34.1

2024-04-26

PrivX 34.1 is an incremental release with security and bug fixes.

  • [PX-6790] Session recording for native RDP client connections does not work

  • [PX-6801] Configuring routing prefix for HA Carriers results in a duplicated name error

  • [PX-6813] Connection search timeout

34.0

2024-04-08

PrivX 34.0 is a maintenance release focusing primarily on stability improvements.

Important Notes for This Release

Issues in RDP native-client connections! (2024-04-17)

We identified a major bug in PrivX 34.0 that affects native RDP client connections. If you use RDP native-client connectivity, we recommend against upgrading to this version. We are working on a point release to fix this issue.

For more detailed information about the issue, please contact SSH support.

RDP connections via the PrivX GUI work as intended.

Upgrade to 34 Only Supported from 32.x and later

Upgrade to this version is only supported from versions 32.x and later! To upgrade from previous versions such as 31.x, you must upgrade to 32.x first, before you can upgrade to 34.

Supported upgrade paths to this release are:

  • Upgrade with downtime: 32.x, 33.x
  • Zero-downtime upgrade: 33.x

For more information about upgrading from older versions, see Upgrade from Older Releases.

After this release, we provide security and stability fixes for PrivX 34.x, 33.x, and 32.x. Older versions are not officially supported. We recommend you upgrade as soon as you can if you are running an unsupported version.

Deprecation Warnings

PostgreSQL 11.x Support Ended

PostgreSQL 11.x has reached end of life since Nov. 2023 and official support for this version will be ended in future releases.

SHA-1-Certificate End of Support Imminent
Support for certificates signed with SHA-1 shall be dropped in future PrivX releases.

By default PrivX will not trust certificates with SHA-1 signatures unless they are self-signed. Re-enabling trust for such certificates requires setting the GODEBUG=x509sha1=1 environment variable for PrivX microservices and tools.

Practical attacks against SHA-1 have been demonstrated in 2017 and publicly trusted Certificate Authorities have not issued SHA-1 certificates since 2015.

CentOS/RHEL 7 support Ending

CentOS 7 and RHEL 7 will reach end of life on June 30, 2024. PrivX aims to end installation support for these platforms on the same timeline. Starting from PrivX 32, Rocky Linux 9 and RHEL 9 are officially supported. See Migrate from EOL Operating Systems.

New Features

  • [PX-6201] Support Universal SSH Key Manager as a host directory

Improvements

  • [PX-6609] Support Microsoft Graph custom attributes
  • [PX-6584] Role store API support pagination
  • [PX-6674] Configurable timeout values for PrivX Web Proxy
  • [PX-6580] PrivX UI: improved instruction on PrivX Authorizer (mobile app) pairing
  • [PX-6444] New sub-admin permissions: mobilegw-view and mobilegw-manage
  • [PX-6578] Improved connection-manager error responses
  • [PX-6682] Connection and event search default time range set to one week
  • [PX-6198] Redis is no longer supported for notifications
  • [PX-6597] Enforce reasonable minimum value to 2 minutes for access_token_valid, refresh_token_valid, session_valid and authorize_token_valid in oauth-shared-config.toml
  • [PX-6204] Allow setting maximum TLS version for RDP connections

Bug fixes

  • [PX-6647] Search SSH trail in maintenance mode causes page reload
  • [PX-6606] Windows line endings break offline license
  • [PX-6677] Non-admin users should be able to see service status of Auxiliary Instances
  • [PX-6621] Setting equal port min and port max in Extender service may crash the service
  • [PX-6616] license-manager: changing statistics collection opt-in in PrivX UI does not reflect to all HA nodes before license refresh
  • [PX-6620] Connection trail and metadata removal end time keeps on changing
  • [PX-6695] "Allow modified url params" in web host does not allow credentials being filled properly

Known Issues

  • [PX-1517] Permission denied for AuthorizedPrincipalsCommand on AWS RedHat AMI

    • Workaround: To correct SELinux context, copy the principals_command.sh to correct location:

      # scp -i key.pem principals_command.sh user@target:/tmp/
# ssh -i key.pem user@target "sudo cp /tmp/principals_command.sh /etc/ssh/"

  • [PX-1711] RDP fails to connect to target in maintenance mode, need support for /admin flag

  • [PX-1835] Extender/Carrier/WebProxy configs are not migrated on upgrade

  • [PX-1875] Web proxy login does not work, if login page does requests to multiple domains

  • [PX-2947] No sound when viewing recorded rdp-mitm connection.

  • [PX-3086] PrivX role mapping to AD OU not working as expected.

