Keycyte PAM 3.2 · Release Notes

Fixed Issues

Keycyte PAM 3.2 fixes the following issues of earlier versions.

Security

An ADMIN account could create a user with the MASTER role and so gain MASTER rights. Now only a MASTER administrator can grant the MASTER role or change an account that holds it.
Text typed in a recorded session could run as markup in the browser of the administrator who played back the recording. Recorded text is now always shown as plain text.
The Admin Panel returned the cached sign-in password of users in some user responses. It is no longer returned.
Password Vault responses contained the password history in clear text, including the current password, for users who could see the entry. Password history is no longer returned in these responses; it is available only through the permission-checked history function.
In the Client Panel, an ADMIN listed as an owner of a vault entry could copy its password at any permission level. Copying now requires full access to the entry or a password role that allows copying, as in the Admin Panel.
The RADIUS and TACACS+ server settings returned the stored shared secret. The secret is now write-only.
The files of the Admin Panel could be downloaded without signing in. They are now served only to administrators.

Web terminal sessions could end without any record of why. The close reason is now sent to the SSH proxy and written to the client log for web terminal and native SSH sessions.
SSH sessions showed no Type in Session History, and the owner of an SSH session could not pause or share it.
Behind a load balancer, a colleague’s session on the same target account on another node was not detected and their desktop could be signed out.
Browser requests could fail with net::ERR_CONNECTION_CLOSED when several requests ran at the same time.
SFTP, SSH and session watching connections could drop in the middle of a session with WebSocket code 1006.
Session recordings could be left incomplete when the PAM server was stopped. Open sessions are now finished cleanly at shutdown so that their recordings are complete.

Cloning a server overwrote the server that was last opened for editing instead of creating a new server.
Servers of the 3rd party application type that were saved with an application selected from the list could not connect (“Third-party application not found”).
The Server Roles field of a vault entry was not saved. Server roles are now selected in the Servers field.
A password changed on Active Directory could be lost when the directory’s response contained a trailing NUL character.

Weekly role schedules never matched, so the role denied access on every day.
Time windows that end after midnight (for example 22:00–06:00) never matched.
The start and end dates of custom role schedules were not saved, so such roles were not limited at all.
Saving the authorized users or groups of a role could leave the role without any if an error occurred during the save.
The owner dialog of a role could add any account as owner or remove a MASTER co-owner. It now follows the same rules as bulk owner changes.

Account Report figures were wrong: rotated or verified accounts were counted as failed, and some charts read the wrong column.
Send now for a scheduled e-mail report always reported success, even when the e-mail could not be sent.
With more than one Syslog target, only one target received records, and an unreachable target stopped forwarding altogether.
Audit records that arrived while the Syslog targets were being read were dropped.

An exact match in user and group autocomplete could be pushed out of the results by longer names.
An unreachable LDAP server delayed every user search, including local and RADIUS users.

Applying a Web TLS certificate failed after a successful validation.
A full chain pasted into the certificate field caused a false “no chain was supplied” warning, and the intermediate certificate could be sent twice.
For a two-level internal CA, an incomplete chain was served.

Searches in role views did not match Turkish characters (for example “istanbul” did not find “İSTANBUL”).
The Save button of the permission profile dialog could be out of view on small screens.
Some texts were shown as translation keys, and the panels did not reload after an update when an outdated page part was requested.