Advanced Server Access release notes

• Advanced Server Access client, agent, and gateway now support RHEL 10 and Oracle Linux 10.

• Windows 10 Enterprise is no longer supported.

• RPM packages for Amazon Linux 2023 are now signed with SHA-256. This ensures that packages meet FIPS compliance requirements for admins using Amazon Linux 2023 and 2022 environments.

• The Advanced Server Access client --version command incorrectly included a DEBUG- prefix in the version text.

• Linux client tools, server tools, gateway, and RDP gateway are now packaged using native packaging tools for Debian and RPM-based systems.

• Launching RDP sessions from the web now displays the server name in the MacFreeRDP window.

• The sft client now sanitizes secret values before displaying them in the terminal to prevent command execution through malicious escape sequences. If you use terminal emulators like iTerm2, update your sft client to securely handle binary data and special characters.

• Windows users sometimes received an error message after exiting an SSH session established through a gateway.

• The sft client sometimes didn't clear session tokens after a user signed out. This could allow a subsequent user on the same machine to incorrectly reuse the previous session token for RDP connections.

• The sft client for Windows sometimes used an insecure communication configuration that could allow arbitrary command execution during data deserialization.

• When a user initiated a Remote Desktop Protocol (RDP) session from the web interface, the session sometimes failed to use the correct team context if the client was already authenticated to a different team.

• RSA keys created for proxy commands now use a larger key size to improve security.

• After upgrading the Advanced Server Access client to version 1.95.0 or higher on Windows, the scp command failed to work as expected.

• Advanced Server Access now supports Linux systems with shared home directories. Admins can now configure the Advanced Server Access server agent to bypass provisioning the authorized principals file to a user's home directory, which eliminates log pollution issues on systems using Network File System (NFS).

• When enrolling a Microsoft Windows 11 client, the enrollment approval page incorrectly displayed the operating system as Microsoft Windows 10.

• Advanced Server Access client versions 1.93.0 and 1.94.0 failed to fall back to locally supported authentication methods when an admin attempted to connect to an unmanaged server using the --via flag.

• You can now use the --account flag to connect to your server account for SSH or RDP access.

• Digital signature verification has been added for all DLLs loaded from outside the trusted system paths.

• Local account discovery, synchronization, and group membership management are now disabled for hosts that are Windows Domain Controllers.

• A backwards compatibility issue existed between the Advanced Server Access client and server agent with version 1.94.0, which exclusively impacted client trust forwarding.

• The --account flag has been deprecated and is now replaced by the --team flag.

• The Advanced Server Access client now supports RDP connections to Active Directory (AD) accounts on Windows AD servers managed by the Advanced Server Access server agent.

• All versions of the Advanced Server Access client older than version 1.66.4 are no longer available for download.

• The sft winscp command now supports selecting user access methods (UAMs) for Advanced Server Access servers. This command disconnects and automatically reconnects every 30 seconds.

• The SSH logs are now included in the Linux gateway server support bundle.

• Okta Privileged Access package versions on dist.scaleft.com/repos are now sorted by name and file version, with directories grouped.

• The support command didn't capture the sshd_config.d and ssh_config.d file logs.

• Support for using ssh.save_privatekey_passwords with the compat keyring on the Mac client is no longer supported.

• Default keyring used to protect SFT state.json has been changed from compat to the system keyring.

• Updated MacFreeRDP to upstream FreeRDP version 3.14.1.

• When the command sft fleet enroll --token-file <tokenfile> was run multiple times on the same client for the same team, the first attempt succeeded, but subsequent attempts resulted in an error.

• Wscapi.dll files now load from the system directory with a valid signature.

You can now enable IP-session binding for web and client sessions within a team. If an IP change is detected, the client or web session is revoked.