  • [PX-3529] Default access group CA key is always copied on the host when running the deployment script via Extender

  • [PX-4218] RDP native clients do not work in Kubernetes environment when running under non-root account

  • [PX-4352] UI shows deleted local user after delete

  • [PX-4616] Upgrade may stop Carriers and Web Proxies from reconnecting.

    • Workaround: Restart affected Carrier and Web-Proxy services.

  • [PX-4662] Pasting larger text amount in Carrier/Proxy host fails (limited to 16kB for now)

  • [PX-4689] PrivX Linux Agent leaving folders in /tmp

  • [PX-4809] Empty file(s) created when ICAP detects malicious uploads with SCP via SSH Bastion.

  • [PX-5558] PrivX does not support password change required option for user in auth flow via passkey.

  • [PX-6669] Kerberos login does not work if LDAP user does not have sAMAccountName

33.1

2024-03-27

PrivX 33.1 is an incremental release with security and bug fixes.

33.0

2024-02-15

Important Notes for This Release

Upgrade to 33 Only Supported from 32.x

Upgrade to this version is supported from the previous major release 32.x only! To upgrade from previous versions such as 31.x or 30.x, you must upgrade to 32.2 first, before you can upgrade to 33.

For more information about upgrading from older versions, see Upgrade from Older Releases.

After this release, we provide security and stability fixes for PrivX 33.x, 32.x, and 31.x. Older versions are not officially supported. We recommend you upgrade as soon as you can if you are running an unsupported version.

PrivX Documentation Moved to New Documentation Platform

The move is transparent for users. You may access the latest version of PrivX docs as usual at https://privx.docs.ssh.com

If you need to access older documentation versions, specify the version in the URL. For example, PrivX 29 at https://privx.docs.ssh.com/v29

privx-cmd and PrivX-Agent support for old platforms ended

privx-cmd and agents from this release may not support old platforms:

  • Windows 7, 8, Server 2008 and Server 2012.
  • MacOS versions 10.14 and older.

If you use agents or privx-cmd for enabling native-client connections, ensure that the users' OS is updated.

Deprecation Warnings

Redis Support Ending
Redis support will be ended in a future release. We recommend you change to PostgreSQL for PrivX microservice notifications. Please Change Notification Mechanism to PostgreSQL if your PrivX still uses Redis for notifications.

SHA-1-Certificate End of Support Imminent
Support for certificates signed with SHA-1 shall be dropped in future PrivX releases.

By default PrivX will not trust certificates with SHA-1 signatures unless they are self-signed. Re-enabling trust for such certificates requires setting the GODEBUG=x509sha1=1 environment variable for PrivX microservices and tools.

Practical attacks against SHA-1 have been demonstrated in 2017 and publicly trusted Certificate Authorities have not issued SHA-1 certificates since 2015.

CentOS/RHEL 7 support Ending

CentOS 7 and RHEL 7 will reach end of life on June 30, 2024. PrivX aims to end installation support for these platforms on the same timeline. Starting from PrivX 32, Rocky Linux 9 and RHEL 9 are officially supported. See Migrate from EOL Operating Systems.

New Features

Improvements

  • [PX-6503] Implement an optional support of "Set-Cookie" header for Python SDK
  • [PX-6586] Show number of active connections in PrivX restart dialog
  • [PX-6427] "Pair New Device" button is not shown under Account page if PrivX is not registered to mobile gateway
  • [PX-6013] New design of PrivX landing UI
  • [PX-6473] Entra ID (Azure AD) user directory support for additional and custom attributes
  • [PX-6424] PrivX install supports PostgreSQL 15 and 16
  • [PX-6502] Content-Type header added to PrivX SDK requests
  • [PX-6369] The role list no longer displays member counts automatically for performance reasons. Accurate role member counts are now shown on the role details page.
  • [PX-6364] Trail integrity check improvements
  • [PX-6627] Loading larger amount of secrets is faster
  • [PX-6577] Statistics collection job waits to start until previous job is completed
  • [PX-6565] GET /users/{id}/resolve to return user object and user's roles

Bug fixes

  • [PX-6610] Issuing certificates fails when there is an expired access group CA certificate
  • [PX-6576] Navibar autohide does not work in Firefox Carrier browser
  • [PX-6566] Incorrect help texts on deployment page
  • [PX-6515] Upgrade on Kubernetes doesn't clean up PrivX CA Key
  • [PX-6482] Setting user directory TTL to 0 or below 0 behaves incorrectly
  • [PX-6481] Web container (firefox) allows to install extensions
  • [PX-6458] PrivX RPM upgrade backs up incorrect version of config file
  • [PX-6417] Editing a Microsoft Graph user directory may result in multiple synchronization tasks running concurrently
  • [PX-6387] workflow-engine send more queries to role-store than needed
  • [PX-6348] Stopping PrivX directory sync does not work properly
  • [PX-6343] MS Graph directory logs are too verbose
  • [PX-6334] Numerous concurrent logins using the same user account result in a high number of slow database insert operations
  • [PX-6211] AWS roles page is sometimes showing the same role multiple times
  • [PX-6184] "User-authentication-failed" error should only be logged when login failed in the end.

