About This Guide

These release notes describe Keycyte PAM 3.2 (build 3.2.5). They list the changes since Keycyte PAM 3.0.

Intended Audience

This document is intended for everyone who installs, upgrades or uses Keycyte PAM.

Contents

Version Information

The version of a running installation is shown in the footer of the Admin Panel.

What's New in Keycyte PAM 3.2

Keycyte PAM 3.2 introduces the following new features and improvements.

Administration and Permissions

• Permission profiles. A new page, Settings > Permission Profiles, defines what ADMIN accounts may do in each Admin Panel module (view, add, edit, delete). Every ADMIN account is assigned a profile. The menu, pages and buttons of the Admin Panel follow the profile. MASTER accounts are never restricted by profiles.
• Tags. Servers and Password Vault entries can be tagged. Tags are managed on Settings > Tags and can be used to filter lists. Only MASTER administrators can create, delete and merge tags.
• Password Vault recycle bin. A deleted vault entry is moved to the recycle bin (Settings > Recycle Bin) and can be restored until its retention period ends. The retention period is configurable.
• Runtime log level. The log level of the PAM server can be changed on Settings > General without a restart.
• Light and dark theme. Both panels have a theme switch in the top bar, and the choice is saved per user.
• Sortable tables. Clicking a column header sorts the whole list in tables that are paged in the browser, in both panels. Sorting is language-aware and keeps the row selection.

Roles and Access Control

• Bulk actions for roles. On Server Roles and Password Roles, a Bulk actions menu changes several roles at once: features, schedule, authorized users and groups, owners and tags. Each bulk change runs as one transaction, reports updated, unchanged, forbidden and not found roles, and is written to the audit log.
• Clearer role tables. The role tables show the authorized users and groups, the member count and the enabled features. Roles can be filtered by an authorized user or group, for example to remove a person from every role at once.
• Role schedules. Weekly schedules, overnight time windows (for example 22:00–06:00) and custom date ranges are enforced for server, password and user roles. The role list shows each role’s schedule.
• Server picker in the Password Vault. The Servers field of a vault entry offers server roles and shortcuts such as “All RDP servers” and “All SSH servers” in addition to individual servers.

Password Management

• Self-first password change. For Windows and Active Directory accounts, the password policy has a new Change Method: the account changes its own password first and falls back to a privileged reset (default), reset only, or self change only. Every change is verified by signing in with the new password, and every step is written to the Password Manager log.
• Self-change skip. If an account cannot change its own password for a lasting reason, it is reset with the privileged account for 30 days. The Password Vault shows this, and Retry self change in the action menu ends the skip for one account.

Network Device Access

• TACACS+ server. Keycyte PAM provides a TACACS+ server for authentication, authorization and accounting of network device administrators. It is configured on Settings > TACACS+ Server. A server can be registered as a TACACS+ device with its own shared secret, and server roles carry a TACACS+ privilege level.

Integrations

• Secrets API. Applications can read secrets from the Password Vault through the Secrets API with service identities and API keys. API keys have an expiry, can be revoked, and are flagged when they are not used for a long time. The API reference is available from the Admin Panel.
• Several Syslog targets. Audit records are forwarded to every enabled server on Settings > Syslog Settings. Each target has its own queue, so an unreachable target no longer delays the others. Targets are validated when they are saved.
• Faster user and group search. User and group autocomplete shows exact matches first, then names that start with the search term, then names that contain it. Directories are searched in parallel with time limits, and an unreachable directory no longer blocks the search; a note under the field tells you when a directory could not be reached.

Sessions and Reporting

• Detailed analysis of session reports. Session Reports have a new Detailed analysis tab: filter sessions by users, servers, accounts, time, duration, close reason, recording and client, group them on a chosen axis, view totals and a trend chart, compare with the previous period, export to CSV or Excel and open the matching sessions in Session History. Filter sets can be saved and shared.
• Client IP on File History. File History has an optional Client IP column.
• Close reasons for SSH sessions. The reason why a web terminal or native SSH session ended is written to the client log.
• Session keepalive. The Client Panel keeps the connection of an open session alive and shows a prompt when the sign-in session expires, instead of closing the session without notice.
• Kubernetes protocol. Kubernetes is available as a server protocol.

Client Panel

• Black terminal theme. A new Black terminal theme shows terminal sessions on a pure black background. The area around the terminal takes the color of the selected theme.

Security and Certificates

• Web TLS certificate management. On Settings > Web TLS Certificate, the certificate, key and chain can be loaded from PEM files. A full chain pasted into the certificate field is split automatically, chains of internal CAs without the root are accepted with a warning, and the chain is served in issuer order. Keys that browsers cannot use (Ed25519, ECDSA P-521) and password-protected keys are refused with a clear message.
• Write-only shared secrets. The RADIUS and TACACS+ shared secrets are no longer shown after they are saved.
• Protected Admin Panel files. The files of the Admin Panel are served only to signed-in administrators.

Fixed Issues

Keycyte PAM 3.2 fixes the following issues of earlier versions.

Security

• An ADMIN account could create a user with the MASTER role and so gain MASTER rights. Now only a MASTER administrator can grant the MASTER role or change an account that holds it.
• Text typed in a recorded session could run as markup in the browser of the administrator who played back the recording. Recorded text is now always shown as plain text.
• The Admin Panel returned the cached sign-in password of users in some user responses. It is no longer returned.
• Password Vault responses contained the password history in clear text, including the current password, for users who could see the entry. Password history is no longer returned in these responses; it is available only through the permission-checked history function.
• In the Client Panel, an ADMIN listed as an owner of a vault entry could copy its password at any permission level. Copying now requires full access to the entry or a password role that allows copying, as in the Admin Panel.
• The RADIUS and TACACS+ server settings returned the stored shared secret. The secret is now write-only.
• The files of the Admin Panel could be downloaded without signing in. They are now served only to administrators.

