PAM360 Release Notes

New Features

• Cloud Entitlements Management via PAM360

  Introducing Cloud Infrastructure Entitlements Management (CIEM) in PAM360, a centralized platform designed to enhance governance and secure cloud entitlements by unifying control over permissions and policies. CIEM in PAM360 proactively identifies risks from excessive permissions, policy violations, and misconfigurations, providing a comprehensive view of vulnerable permissions across AWS cloud environments

  With built-in detection and mitigation workflows, CIEM in PAM360 supports the achievement of Zero Standing Privileges, effectively reducing security vulnerabilities to protect cloud infrastructure from end-to-end.

  Feature Highlights
  • Enhanced Visibility: Obtain in-depth insights into cloud entitlements and permissions through a centralized platform, enabling informed decision-making.
  • Detailed Access Mapping: Visualize user permissions and entitlements for easy management and adjustments.
  • Proactive Risk Mitigation: Identify excessive privileges and vulnerable permissions and mitigate risks by leveraging inline policies for effective management.
  • Right-Size Permission Management: Implement a Just Enough Access (JEA) model by enforcing least privileges to all the accounts.
  • Compliance Assurance: Ensure continuous adherence to industry regulations with ongoing monitoring of compliance.
  • Refer to our help documentation to know more about in detail.
• Domain Account Password Update in ADMP via PAM360

  Administrators can now associate ADManager Plus' (ADMP) privileged domain account directly with the corresponding domain account in PAM360. This integration ensures that whenever a password rotation is performed for a domain account in PAM360, the updated password is automatically synchronized in ADMP. This automation eliminates the need for manual intervention in ADMP, thus ensuring seamless access continuity for Active Directory users.

Enhancements

• From build 7300 onwards, the PAM360 agent will get installed in the 'systemd' software suite for utilizing the parallel processing of agent installation and other agent capabilities.
• PAM360 now offers digital signature support for the agent files, enhancing authenticity and protection against tampering.

Performance Improvement

PAM360 now features a significant improvement in overall performance, tailored for organizations that heavily depend on dynamic resource groups, delivering greater efficiency and responsiveness.

UI/UX Enhancement

In this release, we have modernized our PAM360 icons with a new design pattern, thus enhancing the user interface with a complete visual refresh for a more engaging user experience.

Security Enhancement

We have enhanced our security checks against Path Traversal, Local File Inclusion, Stored XSS, Reflected XSS, Denial of Service, Usage of Static Variables, and other few vulnerabilities.

Security Fixes

• A stored XSS vulnerability that occurred while managing user organization access has been found and fixed.
• We have addressed the issues that allowed unauthorized access to users for the following actions:
  • Viewing a password access request raised to an authorized administrator
  • Editing a resource without provided edit privilege
• We have resolved a Remote Code Execution (RCE) vulnerability that allowed adversaries to execute arbitrary commands in the following scenarios:
  • Transferring files over Legacy SSH connection
  • Deploying certificates on Linux resources
  • Rotating SSH keys on Linux resources
• An issue that caused the domain account discovery operation to fail for users with Full Access permission to Windows Domain resources has been resolved.

New Feature

Introducing the Transfer User Accountabilities feature under user actions within the Users tab. This feature enables the seamless transfer of all assets and approval responsibilities from one user to a new PAM360 user. When a user leaves the organization or department, this feature ensures a smooth transition of resources, delegation of permissions, and approval privileges with just one click.

Refer to our help documentation to know more about in detail.

PAM360 now supports creating a new database resource type with a customized set of database attributes. This functionality enables users to add their uniquely configured MS SQL, PostgreSQL, Oracle DB, Sybase ASE, NoSQL, and other SQL server databases that support JDBC as new resources in PAM360. With this enhancement, users gain the flexibility to perform password management and SQL auto logon for their unique databases, tailored to their specific management needs, thus empowering users to precisely align their database resources with their day-to-day requirements.

PAM360 now provides NIS2 Compliance Reporting, enabling organizations to generate applicable comprehensive reports related to the 140+ NIS2 directives for compliance verification and reporting purposes. These reports offer detailed insights into how privileged access is managed and aligned with NIS2 standards, and they allow users to track access activities and monitor incident responses. With built-in support for privileged access tracking and incident response monitoring, organizations can ensure they meet NIS2 requirements efficiently.

New Integration

PAM360 now integrates with ManageEngine IT Operations Management (ITOM) applications for efficient IT infrastructure management. With this integration, whenever a password is changed remotely in PAM360, the updated passwords for network devices stored in the PAM360 database are automatically synced to the ITOM database. This integration ensures secure IT infrastructure management by safely storing passwords in PAM360 and sharing them as needed with the appropriate ITOM applications.

Enhancements

• As part of our commitment to aligning with PCI DSS 4.0, which includes updates to existing requirements and the introduction of new measures to address emerging threats, we have delivered the essential PAM360 reports and information in this build to ensure compliance with the latest PCI DSS standards.
• Starting from build 7200, PAM360 allows administrators to set up Just-In-Time (JIT) privilege elevation for Windows Domain accounts directly within the PAM360 environment in addition to the existing ADManager Plus (ADMP) integration option.
  Note: Please note that this update does not impact the existing JIT privilege elevation configurations of Windows Domain resources set up through integration with ManageEngine ADManager Plus (ADMP). However, administrators can now leverage this new configuration option while setting up further JIT privilege elevation configurations for Windows Domain resources.
• Users can now generate audit summaries for all resource, user, and task audit trails, along with related audits for all resource and task trails. These enhancements offer a comprehensive overview of all details associated with specific audits, making it easy for users to access and review relevant information in one location. Additionally, audit summaries and related audits can be exported or emailed, providing convenient access and documentation.
• Administrators can now use domain accounts to reset the passwords of Windows local accounts during remote password resets for both individual and bulk configurations.
• From build 7200 onwards, the PAM360 service will get installed in 'systemd' software suite for utilizing the parallel processing of services and other service capabilities.
  Note: However, for existing users, the service will remain the same in the 'initd' process control system unless they choose to change it. If you are an existing user and want to change the service to 'systemd' software suite, follow the procedure mentioned here.
• Administrators can now configure keyboard language for the users' remote sessions via Remote Session Management in General Settings, and further, users can opt for the desired keyboard language for their remote sessions via the Remote Session Settings provided in the My Profile dropdown.
• Earlier, when creating a dynamic resource group or associating resources to a dynamic group, administrators could only specify criteria using either 'Match all of the following' (AND) or 'Match any of the following' (OR). From now on, administrators can specify dynamic criteria using AND and OR logic with the desired conditions and subsets in diverse combinations.
• Earlier, when an SSH proxy was configured with a resource, it could be modified with a new resource but could not be disabled. In this build, we have introduced the option to disable the SSH proxy configured for the Remote Connect application.
• We have introduced the Connection View page to the global search results, alongside the Detailed View tab.
• In addition to TLS protocol version 1.1 and 1.2, PAM360 now supports TLS version 1.3 for agent and HTTPS communication.
• Previously, transferring ownership of a resource discovered through an agent required manual updates to the configuration file to complete the process. Now, ownership can be seamlessly transferred directly through the user interface (UI), eliminating the need for configuration file updates.
• From now onwards, the special character '-' can now be included when generating passwords, offering greater flexibility in password creation.

