Fudo PAM 5.0-72004

This is a major Fudo release, introducing new features, improvements, API changes, and bug fixes.

In this release, the Artificial Intelligence component has been rewritten to speed up processes and reduce resources with the newest software version. Due to this fact, the AI features won’t work until the new models are trained with the updated AI component. In case of a configured cluster, it is advised first to upgrade the node with the configured AI component, train the new models and then connect it to the rest of the nodes. 

NEW FEATURES:

• The Just In Time feature allows users to request access to resources for a time period or to schedule for the future.
• Fudo Officer 1.0 mobile application has been released. The application allows managing the access requests, sent by the user via the User Portal.
• The Auto Discovery feature allows scanning a domain controller for new accounts and onboarding them automatically.
• Added possibility to configure multiple remote backup destinations: S3, Backblaze, or FTP.
• The Hotfix feature allows uploading a minor fix through the Fudo Admin Panel. The fix package is delivered by the Fudo Support Team.
• Added an opt-in Call Home service that allows Fudo Support Team to connect remotely to the client’s system, check diagnostics, and remotely perform required operations for the client.
• Added option to send push notifications about the sessions that are waiting for approval.

IMPROVEMENTS:

• Added support for Huawei Cloud.
• Added support for HTTP login in HP iLo.
• Added possibility to checkout a secret for an account that borrows secret from another account.
• A static server can have now multiple addresses. Each address is allowed to have a separate port.
• The users with superadmin, administrator, and operator roles can authenticate to the Fudo Management with Single Sign On (SSO).
• A new setting has been added to the Artificial Intelligence tab within the Session analysis section: the Score logging field is responsible for logging session scores in the system log. Sessions with high, low, or all threat levels can be separately logged. The default value for the Score logging field is a high threat level.
• An account can be configured so that in case of a failed password verification, a password will be recovered by resetting it to a value known to Fudo.
• A user is able to connect directly to a server or to the remote application in transparent mode.
• Notifications can be now set and edited per Granted User within a Safe.
  The algorithms RSA (1024) and DSA (1024) for the authentication method key have been disabled for the accounts where the chosen server doesn’t have the Legacy ciphers option enabled.
• The logged-out or unauthorized user is redirected now to the login page when trying to access the session via URL.
• A unique identifier of the Fudo instance (FUID) is displayed now on the footer of the Fudo Admin Panel.
• The default sender address for the notifications has been changed to noreply@fudosecurity.com.
• The user with operator role has access to the sessions and can manage notifications in a Safe.
• The default value for a period of logs retention removal has been changed from 90 days to 3650 days.
• Added support for the Polish 214 keyboard layout.
• Changed OATH QR code generator so that instead of the email address, the user’s domain and name are included.
• Improved pagination of the Events logs within the Safe. Message entries of the Event Logs are expanding according to their length.
• The Event Logs can be filtered out with multiple filters being applied at the same time.
• Full Event log information is available now within the exported log file.
• Clarified the error message that appears if the IP address is misconfigured for the Dynamic server.
• Improved search of the LDAP groups.
• Corrected process of defining the safe access time policy for a user.
• Created a log that contains information about objects used to establish the session when the Require approval option is enabled for the Safe.
• Implemented the attempts limit for 2-factor authentication methods.

API CHANGES:

• The WebClient feature can be set to a Safe via API.
• Added validation in API to detect if the server host or port already exists.
• Added a new endpoint to handle notifications per Granted User in the Safe.
• Fix validation for legacy ciphers in RDP and SSL enabled protocols.

BUG FIXES:

• Fixed connection to Microsoft SQL Server 2017.
• Corrected the process of logging in using the UK keyboard layout during the RDP session.
• Fix lack or delay in email notifications when values in the Binding address field include IP or label for the SMPT server settings.
• Fixed problem with session encoding being sent to all the cluster nodes. Now, the sessions are encoded to the node, marked as session owner, or to the node with sessions set to be fully replicated.
• Fix group mapping with more than one domain for LDAP synchronization.
• Fixed a bug appearing while changing the account type from regular to forward, having the password configured – the secret field was not cleared from the database. Now, it is.
• Fixed Internal Server Error when trying to view SFTP session while Russian or Ukrainian language was set as an interface language.
• Fixed a bug with a lack of connection to dynamic servers using the WebClient feature.
• Fixed a bug when PuTTY users were unable to establish SSH sessions with servers using the SSH Agent Forwarding feature.
• Fixed a player bug that took place while joining the rendered HTTP sessions – it was played from the start, instead of going live.
• Fixed a bug that appeared while replying to a comment in a recorded session via Player – then the player was closed and the user was redirected to the Fudo Admin Panel.
• Fixed a bug when an admin couldn’t terminate the session on a remote node.
• Fixed a bug when an admin couldn’t see ongoing sessions, connected via the Webclient feature.
• Corrected synchronization within the system when there are users in the nested groups in Active Directory.
• Fixed bug when the server limit wasn’t cleared after the license was changed from server-limited to session-limited type.
• Fixed a bug with listeners after renaming a label: there was wrong address mapping. Now, all listeners attached to the changed label are correctly mapped.

BEFORE YOU UPGRADE

There are a few things that need to be verified before this upgrade can be applied.
Make sure your Fudo instance isn’t undergoing any system-wide process, such as storage rebuild, or the system isn’t under full-load.
In a cluster configuration, make sure all nodes are synchronized and upgrade the slave node first.
Make sure you have an active Premium or Standard Support maintenance contract.

HOW TO UPGRADE YOUR FUDO

Login to your Fudo and from the menu on the left-hand side select ‘System’, then the ‘Upgrade’ tab.

If your Fudo is running in a cluster, start the upgrade on the Slave node, and only when the upgrade finishes successfully start upgrading the Master node. When both systems are running the same Fudo version cluster communication will be restored.
Select “Upload” from the top left side and upload the previously downloaded and unzipped upgrade package file.

Select “Run Check” to determine if your upgrade file is correct and can be applied to the existing Fudo configuration. Refresh your browser window to see “Upgrade check” current progress.

Upon a successful “Run Check” result, upgrade your Fudo by using the “Upgrade” button. Upon system restart, all active sessions will be terminated.

In case of an unsuccessful check do not upgrade your system, double check your upgrade file checksum. If you encounter any problems, get in touch with us and we will assist you.

THE ROLLBACK PROCEDURE

If you are experiencing issues with the newly installed version, you have an option to roll back to the previous version of Fudo running on this machine. To do so, click the user menu on the top, select ‘Restart’, and select previous system revision from the drop-down list.

Please keep in mind any session recordings performed on a newer version will be lost upon upgrade rollback execution.

CONTACT US

If you have questions or concerns, please get in touch at support@fudosecurity.com or by phone: +48 22 100 67 09.

Sincerely,
Fudo Security Team