Advanced Server Access release notes 2024-2025

Client

Server agent

• A backwards compatibility issue existed between the Advanced Server Access client and server agent with version 1.94.0, which exclusively impacted client trust forwarding.

• The --account flag has been deprecated and is now replaced by the --team flag.

• The Advanced Server Access client now supports RDP connections to Active Directory (AD) accounts on Windows AD servers managed by the Advanced Server Access server agent.

• All versions of the Advanced Server Access client older than version 1.66.4 are no longer available for download.

• The sft winscp command now supports selecting user access methods (UAMs) for Advanced Server Access servers. This command disconnects and automatically reconnects every 30 seconds.

• macOS 15 is now supported in Advanced Server Access client and MacFreeRDP client.

• Windows 10 (22H2) and Windows 11 (22H2, 23H2, and 24H2) are now supported in Advanced Server Access client.

• The ssh config command didn't work correctly on Windows when paths contained spaces.

• A vulnerability was resolved where it was possible for an external actor to inject false successful login events into the System Log without actually authenticating to a server.

• The sft putty command now supports selecting user access methods (UAMs) for Advanced Server Access servers.

• Enhanced security for transferring RDP credentials from the Advanced Server Access client to MacFreeRDP

• The sft command no longer adds the server name to the username when connecting through RDP with Windows and FreeRDP clients.

• The SSH logs are now included in the Linux gateway server support bundle.

• The ScaleFT CLI now only accepts HTTPS URLs.

Server Agent

• The timeout setting for SSH connections has been updated to address stale logins.

Clients

Server Agent

• Windows Server 2025 is now supported in Okta Privileged Access.

• Okta Privileged Access package versions on dist.scaleft.com/repos are now sorted by name and file version, with directories grouped.

• When enrolling a client, the hostnames in the URLs now match the hostnames in the enrollment request.

Gateway

Server Agent

• The support command didn't capture the sshd_config.d and ssh_config.d file logs.

• Support for using ssh.save_privatekey_passwords with the compat keyring on the Mac client is no longer supported.

• Default keyring used to protect SFT state.json has been changed from compat to the system keyring.

• Updated MacFreeRDP to upstream FreeRDP version 3.14.1.

• When the command sft fleet enroll --token-file <tokenfile> was run multiple times on the same client for the same team, the first attempt succeeded, but subsequent attempts resulted in an error.

• Users can now set a timeout for how long the system waits for confirmation of a failed connection before terminating the process. This timeout activates when an SSH connection is initiated.

• Removed the unsupported Advanced Server Access gateway for Windows OS.

Server agent

Gateway

• The SFT support bundles now include /etc/sudoers and /etc/sudoers.d/* files.

Client

Server Agent

• Wscapi.dll files now load from the system directory with a valid signature.

• sft-gatewayd.sample.yaml file had an invalid quote ( " ) in the ListenAddress parameter.

Client

Server agent

Gateway

• Advanced Server Access now supports Ubuntu 24.04.

The Advanced Server Access client CLI failed to display the timeout message and exit if there was a timeout while waiting for the user to choose a user access method.

Shift and control keys didn't work correctly when using MacFreeRDP.

Linux command-line tool (sft) now automatically encrypts tokens in state.json using D-Bus SecretService if detected.

You can now enable IP-session binding for web and client sessions within a team. If an IP change is detected, the client or web session is revoked.

• Starting May 01 2024, the Advanced Server Access client will no longer support the following operating systems:

  • macOS 10

  • macOS 11

• Starting May 01 2024, the Advanced Server Access client, server agent, and gateway will no longer support FreeBSD operating system.

• Secrets stored in state.json on Windows are now encrypted by default using the Windows Data Protection Application Programming Interface (DPAPI) before being written to disk.

• Secrets stored in state.json on macOS are now encrypted by default using the Keychain before being written to disk.