Behavioral Changes

• PAM360 now supports OAuth 2.0 authentication for server-to-server interactions during remote password resets of Google Workspace resources, enhancing security. As a result, the remote password reset configuration has to be updated for such resources with a few additional inputs.
  Note: The existing remote password reset configurations for Google Workspace resources will no longer rotate passwords, and you will have to reconfigure them for seamless password rotations.
• Starting from build 7200, user authentication tokens will now have access validity periods defined in days. To maintain access validity, users should regenerate their authentication tokens consecutively in the specified intervals. This proactive measure ensures that tokens do not expire prematurely. In cases where tokens expire, administrators can regenerate them for continued user usage.

Upgrade

The Apache Tomcat server has been upgraded from version 9.0.54 to 9.0.78.

Bug Fixes

• Previously, when a user launched a RDP session for an resource with incorrect credentials, the session window remained open despite the authentication failure. This issue has now been resolved
• Starting with build 6100, enabling Sync Account Deletion under General Settings >> Resource / Password Creation caused a problem where attempting to discover accounts from resources added via the PAM360 agent inadvertently deleted all existing accounts in the PAM360 repository associated with that resource. This issue has now been resolved.
• Previously, users have experienced random connection request failures in the PAM360 application installed in the AWS environment with the application load balancer. This issue has now been addressed.
• From build 6710, the reason field in the user audit displayed incorrect formatting for usernames containing '\n' characters, causing the '\n' to be removed. This issue has now been resolved.
• Fixed an issue where the user audit captured upon adding a user to a user group was missing the user group name.
• Earlier, when users attempted to launch a remote session using the logged-in AD account from the connections tab, there were some inconsistencies in the displayed remote access protocols. This issue has now been resolved.
• In build 7100, when configuring remote password reset for a dynamic group, despite setting the password allocation to 'Assign same password to all accounts, but change during every schedule,' unique passwords were generated for each account. This issue has been resolved.
• Previously, modifications made to the user group description were not updated, resulting in the old description being displayed. This issue has also been fixed.
• Previously, modifying the Group Name in AD synchronization schedules occasionally resulted in a failed operation. This issue has now been resolved.
• Previously, an issue occurred when multiple password rotations were triggered for resources added via an agent within the specified timeout interval. This has now been resolved, ensuring smoother and more controlled operations.
• In the earlier MSP builds, when attempting to replicate audit purge settings across client organizations, there was a discrepancy in the configured number of days in the MSP and the client organizations. This issue has now been addressed.
• An issue that prevented the rotation of the encryption key when executing RotateKey.bat in environments using RDS MSSQL as the backend database has been found and fixed.

Security Enhancement

In this release, we have eliminated the Struts framework dependencies and utilized the internal libraries for executing the operations, thereby enhancing the security of PAM360.

Security Fixes

We have addressed issues that previously allowed unauthorized access to low-privileged users for the following actions:

• Viewing attributes, resource names, and account names of unshared resources
• Sending password access requests to unauthorized administrators
• Fetching resource owner details of unshared resources
• Viewing user details, emails, and relevant user group information

New Feature

PAM360 now extends its capabilities beyond service account discovery to include the discovery of privileged domain accounts, such as enterprise administrator and domain administrator accounts, within Windows Domain resources. This feature comes with customizable discovery criteria and synchronization schedules, empowering administrators to manage access to these high-level accounts efficiently. By ensuring precise administration of accounts in Windows Domain resources, this enhancement significantly streamlines the management of privileged domain accounts.

Performance Improvements

PAM360 now has a significant enhancement in the performance of the periodic password rotation, delivering up to a minimum of 10 times faster operation times under standard system environmental conditions. This improvement is particularly beneficial for organizations with extensive resources, providing critical efficiency gains, especially during emergencies requiring rapid password rotations. Notably, the enhancement significance for a few has been displayed here for a sample:

• Rotating passwords for a resource group of 800 Linux resources now takes approximately five minutes, down from the previous 68 minutes.
• Rotating passwords for a complex resource group of 10,000 resources (including 4,000 Windows and 6,000 Linux resources) now completes in about 39 minutes, a substantial reduction from the previous 14 to 20 hours.

This enhancement underscores the commitment to improving operational efficiency and productivity in managing password resets across diverse IT environments.

Enhancement

Users can now access a streamlined support reporting feature within the PAM360 application. This enhancement allows users to report issues directly to the support team from PAM360, providing essential details and logs efficiently.
Navigate to Profile >> Support and click Report an Issue for more details.

New Features

• Kubernetes Integration for TLS Secrets

  PAM360 now integrates with Kubernetes (K8s) - an open-source platform that automates containerized application deployment, scaling, and secrets management. Kubernetes secrets, a feature provided by the Kubernetes platform, facilitates a secure way of storing Kubernetes TLS secrets (certificates) within Kubernetes clusters.

  The integration aids administrators in securely fetching the Kubernetes TLS secrets (certificates) into PAM360, managing them within the single centralized repository, and rotating/updating the secrets obtained from multiple Kubernetes clusters.

  To configure and manage all your Kubernetes TLS secrets (certificates) via PAM360, navigate to 'Certificates >> Kubernetes' in the PAM360 console.

• Private Certificate Authority (CA) / Intermediate CA

  PAM360 now offers a new feature, Private CA (Intermediate CA), that allows organizations to create and manage their certificates internally. Selected users can sign the end-user certificates for internal servers, applications, and services using the intermediate certificate, signed using the root certificate.

  With this feature, organizations can:

  • Achieve enhanced security and gain more control over their certificate management process without relying on external CAs.
  • Minimize the risk of external threats and improve their overall certificate management process.
  • Streamline the process of issuing and revoking certificates while maintaining complete control over their certificate authority, thus ensuring the certificates issued by the organization are trusted and secure, making it easier to manage and monitor all the internal certificates in one central location.

• Azure Key Vault - TLS Secrets Management

  PAM360 now allows users to manage the TLS secrets stored in the Secrets of Microsoft Azure Key Vault - a management service offered by Microsoft. Through this integration, users can create (PFX format), renew, and manage the entire lifecycle of SSL/TLS certificates stored in the Secrets of Azure Key Vault via PAM360 by importing them into the PAM360 repository.

• Configurable ACME

  PAM360 supports adding ACME providers for the effective automation of certificate lifecycle management. Just like its integration with renowned certificate authorities such as Let's Encrypt, Buypass Go SSL, and ZeroSSL, which offers automated SSL/TLS certificate management, PAM360 now has the flexibility to incorporate other ACME service providers, thus empowering efficient certificate management with the automated precision. To explore more about the configurable ACME, navigate to 'Admin >> SSL Certificates >> ACME Providers'.