Known Issues

  • [PX-1517] Permission denied for AuthorizedPrincipalsCommand on AWS RedHat AMI

    • Workaround: To correct SELinux context, copy the principals_command.sh to correct location:

      # scp -i key.pem principals_command.sh user@target:/tmp/
# ssh -i key.pem user@target "sudo cp /tmp/principals_command.sh /etc/ssh/"

  • [PX-1711] RDP fails to connect to target in maintenance mode, need support for /admin flag

  • [PX-1835] Extender/Carrier/WebProxy configs are not migrated on upgrade

  • [PX-1875] Web proxy login does not work, if login page does requests to multiple domains

  • [PX-2947] No sound when viewing recorded rdp-mitm connection.

  • [PX-3086] PrivX role mapping to AD OU not working as expected.

  • [PX-3529] Default access group CA key is always copied on the host when running the deployment script via Extender

  • [PX-4218] RDP native clients do not work in Kubernetes environment when running under non-root account

  • [PX-4352] UI shows deleted local user after delete

  • [PX-4616] Upgrade may stop Carriers and Web Proxies from reconnecting.

    • Workaround: Restart affected Carrier and Web-Proxy services.

  • [PX-4662] Pasting larger text amount in Carrier/Proxy host fails (limited to 16kB for now)

  • [PX-4689] PrivX Linux Agent leaving folders in /tmp

  • [PX-4809] Empty file(s) created when ICAP detects malicious uploads with SCP via SSH Bastion.

  • [PX-5558] PrivX does not support password change required option for user in auth flow via passkey.

32.2

2024-01-10

32.2 is an incremental release to address the Terrapin vulnerability. The fix includes the following changes:

  • PrivX SSH Proxy and SSH Bastion enable the OpenSSH strict KEX protocol extension when the target server and client express support for it during the initial KEX exchange.
  • chacha20-poly1305@openssh.com algorithm is removed from the sets of default sshtarget and sshclient ciphers.
  • hmac-sha2-512-etm@openssh.com and hmac-sha2-256-etm@openssh.com algorithms are removed from the sets of default sshtarget and sshclient macs.

It is possible to revert to using the vulnerable algorithm combinations by editing the /opt/privx/etc/ssh-algorithms.toml file. This is not recommended unless you are certain that all target servers and clients, that PrivX communicates with, support the OpenSSH strict KEX protocol extension.

32.1.1

2023-12-05

This minor release fixes Carrier browser images(chromium, chromium_lite). Upgrade involves downloading new browser images and tagging them to match the current PrivX Carrier version.

This example shows how to upgrade the Chromium container image on PrivX Carrier 32.1

docker pull public.ecr.aws/sshprivx/privx_browser_chromium:32.1.1
docker tag public.ecr.aws/sshprivx/privx_browser_chromium:32.1.1 public.ecr.aws/sshprivx/privx_browser_chromium:32.1

32.1

2023-12-01

32.1 is an incremental release that fixes some performance and stability issues found in 32.0.

Bug Fixes

  • [PX-6334] User login timestamp is updated more often than necessary
  • [PX-6364] Trail integrity housekeeping improvement
  • [PX-6387] workflow-engine spams rolestore
  • [PX-6464] panic in secrets-manager

32.0

2023-11-23

Important Notes for This Release

Update to API Roles Parameters

The Role-Store API has been updated for managing user roles in the /role-store/api/v1/users/{user_id}/roles endpoint, affecting both GET and PUT requests. The method for defining validity periods for time-limited roles has changed. Previously, these periods were set using grant_start and grant_end attributes in the root object. Now, they are specified within the grant_validity_periods array, which supports multiple time ranges.

See API specifications.

Monitor-service instance status endpoint at /monitor-service/api/v1/instance/status used for load balancer status checks is no longer returning JSON body for unauthenticated requests. Status codes (200 for OK, 500 for instance down) still remain the same and should be used for LB health checks.

PostgreSQL 9.x and 10.x Support Ended

PostgreSQL 9.x and 10.x have reached end of life since 2021 and 2022 respectively and official support for these database is ended from this release. To upgrade the PrivX database, see Upgrade PrivX Database to Supported Version.