Sessions

• Web terminal sessions could end without any record of why. The close reason is now sent to the SSH proxy and written to the client log for web terminal and native SSH sessions.
• SSH sessions showed no Type in Session History, and the owner of an SSH session could not pause or share it.
• Behind a load balancer, a colleague’s session on the same target account on another node was not detected and their desktop could be signed out.
• Browser requests could fail with net::ERR_CONNECTION_CLOSED when several requests ran at the same time.
• SFTP, SSH and session watching connections could drop in the middle of a session with WebSocket code 1006.
• Session recordings could be left incomplete when the PAM server was stopped. Open sessions are now finished cleanly at shutdown so that their recordings are complete.

Servers and Password Vault

• Cloning a server overwrote the server that was last opened for editing instead of creating a new server.
• Servers of the 3rd party application type that were saved with an application selected from the list could not connect (“Third-party application not found”).
• The Server Roles field of a vault entry was not saved. Server roles are now selected in the Servers field.
• A password changed on Active Directory could be lost when the directory’s response contained a trailing NUL character.

Roles

• Weekly role schedules never matched, so the role denied access on every day.
• Time windows that end after midnight (for example 22:00–06:00) never matched.
• The start and end dates of custom role schedules were not saved, so such roles were not limited at all.
• Saving the authorized users or groups of a role could leave the role without any if an error occurred during the save.
• The owner dialog of a role could add any account as owner or remove a MASTER co-owner. It now follows the same rules as bulk owner changes.

Reports and Logs

• Account Report figures were wrong: rotated or verified accounts were counted as failed, and some charts read the wrong column.
• Send now for a scheduled e-mail report always reported success, even when the e-mail could not be sent.
• With more than one Syslog target, only one target received records, and an unreachable target stopped forwarding altogether.
• Audit records that arrived while the Syslog targets were being read were dropped.

Directory Search

• An exact match in user and group autocomplete could be pushed out of the results by longer names.
• An unreachable LDAP server delayed every user search, including local and RADIUS users.

Certificates

• Applying a Web TLS certificate failed after a successful validation.
• A full chain pasted into the certificate field caused a false “no chain was supplied” warning, and the intermediate certificate could be sent twice.
• For a two-level internal CA, an incomplete chain was served.

User Interface

• Searches in role views did not match Turkish characters (for example “istanbul” did not find “İSTANBUL”).
• The Save button of the permission profile dialog could be out of view on small screens.
• Some texts were shown as translation keys, and the panels did not reload after an update when an outdated page part was requested.

Upgrade Notes

Read these notes before you upgrade an existing installation to Keycyte PAM 3.2.

Before You Upgrade

• Back up. Create a backup on Settings > Backup and copy it off the host. Also back up the installation package folder, including the .env file, and the ~/record and ~/drive directories.
• Keep the encryption key. The new version must use the same encryption key (KEYSTORE_KEY_HEX) and session secret (SESSION_SECRET_KEY) as the current installation. Otherwise stored secrets, backups and recordings cannot be decrypted.
• Upgrade the Password Manager first. The self-first password change of Keycyte PAM 3.2 requires the Password Manager service of the same release. Deploy the new Password Manager before or together with the PAM server.
• Plan a maintenance window. Active sessions are interrupted while the containers restart.
• Several nodes. Upgrade all nodes to the same version.

Database Schema

The database schema is migrated automatically when the PAM server starts. The PAM server creates new tables and adds new columns and indexes; it does not drop existing columns or indexes. No manual database step is required. If the migration fails, the PAM server does not start and logs Failed to run ent auto-migration.

Changed Behavior

Check the following changes after the upgrade:

• Role schedules are enforced. Weekly schedules, overnight time windows and custom date ranges now work as configured. Roles that denied access because of the earlier issues start granting access within their configured windows. Review the schedules of your server, password and user roles.
• Password change method. Existing password policies use the new default change method: the account changes its own password first, then falls back to a privileged reset. Review the Change Method of your password policies.
• ADMIN accounts need a permission profile. ADMIN accounts are restricted by permission profiles. Review the profiles on Settings > Permission Profiles and the profile assigned to each ADMIN account. When a backup taken before permission profiles existed is restored, every ADMIN account receives the built-in full profile.
• Deleted vault entries go to the recycle bin. Deleting a vault entry moves it to Settings > Recycle Bin until its retention period ends. The archived password is not changed on the target system during this period.
• 3rd party application servers. Servers of the 3rd party application type that store the application’s name instead of its ID must be edited: open the server, select the application again and save.
• MFA lockout. The account lockout after failed MFA verifications applies to all user types. Its duration is set with KEYCYTE_MFA_LOCKOUT_DURATION_MIN (default 15 minutes).
• Service access keys. Service access keys are read only from the environment (.env). They cannot be created or rotated in the Admin Panel.
• Request rate limiting. The PAM server no longer limits the request rate per client. Configure rate limiting on a reverse proxy if you need it.
• Session cookie. The session cookie is sent with the __Host- prefix. If you upgrade from a version that did not use the prefix, users are signed out once after the upgrade and must sign in again.