation, and provisioning disable options.

    • Added Managed by information for users and groups, including new columns and filters for identifying objects managed by SCIM, Fudo, or User Directory.

    • Added clearer status and blocking information for SCIM-managed users and groups, including local blocking behavior in Fudo and external management indicators.

  • Improved rendered HTTP sessions:

    • Enhanced Kiosk Browser mode with configurable URL bar behavior: hidden, read-only, or editable.

    • Added an optional browser tab limit with a notification that lets users open a link in the current tab when the configured limit is reached.

  • Added support for uploading and downloading files in RDP sessions.

  • Added Azure Key Vault as a new External Password Repository type.

  • Improved LAPS and password operation handling by adding support for modern JSON-based LAPS password formats with fallback to legacy formats, clearer password retrieval errors, enhanced certificate configuration forms, and stronger logging across password change and verification operations.

  • Added support for FIDO2 authentication in the Admin Panel and User Access Gateway, enabling users to sign in with registered security keys.

  • Improved syslog server configuration:

    • Added TLS support for sending logs to syslog servers over TCP.

    • Added a dedicated Syslog Servers view in the Events Log section for reviewing configured syslog servers and their connection details.

  • Improved API key management by adding friendly names, configurable expiration times, and key hints that make it easier to identify existing API keys without revealing the full value.

  • Updated the Webclient side toolbar for RDP, SSH, and VNC sessions. The toolbar is now displayed on the right side of the session window with a refreshed visual design.

  • Improved cluster network configuration by allowing administrators to choose whether the local bind address should also be used as the node address. This provides greater flexibility for cluster deployments in environments with NAT or custom network routing.

  • Improved PDF report generation reliability by replacing the previous HTML-to-PDF conversion mechanism with a dedicated PDF rendering engine.

  • Restored visibility of users assigned to a specific external authentication method, making it easier for administrators to review dependencies before managing authentication configuration.

  • Enhanced certificate validation for remote server connections to include hostname and address matching when CA verification is enabled, providing more precise server identity matching.

  • Restored connectivity validation notifications for DNS and NTP configuration, so administrators are informed when configured servers are unreachable or non-functional.

  • Added support for assigning the same anonymous account and tunnel listener combination to multiple Safes. Sessions established through such tunnels are now correctly associated with the user who created the tunnel, while existing restrictions for non-tunnel listener configurations remain enforced.

  • Improved bulk operations across tables with object selection options, progress visibility, and clear completion status with issue details when needed.

  • Added new columns to the user list: Auth Methods, External Authentications, and Managed by, making authentication details and management source easier to review directly from the table.

  • Improved AI model synchronization in clustered environments to ensure trained models remain available across nodes after rollbacks and when new nodes join a cluster.

  • Added timestamp verification scripts to TGZ session downloads for Windows and macOS, enabling users to verify session timestamping information.

  • Added DMZ Gateway as a virtual appliance for Reverse Proxy deployments, available on customer request. Customers can deploy a dedicated FreeBSD-based VM image on their hypervisor to expose sshd(8), which Fudo uses to establish a reverse SSH tunnel.

  • Added SBOM generation capability, allowing a Software Bill of Materials for Fudo components to be provided upon customer request.

  • Upgraded the operating system base to FreeBSD 14.4.

  • Upgraded OpenSSH to version 10.2.

  • Added TLS 1.3 support for management, UAG, ShareAccess, and Fudo Officer connections to improve compatibility with modern security standards.

  • Updated SSH message authentication algorithm configuration by moving UMAC-64 and UMAC-64-ETM to legacy options, preserving backward compatibility with existing SSH implementations while keeping the primary algorithm list aligned with current security recommendations.

  • ShareAccess improvements:

    • Improved the Gateway pairing process with Fudo Enterprise by adding clearer setup guidance and validation of key requirements before the connection is established.

    • Connect Region selection for Gateways with latency measurement and automatic indication of the fastest available region.

    • Support for Server Pools synchronized from Fudo Enterprise.

    • Changed domain verification during organization onboarding from mandatory to optional.



Table of Contents