Preserve Custom Browsers when Updating Carrier Configuration

If you use a custom-browser image, and upgrade Carriers and their configurations, ensure that your custom-browser image is specified in the Carrier configuration carrier-config.toml. The name of the custom-browser image must be specified in the default setting under the [web_browsers] section.

** Rocky Linux/RHEL 9 official support added and CentOS/RHEL 7 support Ending **

CentOS 7 and RHEL 7 will reach end of life on June 30, 2024. PrivX aims to end installation support for these platforms on the same timeline. Starting from PrivX 32, Rocky Linux 9 and RHEL 9 are officially supported. See Migrate from EOL Operating Systems.

Deprecation Warnings

Redis Support Ending
Redis support will be ended in a future release. We recommend you change to PostgreSQL for PrivX microservice notifications. Please change notification mechanism to PostgreSQL if your PrivX still uses Redis for notifications.

SHA-1-Certificate End of Support Imminent
Support for certificates signed with SHA-1 shall be dropped in future PrivX releases.

By default PrivX will not trust certificates with SHA-1 signatures unless they are self-signed. Re-enabling trust for such certificates requires setting the GODEBUG=x509sha1=1 environment variable for PrivX microservices and tools.

Practical attacks against SHA-1 have been demonstrated in 2017 and publicly trusted Certificate Authorities have not issued SHA-1 certificates since 2015.

privx-cmd and PrivX-Agent support for old platforms ending

privx-cmd and agents released in PrivX v33 and later may not support old platforms:

  • Windows 7, 8, Server 2008 and Server 2012.
  • MacOS versions 10.14 and older.

If you use agents or privx-cmd for enabling native-client connections, ensure that the users' OS is updated.

Supported releases and upgrade path

After this release, we provide security and stability fixes for PrivX 32.x, 31.x, and 30.x. Older versions are not officially supported. We recommend you upgrade as soon as you can if you are running an unsupported version.

Upgrading to this version is supported from three previous major versions (31.x, 30.x, 29.x). For more information about upgrading from older versions, see Upgrade from Older Releases.

New Features

  • [PX-2314] VMWare vSphere as a supported host directory.
  • [PX-3940] Session-Password Authentication, which allows OIDC login for native RDP/DB connections.
  • [PX-4299] Support for granting multiple validity periods for the same user role via workflows.
    Note that such requests must be requested and approved one at a time.
  • [PX-5418] Multi-Factor Authentication with PrivX Authorizer, a mobile app developed by us.
  • [PX-6142] Dark mode GUI support.
  • [PX-6174] Exporting List Data to CSV or JSON.
  • [PX-6176] Options to omit clipboard and/or file transfers from session recordings.
  • [PX-6273] Initiate connections to target host straight from the host configuration page. Useful for testing connections.
  • [PX-5215] UI shows file upload status on terminal view
  • [PX-5778] UDP protocol support for network targets through Extender
  • [PX-6165] Option to configure web service specific browser version for Carrier connections

Improvements

  • [PX-5630] Password Rotation automatic selection of operating system
  • [PX-6088] ssh-algorithms.toml: prefer aes256 over aes128 ciphers.
    • diffie-hellman-group1-sha1 SSH kex algorithm was dropped from default algorithms. The cipher suite can be re-enabled from ssh-algorithms.toml.
  • [PX-6247] Increase the max file transfer size limit for web connections
  • [PX-6251] web-proxy: allow server responses to take longer than 60 seconds to complete
  • [PX-6389] UI pagination loading improvement
  • [PX-6208] AWS directory does not stop scanning other regions if one region fails. Added region filter feature for cloud host directories.

Bug fixes

  • [PX-5763] Error code for missing workflow step name is incorrect
  • [PX-6086] Fixed Carrier Chromium browser startup issue
  • [PX-6153] PrivX Web-Proxy in HA doesn't do the failover.
  • [PX-6158] PrivX Carrier browsers - dial down the policies to allow viewing HTTPS certificate for web site
  • [PX-6173] Renaming role does not work correctly
  • [PX-6175] SSH Proxy crash issue fixed
  • [PX-6177] OIDC userinfo endpoint does not obey TLS trust anchors file in shared-config
  • [PX-6178] File upload cookies are not expired when the upload request happens.
  • [PX-6187] Incorrect error shown in logs when deleting key on HSM environment
  • [PX-6224] Using role name with space causes issues with Chrome container
  • [PX-6235] Problem with alt key capturing in web session.
  • [PX-6254] Disabling urlbar and navibar doesn't work for Carrier Chromium
  • [PX-6284] RDP-PROXY connectivity broken for legacy ciphers TLS 1.2 and TLS 1.1/TLS 1.0.