Enhancements

• PAM360 is enhanced with the capability of discovering certificates from the FortiGate Firewalls. Furthermore, it now facilitates the addition and administration of multiple FortiGate Firewall accounts, along with the individual deployment of certificates.
• A new option has been provided under 'Certificates >> Certificates >> Multiple Servers' to allow users to add additional fields, such as character, date, and email, on the Multiple Servers page.
• It is now possible to include the multiple server lists of the SSL certificates in the notification email of the SSL expiry schedule.
• DigiCert is now added as a vendor to the SSL Store list. The previously available SSL Store vendors, which include Thawte, Geo Trust, and Rapid SSL, will now be a part of Digicert.
• It is now possible to add an email address while configuring 'Certificate Sync Status Check' from 'Admin >> SSL Certificates >> Certificate Sync Status'. Once added with the configured recurrence time interval, the list of all the SSL certificates with their deployed servers will be sent to the given email address, with the following details: days to expire, date of expiry, serial number, and fingerprint.
• Henceforth, while creating a Certificate Signing Request (CSR), only the Common Name, Validity, and Store Password will be the mandatory fields.
• The following additional key sizes to the key algorithms have now been added for enhanced security strength:
  • 3072 and 4096 key sizes for RSA
  • 2048 and 3072 key sizes for DSA
• PAM360 now supports SHA256 SSL fingerprint to encrypt the SSL certificates. Administrators can navigate to 'Admin >> SSL >> SSH/SSL Config >> SSL Fingerprint' to change their SHA values. In addition to that, all the existing certificates can also be changed to SHA256 fingerprint by enabling the checkbox provided.
• From now onwards, the keys dashboard in PAM360 will not consider the EC certificate key size into account for the 1024-bit and lesser keys calculation.
• New RESTful APIs: The following new REST APIs have been introduced in PAM360:
  • Import User from AD/Entra ID - To import a user from an Active Directory or Microsoft Entra ID to PAM360.
  • Fetch all SSL/SSH Audit Details - To fetch all the Keys and Certificate audits from PAM360.
  • Discover SSL in Bulk from Files - Performs SSL discovery based on the DNS names stored in the files.
  • Fetch SSL Vulnerability Count - To fetch the total number of SSL vulnerabilities.
  • Fetch SSH Key Passphrase - To fetch the passphrase of an SSH key.
  • Import CSR - To import the Certificate Signing Request (CSR) by providing valid information.
• Previously, the CSRs were signed in REST API using MSCA. From now on, either MSCA or root CA can be used to sign the CSRs, and in addition, the API response will display the certificate serial number for further API-related use.
• From this build onwards, additional field data can be added as a dropdown option by giving the desired values via 'Admin >> SSH/SSL Config >> Additional Fields >> Dropdown'.
• The 'Certificate Details' will now show the additional field(s) information related to the SSL certificates in the 'SSL' tab.
• From now on, users can create CSR by importing the KeyStore file from the PAM360's SSL repository instead of exporting them locally and importing them back for CSR creation.
• Henceforth, all the SSL discoveries performed via public Certificate Authority (CA) integrations will be recorded in the Audit window.
• A new PKCS 8 export type that permits additional exportation capabilities has been introduced.
• PAM360 now supports 'DNS Made Easy' to complete domain control validation while acquiring certificates from public Certificate Authorities, alongside the available DNS support types.
• The SSL Expiry Report data will now be sorted based on the expiry date.
• We have introduced two additional certificate conversion formats in the Tools section, now supporting the conversion from Java KeyStore (.jks) to Privacy Enhanced Mail (.pem) and vice versa.
• Users can now import SSH keys in bulk, provided the keys are passwordless or share the same passphrase.

• Microsoft Entra ID Integration

  PAM360 now offers enhanced functionality for importing users from Microsoft Entra ID, including the ability to:

  • Assign roles and languages
  • Configure Two-Factor Authentication
  • Search user groups

  Additionally, the Role, Language, and Two-Factor Authentication information is now displayed on the 'Microsoft Entra ID Synchronization Schedules' page, allowing administrators to:

  • Add synchronization schedules for user import
  • Edit schedules using the 'Edit Schedule' icon under 'Actions'
  • Import users instantly using the 'Import Now' icon under 'Actions'
  • Perform bulk edit and import operations
  • Modify roles, languages, Two-Factor Authentication, and synchronization intervals for each user group configured with a user import schedule
  • Add, edit, and delete domain details

• LDAP Integration

  PAM360 has improved its LDAP integration user-import capabilities, enabling administrators to:

  • Assign roles and languages
  • Configure Two-Factor Authentication

  These enhancements are reflected on the LDAP Server Configuration page, where administrators can now:

  • Edit schedules using the 'Edit Schedule' icon under 'Actions' for Groups and OUs
  • Perform bulk edit operations
  • Assign roles and languages and configure Two-Factor Authentication for users imported from LDAP (Group/OU/Search Filter)

Note: For both Microsoft Entra ID and LDAP, configurations applied during the initial import will be retained in subsequent schedules unless modified.

Bug Fixes

• The SSH and SSL discovery (including scheduled discovery) results had the IP address(es) provided in the 'Exclude IPAddress' field. This issue has now been fixed.
• In the notification policy, email notifications pre-configured by administrators for the expiry of PGP keys were sent at configured intervals without the subject or details, even when no PGP keys were present. This issue has now been fixed.
• The IP and the DNS fields had similar entries when an IP was not resolved into DNS, thus creating duplicate entries on the multiple server pages. This issue has now been fixed.
• Earlier, in addition to the latest version, .Net Framework version 3.5 was required for IIS binding. Following the fix, .Net Framework version above 4 will be sufficient to bind a certificate to a website in IIS.
• When adding or updating the schedules, they relied on the client machine's date instead of the server's. This issue has now been fixed.
• In the notification policy, email notifications pre-configured for certification expiry were sent without any subject or details at configured intervals. This issue has now been fixed.
• An issue that led the SSL discovery to fail with an exception message - 'certificates do not conform to algorithm constraint' has been fixed.
• An issue in fetching some columns from the ServiceNow help desk that appear under 'Admin >> Integrations >> Ticketing system' has now been fixed.
• When an administrator tried to rediscover the certificates in an organization, it failed with an empty error message. This issue has now been fixed.
• The revoked status of the certificates was still showing even after the renewal of revoked certificates in MSCA. This issue has now been fixed.
• The load balancer discovery schedule failed when specified with a port number during the schedule configuration. This issue has now been fixed.
• When signing a CSR with a certificate, SHA256 was being used as the default signature algorithm instead of the signer certificate's signature algorithm. This issue has now been fixed.
• The Subject Alternate Name that contains a Principal Name faced a parsing error during the certificate operations. This issue has now been fixed.
• An issue in creating certificates with multiple organizations and organization units has been fixed.
• The IIS binding failed with SHA256 SSL fingerprint enabled. This issue has now been fixed.
• Saving the IIS binding updated other rows with incorrect values under 'Admin >> SSL Certificates >> IIS Binding'. This issue has now been fixed.
• The self-signed certificates that are auto-renewed accumulated over the new discovery list. This issue has now been fixed.
• When the SAN field in the CSR request page included an IP address, it was not appearing in the SSL parser or the SSL certificate details page. This issue has been rectified in this update.
• In previous versions, after certificate renewal, auto-deployment to MS Store failed in a few cases. This issue has now been fixed.
• Previously, the SSH session to a target resource via landing server using domain authentication was not functioning as intended. This issue has now been fixed.
• In build 6710, users were unable to launch RDP, SSH, and VNC connections to a target resource due to a mismatch in the gateway server settings. This issue has now been fixed.

