Warning
This release contains breaking API changes, meaning that existing API clients might not work anymore. Compatible Terraform provider and Kubernetes operator updates will be released together with a stable release.
Features
- Session approvals (JIT access): targets can now require an admin to approve each session before the connection is allowed, with configurable timeout and approval caching by @Eugeny in #2563
- MFA enforcement policy: a global setting to require or prompt enrollment of a second factor for all users, with an option to exempt SSO users by @Eugeny in #2555
- Default credential policy setting for new users, editable under Config → Policies by @Eugeny in #2557 (fixes #2556)
- Sessions are now split into user sessions and target sessions, so a single HTTP session lists all its target connections together in the admin UI by @Eugeny in #2499
- SSH host keys are now stored in the database instead of the data directory. Existing key files are imported automatically. in #2570
Fixes
- Internal error details (database, LDAP, TLS, upstream errors) are now hidden in HTTP responses; end users will see a correlation ID that can be cross-referenced to the server logs by @janisdombr in #2547
- SSH: sessions with a large amount of output could end without the client being told the channel was closed, leaving
sshhanging by @janisdombr in #2521 - fixed #2536 - do not record keypresses during interactive RDP logon, add an option to disable keyboard recording completely by @Eugeny in #2537
- Keep the auto-reconnect secret out of the RDP logon log line by @janisdombr in #2542
Other
- Docker images migrated from Debian bullseye to bookworm by @janisdombr in #2550
Full Changelog: v0.28.6...v0.29.0