Known Issues

  • [PX-1517] Permission denied for AuthorizedPrincipalsCommand on AWS RedHat AMI
    • Workaround: To correct SELinux context, copy the principals_command.sh to correct location:
      # scp -i key.pem principals_command.sh user@target:/tmp/
# ssh -i key.pem user@target "sudo cp /tmp/principals_command.sh /etc/ssh/"
  • [PX-1711] RDP fails to connect to target in maintenance mode, need support for /admin flag
  • [PX-1835] Extender/Carrier/WebProxy configs are not migrated on upgrade
  • [PX-1875] Web proxy login does not work, if login page does requests to multiple domains
  • [PX-2947] No sound when viewing recorded rdp-mitm connection.
  • [PX-3086] PrivX role mapping to AD OU not working as expected.
  • [PX-3529] Default access group CA key is always copied on the host when running the deployment script via Extender
  • [PX-4218] RDP native clients do not work in Kubernetes environment when running under non-root account
  • [PX-4352] UI shows deleted local user after delete
  • [PX-4616] Upgrade may stop Carriers and Web Proxies from reconnecting.
    • Workaround: Restart affected Carrier and Web-Proxy services.
  • [PX-4662] Pasting larger text amount in Carrier/Proxy host fails (limited to 16kB for now)
  • [PX-4689] PrivX Linux Agent leaving folders in /tmp
  • [PX-4809] Empty file(s) created when ICAP detects malicious uploads with SCP via SSH Bastion.
  • [PX-5558] Privx does not support password change required option for user in auth flow via passkey.

31.3

2024-03-27

PrivX 31.3 is an incremental release with security and bug fixes.

31.2

2024-01-10

PrivX 31.2 is an incremental release to address the Terrapin vulnerability. The fix includes the following changes:

  • PrivX SSH Proxy and SSH Bastion enable the OpenSSH strict KEX protocol extension when the target server and client express support for it during the initial KEX exchange.
  • chacha20-poly1305@openssh.com algorithm is removed from the sets of default sshtarget and sshclient ciphers.
  • hmac-sha2-512-etm@openssh.com and hmac-sha2-256-etm@openssh.com algorithms are removed from the sets of default sshtarget and sshclient macs.

It is possible to revert to using the vulnerable algorithm combinations by editing the /opt/privx/etc/ssh-algorithms.toml file. This is not recommended unless you are certain that all target servers and clients, that PrivX communicates with, support the OpenSSH strict KEX protocol extension.

31.1.1

2023-10-12

This minor release fixes Carrier browser images(chromium, chromium_lite, firefox, firefox_lite). Upgrade involves downloading new browser images and tagging them to match the current PrivX Carrier version.

This example shows how to upgrade the Chromium container image on PrivX Carrier 31.1

docker pull public.ecr.aws/sshprivx/privx_browser_chromium:31.1.1
docker tag public.ecr.aws/sshprivx/privx_browser_chromium:31.1.1 public.ecr.aws/sshprivx/privx_browser_chromium:31.1

You don't need to restart PrivX Carrier after the commands.

31.1

2023-09-21

PrivX 31.1 is an incremental release on top of PrivX 31.0 with security and bug fixes

  • [PX-6244] Channel may get closed in ssh-mitm exec connections before the output is sent to client

31.0

2023-09-04

PrivX 31.0 is a maintenance release focused on technical enhancements.

Important Notes for This Release

Azure-Directory Migration to MS Graph

If you have set up Azure user/host directories using Azure AD Graph API, such directories will be automatically migrated to using MS Graph API when you upgrade to this release. After upgrade, you will still need to manually set the the following API permissions for the PrivX app in Azure Portal:

Microsoft Graph→Application Permissions

  • User.Read.All
  • GroupMember.Read.All

Azure AD Graph API was deprecated in June 2023.
https://learn.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview

For more information about setting up Azure directories with MS Graph, see Azure AD as a User Directory via Microsoft Graph API.

Required actions to optimize PrivX performance

As part of our ongoing effort to optimize PrivX performance, we have introduced additional indexing support from PrivX 28. Some improvements require pg_trgm extension to be installed to the PrivX database. For more information about enabling indexing, see Improve Performance with Indexing before upgrade.

Deprecation Warnings

Redis Support Ending
Redis support will be ended in a future release. We recommend you change to PostgreSQL for PrivX microservice notifications. Please change notification mechnism to PostgreSQL if your PrivX still uses Redis for notifications.