Security Fixes

• A stored XSS vulnerability caused by the Key Name parameter after associating a key via Public Key Association has been fixed.
• We have fixed a Remote Code Execution (RCE) vulnerability that allowed the adversary to execute the arbitrary command on the Windows machine via the SSL agent.
• An issue that allowed an unauthorized access to a user to add the user of an MSP organization to the client organization's user group has been found and fixed.
• A stored XSS vulnerability, which occurred while importing the IdP certificate file from the File Store or Key Store in PAM360 has been identified and fixed.
• An issue that allowed an API user with administrative privileges to perform the following unauthorized accesses has been found and fixed.
  • To reject a password access request raised to an authorized administrator
  • To check-in the password access request approved by an authorized administrator
• An issue that allowed a low-privileged user to access the command history of an active legacy SSH session has been fixed.

New Feature

Introducing the latest addition to our PAM360 suite: the PAM360 Software Development Kit (SDK). The SDK opens up new pathways for developers and administrators, offering seamless integration of PAM360 functionalities within DevOps, CI/CD platforms, or any other microservices/software across organizations. By leveraging the SDK, developers can efficiently embed privileged access management capabilities into their applications, ensuring robust security and seamless functionality within the PAM360 environment.

Key Highlights of PAM360 SDK

• Java and Python Support: Our SDK comes fully equipped with support for Java and Python, ensuring flexibility and compatibility with diverse programming environments.
• Secured Ease of Use: Eliminate the hard-coded PAM360 data in the client applications by leveraging the appropriate PAM360 APIs across your applications/environments using our SDK.
• Effortless Data Exchange: With our SDK, exchange data seamlessly between PAM360 and client applications, streamlining processes and enhancing efficiency.
• Simple Integration: Declare and define PAM360 APIs as simple methods/functions within your Java/Python applications, simplifying the integration process and reducing development overhead.
• Data Transfer Capability: Push data effortlessly into PAM360 from any other application by leveraging the appropriate APIs, ensuring smooth and real-time data synchronization.

For detailed information on configuring and managing PAM360 SDK, please refer to our comprehensive help documentation.

Enhancement

Now, administrators can tailor diverse access permissions during PAM360 user account creation, offering a spectrum of options, including Web Access, REST API Access, and SDK Access for a single user account. This update empowers administrators to finely tune user privileges according to specific organizational requirements, ensuring precise allocation of PAM360 access to the users as desired. Notably, existing REST API-only user creation remains unchanged, with the added benefit of providing SDK access.

Note: Please note that this update does not impact the roles and functionalities of existing user accounts. However, administrators can now leverage these new access levels while modifying the existing user accounts.

Behavioral Changes

• Users with Super Administrator privileges will no longer have access to the REST API. Existing user accounts with this level of access need to be modified for continued PAM360 accessibility:
  • Revoke Super Administrator privilege for continued REST API access.
  • Alternatively, provide Web access for continued Super Administrator privilege.
• Authentication tokens for API users will now expire after 365 days, ensuring improved security compared to tokens that previously never expired.

Bug Fixes

• Starting from build 6451, even though a resource group is set up for periodic password reset and the reset successfully takes place as expected, the resources within the resource group may appear disabled in the View Selected Resources for periodic password reset operation. This issue has now been fixed.
• Previously, RDP and SSH sessions for access control configured resources persisted beyond the configured access time limit in the client organizations. This issue has now been fixed.

New Feature

Introducing TOTP support in PAM360 for accounts utilizing TOTP as the form of Two-Factor Authentication (2FA). This feature allows administrators to utilize the shared TOTP secrets in accounts for further TOTP code generation, particularly for website accounts configured with 2FA. Once configured, users can directly access such privileged accounts from the PAM360 interface, facilitating the generation of TOTP codes for 2FA alongside the shared passwords. This ensures a streamlined end-to-end process for setting up, validating, and authenticating users to utilize shared accounts configured with password and 2FA, enhancing overall security posture and user experience.

Enhancement

Earlier, PAM360 lacked a setting to specify custom connection properties when changing or migrating the backend database from PostgreSQL to MS SQL. From now on, custom connection properties can be added, thus providing users with greater flexibility to connect to their MS SQL server when changing or migrating the backend database.

Upgrade

The PostgreSQL server has been upgraded from version 10.18 to 14.7.

Bug Fixes

• When a user is provided with the access control approval privilege via user groups and not directly from the user level, and if the user tries to approve an access control request via the PAM360 mobile application, it fails with an error message of unauthorized access. This issue has now been resolved.
• Ticketing settings configurations at Resource Group could not be saved in some instances. This issue has been fixed.
• From build 6400 onwards, users could not take SQL remote sessions for MS SQL resource types with the instance name. This issue has been fixed.
• From build 6400 onwards, users could not migrate to an MS SQL server using a custom instance name and port. This issue has been fixed.
• Fixed an issue where changing a password using an API failed if the new password had the '[' character, which was not recognized as a special character for a strong password policy.
• Fixed an issue that restricted the intended operation of the users with the custom role privilege of 'Lock / Unlock Users'.
• We have resolved the remote connection failure that occurred for the accounts in the MySQL resources in both SSL and Non-SSL connection modes.

New Feature

Smart Login
We have introduced a convenient login method in PAM360: Smart Login via QR code. The feature allows effortless login to PAM360 by scanning the QR code displayed on the PAM360 webpage using the PAM360 mobile application (Settings >> Smart Login). This direct login method streamlines the process with a passwordless authentication, thus significantly reducing login effort.

Note: To use this functionality, users should upgrade PAM360 web and mobile applications to the following versions as applicable.

• Web application - Version 6500
• Android application - 2.6.0
• iOS application - Version 2.5

New Integration

Integrate PAM360 with 800+ Business Applications Now via Zoho Flow!
PAM360 integration with Zoho Flow empowers users to deploy workflow automation across 800+ business applications, majorly focusing on HR and IT Service Management (ITSM). The integration lets swift user onboarding/offboarding of users to/from recruitment/ATS systems to PAM360, thus seamlessly bridging the HR and ITSM functionalities of an organization.

With this integration, a designated PAM360 REST API user can effortlessly craft custom workflows in Zoho Flow, connecting PAM360 to an extensive range of applications within Zoho Flow using its dedicated APIs, which perform pivotal actions such as user creation, group management, account control, and privileged resource sharing in automated workflow triggers.

Read our help documentation to know more about this integration, and real-time scenarios in detail.

Enhancements

• Users can now generate session query reports using the latest version of PAM360. These reports fall under the new 'Recorded Session' category and include the following lists:
  • All recorded sessions
  • Deleted session recordings
  • Recorded RDP sessions
  • Recorded SSH sessions
  • Recorded VNC sessions
  • Recorded SQL sessions
  • Recorded telnet sessions
  • Recorded remote desktop sessions
• Users with the administrator role can terminate user sessions initiated through add-ons and the PAM360 mobile application.
• With this latest update, we have introduced a new custom role option - Terminate User Session, which, when enabled, empowers users to conclude active sessions promptly as needed.

