Fudo Enterprise 6.3 - System Documentation


Welcome!


The following are the enhancements and modifications introduced in version 6.3 of Fudo Enterprise. Remember to update to the latest available version to benefit from all improvements.


Version 6.3


Version 6.3 introduces the following improvements and changes:

  • File scanning in rendered HTTP sessions - files uploaded and downloaded in rendered HTTP sessions can now be scanned by your antivirus engine through an ICAP service before they reach the target server or the user’s device. See File Scanning in Rendered HTTP Sessions.

  • Configurable file transfer in RDP Web Client sessions - get more control over file transfers with separate upload and download settings for each safe and a configurable storage limit. See the safe functionality options.

  • RDP session playback decoded in the browser - recordings from the new RDP implementation are now decoded directly in the browser for consistent playback, seeking, OCR, and video conversion. Servers without RDPGFX require Use legacy RDP implementation on the listener.

  • Commands list in SSH session playback - review SSH sessions faster with a searchable list of entered commands. Click any command to jump straight to the moment it was entered. See Commands List in SSH Sessions.

  • Session details side panel - review session information without jumping between pop-up windows. The session player and the Sessions list in the Admin Panel now include a side panel with dedicated tabs for session details, participants, access and share history, live monitoring, AI summary, and transferred files.

  • AI Live Session Monitoring for more protocols [BETA] - AI agents now analyze Telnet, PostgreSQL and MySQL sessions in addition to SSH. Each agent runs on the protocols selected for it, and the built-in agents can be used directly once you assign them a provider and select them in a safe. See AI Live Session Monitoring [BETA].

  • Signed .rdp files — files generated for the Native client option are now signed with the listener’s server certificate, so the Windows warning about an unsigned connection file can be dismissed permanently.

  • Access Gateway allowed hosts - a new list in the system settings restricts the host names and IP addresses under which users can open the User Access Gateway. The list is empty by default, so nothing changes until you fill it. See Access Gateway Allowed Hosts.

  • TACACS+ external authentication - added TACACS+ (RFC 8907) as an external authentication server type, with ASCII, PAP, and CHAP authentication methods. The connection to the TACACS+ server can be secured with TLS 1.3 (RFC 9887), with server certificate verification and a client certificate that can be uploaded or generated in the Admin Panel. See TACACS+.

  • OpenID Connect Back-Channel Logout - signing out at the Identity Provider now also ends the corresponding Fudo Enterprise sessions in the Admin Panel and the User Access Gateway across all online cluster nodes. To enable this, register the Backchannel logout URL from the OpenID Connect configuration with the Identity Provider. See Back-Channel Logout.

  • Password strength and complexity hints - see how strong a new password is as you type. When password complexity is enforced, a live checklist shows which requirements are met, and the password can be saved only after all of them are satisfied. A built-in generator creates a compliant password in one click. See Password Complexity.

  • Fudo Officer pairing from the User Access Gateway - users can now pair the Fudo Officer mobile app with their account directly from the User Access Gateway. Pairing is controlled per user by the administrator and can be removed at any time.

  • Copying and pasting in the Web Client - work more naturally in SSH and RDP Web Client sessions with direct clipboard integration and familiar keyboard shortcuts.

  • Public address for Reverse Proxy listeners - Reverse Proxy listener mappings can now define an external address and port, for example a public IP address or a DNS name behind NAT. The User Access Gateway shows them to users for native client connections instead of the remote address and port. See Reverse Proxy.

  • Blocking concurrent sessions through other safes - a new safe option prevents users from having sessions through two different safes at the same time. See Blocking Concurrent Sessions Through Other Safes.

  • Italian and French interface languages - Fudo Enterprise is now available in Italian and French. An updated license file is required to make them available for selection.

  • Password Vault in Fudo Officer - the Fudo Officer 2.4.4 mobile app brings the Password Vault to the phone: browsing and searching accessible collections, viewing secret details, sending an access request when approval is required, and filling a matching secret into another application on Android and iOS. Users can view, filter and create their own personal secrets - logins, SSH keys, API keys, notes and certificates - directly in the app.

  • Secure secret storage in Fudo Officer - Fudo Officer 2.4.4 now stores the app’s data in an encrypted database rather than a file protected by the device PIN, removing its exposure to PIN brute-forcing.

  • Renamed the session cookie to __Host-sessionid to strengthen its protection. If your integrations or security rules rely on the previous sessionid name, update them, or temporarily enable the Use legacy sessionid option in the system settings (requires a restart).

  • API v2 responses now include the Content-Disposition: attachment header. An API URL opened directly in a browser is now downloaded as a file instead of being displayed.

  • API v2 JSON responses now declare charset=utf-8 in the Content-Type header.

  • The User Access Gateway now removes the stored Web Client connection and Accounts page filters from browser storage on logout, including automatic logout.



Table of Contents