PostgreSQL 9.x and 10.x Support Ending

PostgreSQL 9.x and 10.x have reached end of life since 2021 and 2022 respectively and support for these database versions shall be dropped in a future PrivX release. For more information about upgrading the PrivX database, see Upgrade PrivX Database to Supported Version.

SHA-1-Certificate End of Support Imminent
Support for certificates signed with SHA-1 shall be dropped in future PrivX releases.

By default PrivX will not trust certificates with SHA-1 signatures unless they are self-signed. Re-enabling trust for such certificates requires setting the GODEBUG=x509sha1=1 environment variable for PrivX microservices and tools.

Practical attacks against SHA-1 have been demonstrated in 2017 and publicly trusted Certificate Authorities have not issued SHA-1 certificates since 2015.

privx-cmd and PrivX agent support for old Windows versions ending

privx-cmd and agent released after Q3/2023 may not support Windows 7, 8, Server 2008 and Server 2012. If you use native ssh client on Windows by connecting directly using privx-cmd, or Windows version of PrivX agent, please update your Windows.

Supported releases and upgrade path

After this release, we provide security and stability fixes for PrivX 31.x, 30.x, and 29.x. Older versions are not officially supported. We recommend you upgrade as soon as you can if you are running an unsupported version.

Upgrading to this version is supported from three previous major versions (30.x, 29.x, 28.x). For more information about upgrading from older versions, see Upgrade from Older Releases.

New Features

Improvements

  • [PX-4820] Show progress while fetching lots of users/hosts from directories
  • [PX-5874] Support database certificates in Kubernetes
  • [PX-5978] Deployment script supports "--offline" option
  • [PX-5156] Carrier container follows user browser's timezone
  • [PX-5925] Hosts in unusable statuses are filtered out from import
  • [PX-6041] aes256-gcm@openssh.com is supported and added to ssh-algorithms.toml
  • [PX-6047] In an active connection in web client, pressing Ctrl-w does not close connection abruptly
  • [PX-6160] Support additional Graph API attributes for attribute mapping
  • [PX-6143] Improved UX for multiple files uploading
  • [PX-6129] web-proxy: domain pattern based certificate validation error suppression
  • [PX-6132] web-proxy: proxy chaining support with http connect and SOCKS proxies
  • [PX-6146] [PX-6105] web-proxy: internal enhancements to ssl bumped certificate generation
  • [PX-6162] web-proxy: support legacy x.509 certificates

Bug fixes

  • [PX-4411] RDP-PROXY: "Default access group not found" warning on manual connection for no reason
  • [PX-4650] Setting ​access_token_valid to "1m" kicks the user out to the login page
  • [PX-5076] Housekeeping task to delete inactive user data doesn't work with a lot users
  • [PX-5394] SSH cert auth conn fail after rotating PrivX CA Key
  • [PX-5786] Empty trail folders left after housekeeping
  • [PX-5875] Incorrect message when SSO session expired when login to PrivX UI
  • [PX-5943] nginx default.conf in /etc/nginx/conf.d overrides privx.conf
  • [PX-5968] Disclaimer popup and preview issues
  • [PX-5979] Host tags are returned in random non-deterministic order
  • [PX-6016] Missing end slash in connection url will cause web connection to fail
  • [PX-6027] The UI suggests the wrong role mapping example when a Graph directory is selected
  • [PX-6073] Deleting user directory does not clean up role mapping rules.
  • [PX-6075] Typo in PrivX sshexec router README file
  • [PX-6094] MFA tokens can be overwritten in cases of DB connectivity issues
  • [PX-6136] Trails for active SSH connections may be corrupted when ssh-proxy is stopped
  • [PX-6139] Health check status for web services is broken if the host has other services configured
  • [PX-6185] Connection-manager search API with sortKey "id" returns BAD_REQUEST.