Bug Fixes

• Previously, the remote password reset for the Microsoft Azure accounts failed if the UPN suffix (domain.com) of a user account and the DNS of a resource differed. This issue has now been fixed.
• Previously, in the Auto Approval scenario for access control, the password was not checked-in back within the specified period, even after the approval time, until the user checked it out manually. This issue has now been rectified.
• Previously, when the administrator required a reason for retrieving a password for an account containing special characters, there was a discrepancy between the old password copied from the Password History section. This issue has now been rectified.
• HTTPS Gateway Server-Related Fixes
  • In this release, we have resolved an issue that restricted the authentication of a few ManageEngine application URLs via the HTTPS gateway server due to a set of common cookie names.
  • Previously, the HTTPS gateway server encountered difficulties in decoding responses from certain resource URLs sent to the PAM360 server. This issue has now been successfully rectified.
  • Starting from build 6010, a few HTTPS gateway sessions resulted in bad requests due to case-sensitive modifications in the session URL (for instance, from https://ipaddress:port/GS_6b86b273ff34fce1_ to https://ipaddress:port/gs_6b86b273ff34fce1_). We have now addressed it.
  • Some URLs accessed via the HTTPS gateway server were experiencing bad request errors when the redirection URL of the HTTPS gateway server contained / or // at the end of the URIs. This issue has now been resolved.
  • Before build 6010, if a redirection URL from the HTTPS gateway server included a hostname and port number instead of a Fully Qualified Domain Name (FQDN), connections to certain URLs would fail. This issue has been resolved, and from now on, it will work as expected.

Security Fix

• An issue that allowed the users with the password auditor privilege to terminate the user session has been found and fixed.
• An issue in build 6100 that allowed the privileged users to add/edit/delete the conditions in the unshared access policy (Zero Trust) has been found and fixed.

Enhancements

• New Resource Type
  A new resource type, RabbitMQ, has been introduced in this release to facilitate the proficient administration of RabbitMQ server passwords.
• From now onwards, users with administrative privileges can filter out the most active users' data based on password access count for a specific date range, such as Last 7 days, Last 30 days, and custom range in User Dashboard.
• Importing Users, Resources, Organizations, and Passwords from Excel file formats like '.xls' and '.xlsx' are now supported.
• Previously, after importing users, resources, organization details, and personal passwords as files, column mapping required manual intervention. Now, columns will be automatically mapped with the form fields, provided the files imported have the same column names.
• Earlier, during bulk editing of resources, the resource and account additional fields were accessible only after selecting the resource type. However, from build 6400, these additional fields will be available without specifying any resource type. Additionally, it is possible to bulk edit RDP, SSH, and Telnet session recording, password reset, and resource type.

Bug Fixes

• From build 6000 onwards, a few placeholders got encoded after saving the email templates and message templates. This issue has been fixed.
• In earlier versions, the session recordings of SSH and Telnet sessions failed to export when the resource name contained special characters. This issue has been fixed.
• From build 5700, the PAM360 Windows Domain agent failed to verify the domain account passwords through the password verification feature. This issue has been fixed.
• From build 6100, the Agent Update command failed to work as expected while reinstalling the PAM360 Agent via the command line. This issue has been fixed.
• In PAM360 with MSSQL backend, the search in the 'Resource Name' column of the 'Passwords' tab failed under the following two circumstances:
  • When the resource name exceeded 30 characters.
  • When the resource names were searched using their sub strings.
  This issue has been fixed.
• The CPU spike caused by the PAM360 dashboard has been fixed.
• From build 6100, users could not save edits to dynamic resource group attributes. This issue has been fixed.

Security Fix

A custom audit filter created by one user could be deleted by other users due to a security vulnerability, which has been fixed in this release.

New Feature

Application Scaling using External PostgreSQL Cluster
For continuous and uninterrupted workflow with a day-to-day growing user base, increased API workloads, user traffic, etc., we introduce an additional scalability function in PAM360 by which users can use their external PostgreSQL cluster as the backend database.

Feature Highlights

• Uninterrupted Access: We can add up to five servers to the database cluster, with one acting as the main node and others as subnodes. In case of main node downtime, any subnode can seamlessly be changed into a main node, ensuring uninterrupted service.
• Improved Performance: Distribute data operations across configured subnodes, thus enhancing application performance and responsiveness.
• Application Scaling Dashboard: Once configured, the Application Scaling dashboard displays detailed information about the nodes, including Host Name, DNS Name, Last Activity, Type, Status, and Active Sessions.
• Node-based Audits: Perform audits specific to Application Scaling under the 'Audit' tab. The 'Resource Audit' and 'User Audit' sections display comprehensive audit trails for each configured node.

Enhancements

• From now onwards, you can apply PPM to the Read-Only server(s) configured in your organization.
• PAM360 now allows users to use SSL connection mode for remote password resets of domain accounts that are part of the "Windows Domain" resource type.
• PAM360 now supports SHA-256 hashing algorithm for SAML Single Sign-On.
• From this version of PAM360, users can generate the following query reports that are available under the Users, Resource Groups, and User Groups categories:
  1. Users without shared accounts
  2. Last login details of the users
  3. Resource groups with recent password changes
  4. User groups with shared accounts
  5. User groups with shared resources
  6. User groups with shared resource groups
• PAM360 now supports remote connections using domain account for SSH based resources.

Upgrade

The JRE (Java Runtime Environment) used in PAM360 has been upgraded from version 1.8.0_252 to 1.8.0_372.

Bug Fixes

• An issue was discovered in a Windows Domain environment that involved a secondary domain controller. During a period when the primary domain controller was offline, the password verification sync incorrectly indicated that the password was in sync, even though it was incorrect. This problem has been resolved.
• We have fixed an issue where the displayed serial number of the IdP certificate on the SAML configuration page did not match the imported certificate.

Security Fixes

• In this release, we have resolved a security vulnerability that allowed unauthorized users to access the resource details of other users' resource groups. This included information such as resource name, account name, resource type, etc. We have taken the necessary measures to fix this issue and ensure that unauthorized access is no longer possible.
  Note: This vulnerability did not pose a risk to passwords and sensitive data, as they remained secure and inaccessible to unauthorized users.
• In this build, issues that allowed the following unauthorized access to the users have been found and fixed:
  • To view the connection settings of unshared accounts
  • To modify the connection settings of unshared accounts

