30.3

2024-01-10

PrivX 30.3 is an incremental release to address the Terrapin vulnerability. The fix includes the following changes:

PrivX SSH Proxy and SSH Bastion enable the OpenSSH strict KEX protocol extension when the target server and client express support for it during the initial KEX exchange.
[email protected] algorithm is removed from the sets of default sshtarget and sshclient ciphers.
[email protected] and [email protected] algorithms are removed from the sets of default sshtarget and sshclient macs.

It is possible to revert to using the vulnerable algorithm combinations by editing the /opt/privx/etc/ssh-algorithms.toml file. This is not recommended unless you are certain that all target servers and clients, that PrivX communicates with, support the OpenSSH strict KEX protocol extension.

30.2.1

2023-10-12

This minor release fixes Carrier browser images(chromium, chromium_lite, firefox, firefox_lite). Upgrade involves downloading new browser images and tagging them to match the current PrivX Carrier version.

This example shows how to upgrade the Chromium container image on PrivX Carrier 30.2.

docker pull public.ecr.aws/sshprivx/privx_browser_chromium:30.2.1
docker tag public.ecr.aws/sshprivx/privx_browser_chromium:30.2.1 public.ecr.aws/sshprivx/privx_browser_chromium:30.2

You don't need to restart PrivX Carrier after the command.

30.2

2023-09-21

PrivX 30.2 is an incremental release on top of PrivX 30.1 with security and bug fixes

[PX-6244] Channel may get closed in ssh-mitm exec connections before the output is sent to client

30.1

2023-07-13

PrivX 30.1 is an incremental release on top of PrivX 30.0. This release contains a few important bug fixes

[PX-6087] rdp-proxy can crash with an runtime error
[PX-6085] a role-store crash with fatal error is observed.
[PX-6076] privx-carrier status update causes slow memory leak

30.0

2023-07-03

Important Notes for This Release

Azure-Directory Migration to MS Graph

If you have set up Azure user/host directories using Azure AD Graph API, such directories will be automatically migrated to using MS Graph API when you upgrade to this release. After upgrade, you will still need to manually set the the following API permissions for the PrivX app in Azure Portal:

Microsoft Graph→Application Permissions

User.Read.All
GroupMember.Read.All

Azure AD Graph API shall be deprecated in June 2023.

For more information about setting up Azure directories with MS Graph, see Azure AD as a User Directory via Microsoft Graph API.

Required actions to optimize PrivX performance

As part of our ongoing effort to optimize PrivX performance, we have introduced additional indexing support from PrivX 28. Some improvement requires pg_trgm extension to PrivX database. Please read Improve Performance with Indexing before upgrade.

Deprecation Warnings

Redis Support Ending
We recommend you to use PostgreSQL PrivX inter microservice notifications. Please change notificaiton mechnism to PostgreSQL if your PrivX still uses Redis for notifications. Redis support will be ended in future releases

PostgreSQL 9.x and 10.x Support Ending

PostgreSQL 9.x and 10.x have reached end of life since 2021 and 2022 respectively and support for these database versions will be dropped in a future PrivX release. If you are running an old version for PrivX, please Upgrade PrivX Database to Supported Version

SHA-1-Certificate End of Support Imminent
Support for certificates signed with SHA-1 shall be dropped in future PrivX releases.

By default PrivX will not trust certificates with SHA-1 signatures unless they are self signed certificates. Re-enabling trust for such certificates requires setting the GODEBUG=x509sha1=1 environment variable for PrivX micro services and tools.

Practical attacks against SHA-1 have been demonstrated in 2017 and publicly trusted Certificate Authorities have not issued SHA-1 certificates since 2015.

privx-cmd and PrivX agent support for old Windows versions ending

privx-cmd and agent released after Q3/2023 may not support Windows 7, 8, Server 2008 and Server 2012. If you use native ssh client on Windows by connecting directly using privx-cmd, or Windows version of PrivX agent, please update your Windows.

Supported releases and upgrade path

After this release, we provide security and stability fixes for PrivX 30.x, 29.x, and 28.x. Older versions are not officially supported. We recommend you upgrade as soon as you can if you are running an unsupported version.

Upgrading to this version is supported from three previous major versions (29.x, 28.x, 27.x). For more information about upgrading from older versions, see Upgrade from Older Releases.

New Features

[PX-4465] Accessing database through PrivX
[PX-5163] PrivX OIDC SSO to web target via Web Carrier
[PX-5889] Chromium browser in Web Carrier supports password manager
[PX-3971] PrivX license model based on users and api clients

Improvements

[PX-5553] Allow listing all connections associated with one login session
[PX-5880] Troubleshooting script collects additional information
[PX-5996] Trail timestamp obfuscation is now configurable
[PX-5205] Send audit event before user's authorized key is going to expire
[PX-5928] Optimized audit event removal during housekeeping

Bug fixes

[PX-4436] Error in log when deleting user without secret
[PX-4794] Service status shows green even when there's no connection to connection manager
[PX-5232] Bad error message for duplicate authorized keys when using privx-cmd
[PX-5575] Monitoring status page components disappear too soon after disconnect
[PX-5760] RDP Proxy fails to start on some environments
[PX-5798] Typing becomes slower while mouse is hovering over clickable link in web client
[PX-5881] Secret search filters returns secrets that shouldn't be returned
[PX-5932] Passkey doesn't work with Graph directory users
[PX-5949] rdp-mitm fails when setting "Allow Role IP Restrictions" to false
[PX-5976] Using '!' character in web url breaks the url
[PX-5980] Target account of to AD Protected Groups does not work for RDP connection
[PX-6025] API returns wrong result when searching by user tag

Known Issues

[PX-1517] Permission denied for AuthorizedPrincipalsCommand on AWS RedHat AMI
- Workaround: To correct SELinux context, copy the principals_command.sh to correct location: 
```
# scp -i key.pem principals_command.sh user@target:/tmp/
# ssh -i key.pem user@target "sudo cp /tmp/principals_command.sh /etc/ssh/" 
```
[PX-1711] RDP fails to connect to target in maintenance mode, need support for /admin flag 
[PX-1835] Extender/Carrier/WebProxy configs are not migrated on upgrade
[PX-1875] Web proxy login does not work, if login page does requests to multiple domains 
[PX-2947] No sound when viewing recorded rdp-mitm connection. 
[PX-3086] PrivX role mapping to AD OU not working as expected. 
[PX-3529] Default access group CA key is always copied on the host when running the deployment script via Extender
[PX-4215] Successful OIDC login might generate too long auth code as query parameter causes access-token fetching to fail (there's a workaround in Nginx config since PrivX 27.0)
[PX-4218] RDP native clients do not work in Kubernetes environment when running under non-root account
[PX-4352] UI shows deleted local user after delete
[PX-4616] Upgrade may stop Carriers and Web Proxies from reconnecting.
- Workaround: Restart affected Carrier and Web-Proxy services.
[PX-4650] Setting access_token_valid to "1m" kicks the user out to the login page
[PX-4662] Pasting larger text amount in Carrier/Proxy host fails (limited to 16kB for now)
[PX-4689] PrivX Linux Agent leaving folders in /tmp
[PX-4809] Empty file(s) created when ICAP detects malicious uploads with SCP via SSH Bastion.
[PX-5394] SSH cert auth conn fail after rotating PrivX CA Key
[PX-5558] Privx does not support password change required option for user in auth flow via passkey.
[PX-6061] Web target configured with Directory account type shows unix username to user but the username is not in use