Known Issues

  • [PX-1517] Permission denied for AuthorizedPrincipalsCommand on AWS RedHat AMI
    • Workaround: To correct SELinux context, copy the principals_command.sh to correct location:
      # scp -i key.pem principals_command.sh user@target:/tmp/
# ssh -i key.pem user@target "sudo cp /tmp/principals_command.sh /etc/ssh/"
  • [PX-1711] RDP fails to connect to target in maintenance mode, need support for /admin flag
  • [PX-1835] Extender/Carrier/WebProxy configs are not migrated on upgrade
  • [PX-1875] Web proxy login does not work, if login page does requests to multiple domains
  • [PX-2947] No sound when viewing recorded rdp-mitm connection.
  • [PX-3086] PrivX role mapping to AD OU not working as expected.
  • [PX-3529] Default access group CA key is always copied on the host when running the deployment script via Extender
  • [PX-4218] RDP native clients do not work in Kubernetes environment when running under non-root account
  • [PX-4352] UI shows deleted local user after delete
  • [PX-4616] Upgrade may stop Carriers and Web Proxies from reconnecting.
    • Workaround: Restart affected Carrier and Web-Proxy services.
  • [PX-4662] Pasting larger text amount in Carrier/Proxy host fails (limited to 16kB for now)
  • [PX-4689] PrivX Linux Agent leaving folders in /tmp
  • [PX-4809] Empty file(s) created when ICAP detects malicious uploads with SCP via SSH Bastion.
  • [PX-5558] Privx does not support password change required option for user in auth flow via passkey.
  • [PX-6261] Revoking default access group initial CA in HA env doesn't remove its key from all nodes
    • Workaround 1: Leave the old CA key. Once a new key has been set as the primary CA key, the old one should not adversely affect PrivX functionality.
    • Workaround 2: Revoke the old CA key from Administration->Access Groups, then run the following command on each PrivX Server:
      /opt/privx/bin/keyvault-tool -name "PrivX CA Key" delete-asymmetric
      Verify the key was deleted:
      /opt/privx/bin/cert-tool -command list -type authorizer-ca -short | grep "OU=PrivX Authorizer CA/" | cut -f 4
      The key was deleted successfully if the previous command outputs nothing. If the command returned a UUID, run the following command once on any PrivX Server (replace <cert_id> with the output of the previous command):
      /opt/privx/bin/cert-tool -command delete -id <cert_id>
  • [PX-6284] RDP-PROXY connectivity broken for legacy ciphers TLS 1.2 and TLS 1.1/TLS 1.0

30.3

2024-01-10

PrivX 30.3 is an incremental release to address the Terrapin vulnerability. The fix includes the following changes:

  • PrivX SSH Proxy and SSH Bastion enable the OpenSSH strict KEX protocol extension when the target server and client express support for it during the initial KEX exchange.
  • chacha20-poly1305@openssh.com algorithm is removed from the sets of default sshtarget and sshclient ciphers.
  • hmac-sha2-512-etm@openssh.com and hmac-sha2-256-etm@openssh.com algorithms are removed from the sets of default sshtarget and sshclient macs.

It is possible to revert to using the vulnerable algorithm combinations by editing the /opt/privx/etc/ssh-algorithms.toml file. This is not recommended unless you are certain that all target servers and clients, that PrivX communicates with, support the OpenSSH strict KEX protocol extension.

30.2.1

2023-10-12

This minor release fixes Carrier browser images(chromium, chromium_lite, firefox, firefox_lite). Upgrade involves downloading new browser images and tagging them to match the current PrivX Carrier version.

This example shows how to upgrade the Chromium container image on PrivX Carrier 30.2.

docker pull public.ecr.aws/sshprivx/privx_browser_chromium:30.2.1
docker tag public.ecr.aws/sshprivx/privx_browser_chromium:30.2.1 public.ecr.aws/sshprivx/privx_browser_chromium:30.2

You don't need to restart PrivX Carrier after the command.

30.2

2023-09-21

PrivX 30.2 is an incremental release on top of PrivX 30.1 with security and bug fixes

  • [PX-6244] Channel may get closed in ssh-mitm exec connections before the output is sent to client

30.1

2023-07-13

PrivX 30.1 is an incremental release on top of PrivX 30.0. This release contains a few important bug fixes

  • [PX-6087] rdp-proxy can crash with an runtime error
  • [PX-6085] a role-store crash with fatal error is observed.
  • [PX-6076] privx-carrier status update causes slow memory leak

30.0

2023-07-03

Important Notes for This Release

Azure-Directory Migration to MS Graph

If you have set up Azure user/host directories using Azure AD Graph API, such directories will be automatically migrated to using MS Graph API when you upgrade to this release. After upgrade, you will still need to manually set the the following API permissions for the PrivX app in Azure Portal:

Microsoft Graph→Application Permissions

  • User.Read.All
  • GroupMember.Read.All

Azure AD Graph API shall be deprecated in June 2023.

For more information about setting up Azure directories with MS Graph, see Azure AD as a User Directory via Microsoft Graph API.

Required actions to optimize PrivX performance

As part of our ongoing effort to optimize PrivX performance, we have introduced additional indexing support from PrivX 28. Some improvement requires pg_trgm extension to PrivX database. Please read Improve Performance with Indexing before upgrade.