New Features

• Certificates Synchronization Status Check
  From now on, PAM360 allows you to perform regular checks on the synchronization status of SSL certificates deployed to multiple servers directly. Additionally, you can schedule the synchronization check and generate a 'Certificate Sync Status' report based on the results.
• New Tools Category
  PAM360 now comes with a 'Tools' category that will allow users to independently perform certificate conversion, SSL/CSR parsing, and vulnerability scanning without adding certificates into the PAM360 repository.
  • Certificate Signing Requests (CSR) and SSL Parser - The parser tool allows users to upload certificates or their contents directly to the interface and sort the attributes into a readable format.
  • Certificate Format Converter - The converter tool supports one-click conversion for a wide range of certificate formats.
  • Scan Vulnerabilities - The scanner tool allows users to scan any domain for vulnerabilities by entering the domain name and port directly. Unlike the SSL Vulnerability scan, this tool checks for vulnerabilities in any domain, without adding the certificate to the repository.
• Integration with AWS Certificate Manager
  PAM360 now supports integration with AWS Certificate Manager (ACM) - a trusted certificate authority and certificate manager. This integration enables users to request, acquire and deploy certificates from PAM360 to AWS ACM and renew and automate the end-to-end lifecycle management of SSL/TLS certificates issued and managed by ACM directly from the PAM360 web interface.
• Managing MSCA Certificates
  Users can now manage the entire lifecycle of MSCA certificates and perform operations such as discovery and renewal from one place. In addition, two new options, 'Revoke' and 'Delete' have been added to the MSCA tab.
• PAM360 - Azure Key Vault Integration
  PAM360 now supports integration with Microsoft Azure Key Vault - an SSL certificate management service offered by Microsoft. Through this integration, users can request, renew, and manage the entire lifecycle of SSL/TLS certificates stored in the Azure Key Vault by importing them into the PAM360 repository.
• Integration with Sectigo Certificate Manager
  PAM360 now integrates with Sectigo Certificate Manager - a PKI management platform built to manage SSL/TLS certificates, SSH keys, and other digital identities. The integration facilitates users to request, acquire, import, deploy, and renew certificates issued by Sectigo and automate their end-to-end lifecycle management of SSL/TLS certificates directly from the PAM360 web interface.
• Importing Certificate Details
  Besides adding certificate objects in different formats, PAM360 now allows users to add certificate details into the PAM360 repository manually and manage them along with other certificate objects. This feature is beneficial when a user has the details of an SSL certificate that resides in a demilitarized zone and therefore, cannot be added to PAM360 as an object through discovery. In this case, users can create a CSV file with the specified certificate details and upload them to PAM360. Furthermore, users can also set up expiry notifications for certificate details.
• Certificate Deployment to Citrix ADC Load Balancer
  Users will now be able to deploy SSL certificates to the Citrix ADC load balancer directly from the PAM360 interface. Users can add and manage multiple Citrix accounts and deploy certificates to them individually.

Note: If you are already using an SSL agent for SSH/SSL-related operations, it's required to reinstall the agent for these new integrations to work seamlessly.

Enhancements

• From this build onwards, after certificate renewal, the expired certificate's details can be sent via email. Configure the required setting under 'Admin >> SSL Certificates >> Certificate Renewal'.
• From now on, PAM360 will display the hosted SSL certificate's CommonName, Serial number, and SyncStatus with the managed servers and include them in the 'Deployed Servers' report.
• From build 5800, scheduled tasks were performed only during the scheduled time. From build 6200, scheduled tasks can be performed anytime by using the 'Execute Now' button available under the 'Schedules' tab.
• From build 6200, PAM360 allows you to check the SyncStatus using SSL Agent. For this to work, the SSL agent should also be updated to version 6200.
• Earlier, certificates were managed based on their Serial Number. Now, certificates having the same common name and different serial numbers can be grouped by enabling it under 'Manage Certificate History' under 'Admin >> SSL Certificates >> Certificate History'.
• From now on, the old certificate will be listed under 'Certificate History' after the certificate renewal.
• From now on, PAM360 allows you to add additional properties to CSR while signing with root by using the 'Advanced Options' menu. It allows users to choose from a list of Key Usage and Advanced Key Usage properties and add them to the new certificate. Examples of the Key Usage properties include; Digital Signature, Decipher Only, Encipher Only, and Certificate Sign.
• It is now possible to import PGP keys created using third-party tools.
• Earlier, during certificate deployment using IIS Binding, users could deploy it to a single server or agent only. From now on, users will be able to deploy certificates to multiple servers as well.
• Henceforth, users will be able to export the private key from the Microsoft Certificate store after certificate deployment.
• From now on, besides deploying to the computer account, PAM360 allows you to deploy certificates to the Microsoft certificate store user account using the SSL agent. The latest version of the SSL agent should run in the user account to which the certificates are to be deployed.
• 'Organization' and 'Organization Unit' has been added to the 'Column Chooser' on the 'SSL Certificates Report' page.
• From now onwards, users can choose to exclude automatically renewed certificate(s) from email notifications.
• Users can now bypass proxy server settings while performing Citrix Load Balancer certificate discovery using the 'Use REST API (By default PAM360 uses CLI commands for discovery and fetching certificates)' option available in the UI. Using this option, PAM360 can bypass the proxy server and directly perform online certificate discovery. This option is also available during scheduled certificate discovery.
• PAM360 now provides an option to import issuer certificates into the repository and form a complete certificate chain. Users can store and export the complete certificate package in JKS, PKCS, and PEM formats.
• In addition to server certificates, PAM360 now allows users to import client certificates from DigiCert and manage them in the PAM360 repository.
• Users can now create a scheduled task for AWS certificate discovery.
• PAM360 now comes with an option that mandates users to include 'Server Name Indication' while configuring and updating IIS Binding.
• Users can now rediscover the expired and about-to-expire certificates from the 'Certificate Expiry' widget in the Keys Dashboard.
• PAM360 will allow users to import the keys created using OpenSSL version 3.0 onwards.
• Users can now import WebSphere certificates into the PAM360 repository.
• PAM360 now allows users to group their certificates based on the 'Expiry Notifications Email' while creating a certificate group.
• From now on, under Multiple Servers, the users will be able to reassign the Primary server from the list of available servers while attempting to delete the existing Primary server.
• A new RestAPI to 'fetch PGP keys' has been added.
• From now on, while configuring ServiceDesk Plus as the ticketing system in PAM360, users can retrieve pre-existing templates from ServiceDesk Plus and utilize them to create tickets that will be displayed in ServiceDesk Plus.
• Henceforth, users will be able to associate columns from ServiceNow with the columns from the Certificates tab to add additional information to the tickets.
• Earlier, DigiCert users were able to add only one API key to PAM360. Henceforward, they can add multiple API keys to PAM360.
• Two new RestAPIs to 'To get Certificate in different file formats' and 'To Export an SSH Key in a specific Key Type' have been added.
• PAM360 now supports file-based certificate discovery for the Microsoft Certificate Store. This feature allows you to import a text file with a select list of hostnames/IP addresses that are accessible to PAM360, using which the remote machines are scanned and certificates are discovered. After a successful discovery, PAM360 will consolidate the newly-discovered SSL certificates in its certificate repository. In addition, the scheduled discovery of Microsoft Certificate Store certificates now comes with two new options: discovery using IP range and via a text file.

Upgrade

The java script framework - jQuery used in PAM360 has now been updated to version 3.6.0.