Deprecation Warnings

Redis Support Ending
We recommend you to use PostgreSQL PrivX inter microservice notifications. Please change notificaiton mechnism to PostgreSQL if your PrivX still uses Redis for notifications. Redis support will be ended in future releases

PostgreSQL 9.x and 10.x Support Ending

PostgreSQL 9.x and 10.x have reached end of life since 2021 and 2022 respectively and support for these database versions will be dropped in a future PrivX release. If you are running an old version for PrivX, please Upgrade PrivX Database to Supported Version

SHA-1-Certificate End of Support Imminent
Support for certificates signed with SHA-1 shall be dropped in future PrivX releases.

By default PrivX will not trust certificates with SHA-1 signatures unless they are self signed certificates. Re-enabling trust for such certificates requires setting the GODEBUG=x509sha1=1 environment variable for PrivX micro services and tools.

Practical attacks against SHA-1 have been demonstrated in 2017 and publicly trusted Certificate Authorities have not issued SHA-1 certificates since 2015.

privx-cmd and PrivX agent support for old Windows versions ending

privx-cmd and agent released after Q3/2023 may not support Windows 7, 8, Server 2008 and Server 2012. If you use native ssh client on Windows by connecting directly using privx-cmd, or Windows version of PrivX agent, please update your Windows.

Supported releases and upgrade path

After this release, we provide security and stability fixes for PrivX 30.x, 29.x, and 28.x. Older versions are not officially supported. We recommend you upgrade as soon as you can if you are running an unsupported version.

Upgrading to this version is supported from three previous major versions (29.x, 28.x, 27.x). For more information about upgrading from older versions, see Upgrade from Older Releases.

New Features

Improvements

  • [PX-5553] Allow listing all connections associated with one login session
  • [PX-5880] Troubleshooting script collects additional information
  • [PX-5996] Trail timestamp obfuscation is now configurable
  • [PX-5205] Send audit event before user's authorized key is going to expire
  • [PX-5928] Optimized audit event removal during housekeeping

Bug fixes

  • [PX-4436] Error in log when deleting user without secret
  • [PX-4794] Service status shows green even when there's no connection to connection manager
  • [PX-5232] Bad error message for duplicate authorized keys when using privx-cmd
  • [PX-5575] Monitoring status page components disappear too soon after disconnect
  • [PX-5760] RDP Proxy fails to start on some environments
  • [PX-5798] Typing becomes slower while mouse is hovering over clickable link in web client
  • [PX-5881] Secret search filters returns secrets that shouldn't be returned
  • [PX-5932] Passkey doesn't work with Graph directory users
  • [PX-5949] rdp-mitm fails when setting "Allow Role IP Restrictions" to false
  • [PX-5976] Using '!' character in web url breaks the url
  • [PX-5980] Target account of to AD Protected Groups does not work for RDP connection
  • [PX-6025] API returns wrong result when searching by user tag

Known Issues

  • [PX-1517] Permission denied for AuthorizedPrincipalsCommand on AWS RedHat AMI
    • Workaround: To correct SELinux context, copy the principals_command.sh to correct location:
      # scp -i key.pem principals_command.sh user@target:/tmp/
# ssh -i key.pem user@target "sudo cp /tmp/principals_command.sh /etc/ssh/"
  • [PX-1711] RDP fails to connect to target in maintenance mode, need support for /admin flag
  • [PX-1835] Extender/Carrier/WebProxy configs are not migrated on upgrade
  • [PX-1875] Web proxy login does not work, if login page does requests to multiple domains
  • [PX-2947] No sound when viewing recorded rdp-mitm connection.
  • [PX-3086] PrivX role mapping to AD OU not working as expected.
  • [PX-3529] Default access group CA key is always copied on the host when running the deployment script via Extender
  • [PX-4215] Successful OIDC login might generate too long auth code as query parameter causes access-token fetching to fail (there's a workaround in Nginx config since PrivX 27.0)
  • [PX-4218] RDP native clients do not work in Kubernetes environment when running under non-root account
  • [PX-4352] UI shows deleted local user after delete
  • [PX-4616] Upgrade may stop Carriers and Web Proxies from reconnecting.
    • Workaround: Restart affected Carrier and Web-Proxy services.
  • [PX-4650] Setting ​access_token_valid to "1m" kicks the user out to the login page
  • [PX-4662] Pasting larger text amount in Carrier/Proxy host fails (limited to 16kB for now)
  • [PX-4689] PrivX Linux Agent leaving folders in /tmp
  • [PX-4809] Empty file(s) created when ICAP detects malicious uploads with SCP via SSH Bastion.
  • [PX-5394] SSH cert auth conn fail after rotating PrivX CA Key
  • [PX-5558] Privx does not support password change required option for user in auth flow via passkey.
  • [PX-6061] Web target configured with Directory account type shows unix username to user but the username is not in use

Was this page helpful?