Behavior Change

Users can now maintain the following certificates at a count of five in the PAM360's centralized SSL repository without affecting the available number of keys in the license:

• Server certificates that are used to secure the communication of the PAM360 server
• Certificates that are internally used in PAM360

Bug Fixes

• Earlier, certificate order creation for GoDaddy's 100 UCC SAN SSL certificates was failing. This issue is fixed now.
• In PAM360 build 5800, while importing SSL certificates from the GoDaddy portal, PAM360 failed to import some of the certificates. This issue has been fixed in this build.
• Previously, when an MSCA certificate was discovered from a different domain, the 'MSCA' type certificate was changed to the type 'Domain', which caused the auto-renewal process to fail. This has now been fixed.
• Previously, ServiceDesk Plus (SDP) ticket creation failed due to the API rate limit set by SDP. This has now been fixed.
• Earlier, the root certificate-based signing failed if the 'SAN' field contained a wildcard. This issue has been fixed.
• In PAM360 build 5800, while discovering certificates using MSCA, certificate discovery failed if the language of the templates was not English. This issue has been fixed in this build.
• Previously, Load Balancer discovery failed when the certificates were discovered using the 'Discover certificate list' page. This has now been fixed.
• In Linux installations, the certificate discovery failed while discovering certificates from Shared Path using the certificate list. This issue has been fixed.
• Operator users were unable to view the details of the certificates that were part of a certificate group created using additional fields as the grouping criteria. This issue has been fixed.
• Administrator users were unable to edit the value of additional fields for certificates that are a part of certificate group created using any criteria. This issue has been fixed.
• Earlier, the users were unable to edit the wildcard certificate details after navigating to the Certificate Details page. This issue has been fixed.
• Earlier, when a certificate that was part of a certificate group expired, the expiry notification email was sent to all groups in PAM360 instead of to only the groups to which the certificate belonged. This issue has been fixed.
• Load Balancer discovery and Shared Path discovery did not work for some users. This issue has been fixed.
• Bulk certificate sync with ServiceDesk Plus failed for some certificates. This issue has been fixed.
• Previously, when users tried to add a new SSL certificate with the same common name as another certificate that was already available in PAM360, the new certificate was not added to the repository. This issue has now been fixed.
• An issue that led the Aruba ATP and ASA Firewall password reset to fail has been found and fixed.
• In build 6100, the auto logon operation performed using the generated ticket ID failed. This issue has now been fixed.

Security Fixes

• A stored XSS vulnerability caused by HTML tags in certificate attributes during SSL certificate import, CSR import, and SSL and CSR parse operations has been fixed.
• Path Traversal Vulnerability, Remote Code Execution (RCE), and SSL validation vulnerabilities have been found and fixed.

New Feature

Policy-Based Access Privilege Using Zero Trust Approach
Introducing our Policy-Based Access Privilege feature - an advanced security model designed to minimize the risk of cyber-attacks and data breaches by eliminating the concept of trust. This is achieved by calculating the trust scores of users and resources continuously in a dynamic manner using conditional and predefined parameters with an assist from respective installed agents. This decisive action ensures that only authorized users/devices have access to the critical privileged resources in an organization.

How Does this Feature Work in Real-Time?
This new feature allows administrators to implement policy-based access privileges based on the trust score methodology. It is achieved by installing user/resource agents on relevant devices, defining parameters and weightage values, and creating access policies for the respective user/resource group. Post the access policy configuration, the access policies are associated with the respective resource groups via static resource groups. Further, with the above configuration, access privileges are granted to the users or restricted based on the configured access policy conditions and criteria.

Salient Feature Highlights

• The feature provides a fine-grained layer of security through the use of access policies that are carefully crafted and derived to ensure that only authorized users can access your organization's resources, regardless of any evolving threats that may arise.
• Access policies ensure that access is granted in an automated, policy-based manner, eliminating the need for manual intervention.
• With this approach, one can maintain complete control over the organization's resources and minimize the risk of unauthorized access.

Read our help documentation to know more about this feature, configurations, and real-time scenarios in detail.

Bug Fixes

• Previously, an issue that intended the super administrator to raise a password request for the resource configured with access control instead of allowing direct connection in the connections tab has been found and fixed.
• Previously, the accounts discovery failed in the resources added via the Linux agent. This issue has been fixed now.
  Note: The existing users with installed Linux agents should reinstall their agents to proceed with further account discovery.
• Earlier, password resets were performed on the disabled resources imported via Active Directory. This issue has now been fixed.

Security Fixes

In this build, issues that allowed the following unauthorized privileged access to the users have been found and fixed:

• Delete the IIS binding
• Trigger a certificate discovery
• Deploy the certificate groups
• Rotate the unowned SSH keys in a key group
• Create a schedule for SSH keys etc.,

Similar to the above fixes, we have fixed 16 such issues that led to unauthorized privileged access.

New Feature

Support for New Two-Factor Authenticators
We have introduced the following authentication services in PAM360:

• Zoho OneAuth Authenticator - A comprehensive multi-factor authentication application that helps you secure your online accounts, thus enhancing your business security. It is available for download on multiple devices - iOS, Android, iPad, macOS, watchOS, and Windows platforms and can be installed at your convenience.
• Oracle Authenticator - A multi-factor authentication application that provides an additional layer of security by prompting a second factor of authentication during login. The following devices support its download and installation: iOS 12.0+, Android 5.0+, smartphones, and tablet devices.

Enhancements

• The PAM360 application user interface is now available in the following user languages - Russian, Italian, and Dutch.
• Unlike earlier, users can now reset their personal passphrases from the Personal tab, wherein the action will permanently remove all the stored passwords.
• Previously, audits and reports reflected the IP address of the load balancer/proxy server through which the user requests were forwarded. Now, the new admin option - Remote Host Header makes it easier for organizations using load balancers or proxy servers to display the actual IP information of their users instead of the load balancers' or proxy servers'. This allows recording and keeping track of the exact user access details.
• Hereafter, users can configure expiry notifications for Annual Maintenance & Support (AMS) license expiry.
• It is now possible to manage application tokens for azure applications.

MSP Edition

• Henceforth, users can generate reports for client organizations individually under 'Admin >> Organizations >> Organizations'. The report spotlights the details of users/user groups with access to the selected organization.
• In this version of PAM360, we have enhanced the access and approval process for the client organization. The 'Actions' menu under each organization in the list view now includes new options that follow to manage user/user group organization access and user/user group organization access requests:
  
  • Manage User Organization Access
  • Manage User Group Organization Access
  • User Organization Access Requests
  • User Group Organization Access Requests

REST API

• New RESTful APIs: This version of PAM360 comes with a new set of REST APIs that follow:
  
  • Generate and fetch agent key - Fetch the available agent key or generate and fetch the new agent key.
  • Fetch HA status - Fetch the status of the configured High Availability server.
  • Fetch all resource groups - Fetches all owned and shared resource groups of a user.
  • Password validator - Validates passwords based on the password policy.
  • Delete user group - Deletes user groups from specific organizations.
  • Remove a user from the user group - Removes a user from a user group in a specific organization.
• Previously, the 'condition_*' parameter in the 'Create Dynamic Resource Groups' API accepted only the default attributes of a resource, such as RESOURCENAME, DNSNAME, LOGINNAME, etc. The custom field attributes will now be accepted alongside the default attributes in the 'condition_*' parameter.
• Users can now enter custom field values in addition to the default values ACCOUNTNAME, PASSWORD, ACCOUNTPASSWORDPOLICY, and NOTES while creating accounts using the 'Create Accounts under a Specific Resource' API.
• Users can now change all account parameters besides the default values ACCOUNTNAME, PASSWORD, ACCOUNTPASSWORDPOLICY, and NOTES while modifying accounts using the "Edit an Account under a Specific Resource" API.

Behavior Changes

• From now on, PAM360 will support only the App-Only Access Token method to import/sync users from Azure AD, and the User Access Token method will not be available.
  Note: For the existing users, the User Access Token method will continue to work (without further import/sync) until Microsoft deprecates its API services.
• User authentication-based password reset will no longer be applicable for Microsoft Azure resources. Henceforward, an Azure App and a privileged account will be required to perform remote password reset for those resources.
  Note: The existing users can reset their passwords using the user authentication method until Microsoft deprecates its API services.

Upgrade

This version of PAM360 comes with the upgraded third-party framework used for HTML5-based RDP and SSH gateway features.

Bug Fixes

• Previously, when there were more than thirty-two thousand passwords in the export list, the export passwords as plain-text (.xlsx) requests failed. This issue has now been fixed.
• Earlier in the MSP edition, the user had access to the client organization, even when the user was removed from the user group that mapped with a client organization. This issue has been fixed now.
• An issue that led users to use the Clipboard option in the remote sessions despite disabling it under 'Connection Settings' has been fixed.
• From build 5500 onwards, users could not view the Private Key Passphrase for the user accounts whose name contained special characters. This issue has now been fixed.
• From build 5800 onwards, users could not download files using the Secure File Transfer method from Linux resources. This issue has now been fixed.
• An issue that restricted users from taking remote connections using domain accounts from the Resources tab (for the resources with no local accounts) has been fixed.
• From build 5900 onwards, during RDP sessions, an issue was encountered when users tried to copy files from remote machines to user machines, which resulted in session failure. We have fixed this issue in this version.
• Previously, while creating Active Directory synchronization schedules, when the synchronization interval was set to 0, all existing schedules got deleted. This issue has now been fixed.

Security Fix

Prior to this version, the PAM360 agent communicated with the PAM360 server without determining the validity of its SSL certificate in the following aspects, thus increasing the risk of external exploitation:

• If the installed SSL certificate is still valid
• If the SSL certificate is issued by a reliable CA
• If the SSL certificate's name and the site's name are the same

From now on, the PAM360 agent will check if a valid SSL certificate is installed on the PAM360 server before initiating communication, thereby boosting security.

New Feature

Self-Service Privilege Elevation for Linux
We are glad to introduce Self-Service Privilege Elevation (agent-based) for the Linux resources in PAM360. This feature allows administrators to configure privileged commands, thus allowing non-privileged users to execute them with an elevated privilege. The privileged commands can be associated with specific accounts and resources as configured by the administrator.

Feature Highlights:

• Administrators with the 'Self-Service Privilege Elevation - Linux' role can configure a set of privileged commands for their owned and managed accounts and resources.
• Non-privileged users can execute the privileged commands in the Linux endpoints without the need for a super user account such as root.
• Provides adequate reports and audits that include:
  1. Accounts and resources with Self-Service Privilege Elevation
  2. Unauthorized execution of privileged commands

Key Benefits:

• Provides greater control over the commands elevated and actions performed in the endpoints through the agent-based mechanism.
• Assured intended execution of privileged commands by the non-privileged user without needing access to the privileged accounts.

Please go ahead and read our help documentation to know more about Self-Service Privilege Elevation capabilities in Linux.

Bug Fix

In build 5900, users could not launch remote connections to endpoints using the AD and Azure AD account credentials. This issue has now been fixed.

Security Fix

In build 5900, a stored XSS issue occurred via the commands added in command groups while accessing query reports. This issue has been fixed in this build.

New Feature

SSH Command Control (Filtering)
We are delighted to announce SSH Command Control (Filtering) in the SSH-privileged remote sessions of PAM360. This feature allows administrators to configure authorized command sets for the end users to use in their SSH-privileged remote sessions. The command sets can be associated with specific accounts, resources, and resource groups that get delegated to end users.

Feature Highlights:

• Ability for the administrators to define fine-grained permissions by configuring specific set of commands for selected users, launching privileged SSH sessions to specific devices.
• Well-designated command lists that can be associated with specific accounts, resources, and resource groups.
• Users can execute only the authorized specific commands, regardless of the account capabilities of the logged-in account.
• Similar to the remote app feature for Windows, which allows users to access only specific applications, this SSH command control feature will allow users to execute only the authorized set of commands.

Key Benefits:

• Adequate control by administrators over the execution of commands by users on the remote SSH devices.
• Controlled command executions to avoid unwanted privilege elevations.
• Additional protection in SSH sessions on top of the accounts' specific permissions delegated to users.
• Effective control over privileged activities carried out by users in servers via SSH remote sessions.

Excited to know more about configuring and using this feature? Please go ahead and read our help documentation.

Bug Fixes

• Previously, when administrators performed password reset for domain accounts, in some customer environments, the passwords were updated in Active Directory but not in the PAM360 database. This issue has now been fixed.
• From build 5500, if the option to execute 'pwdadm' command was enabled for resources of the IBM AIX resource type, then password reset failed for the accounts in the selected resource. This issue has been fixed.

New Features

• Integration with a container platform: Kubernetes
  PAM360 now integrates with Kubernetes, an open-source container orchestration tool that facilitates software deployment automation and helps to scale and manage applications effectively. The integration is of great help to administrators in fetching, managing, and periodically rotating secrets obtained from multiple Kubernetes clusters via API responses. PAM360 records extensive audit trails for all operations performed on the secrets stored in the repository.
• Integration with a new SIEM tool: Microsoft Sentinel
  In addition to the already available integrations with SIEM tools, such as Splunk, ManageEngine EventLog Analyzer, and Sumo Logic, PAM360 now integrates with Microsoft Sentinel, a cloud-native security information and event management (SIEM) solution by Microsoft. PAM360 gathers detailed audit logs for the operations performed on resources and passwords, along with the user details in real-time. Through this integration, PAM360 sends detailed logs to Microsoft Sentinel syslogs, enabling users to view PAM360 audit trails from the Microsoft Sentinel interface.

Enhancements

• Earlier, during SFTP file transfer, it was possible to download only a single file from a single directory path. From this build onwards, users can select multiple files from a single directory path and download them together as a compressed file.
• This version of PAM360 comes with two new default query reports under the 'Resource Group' and 'User Group' categories:
  1. Static resource groups and their resources
  2. User groups and their users.

Upgrade

The internal security framework has been upgraded to the latest version to reduce the occurrence of vulnerabilities and bolster overall security.

Bug Fixes

• From build 5510 onwards, during a remote MSSQL session, users were unable to switch the connection to a different database. This issue has been fixed now.
• From build 5000 onwards, during file upload operation, PAM360 failed to delete the uploaded file that was temporarily stored in a temp folder within the PAM360 installation directory. This issue has been fixed.
• From build 5510 onwards, users were unable to execute the Insert, Update, and Delete queries during a remote session launched to any SQL database. This issue has been fixed now.
• Earlier, some email notifications sent to users did not contain the PAM360 login URL if their respective email templates had been edited in the PAM360 interface. This issue has been fixed.
• Earlier, administrators could not integrate PAM360 with ServiceDesk Plus Cloud due to an internal upgrade. This issue has been fixed.
• From build 5700 onwards, administrators could not save the edited email templates if the message contained a hyperlink tag. This issue has been fixed.

New Feature

Intending to provide uninterrupted access to passwords, we have introduced another functionality - the Read-Only (RO) server for the PostgreSQL database. Unlike the concept of High Availability, where there will be one Primary server and one Secondary server, the Read-Only server can be configured in multiple. The Read-Only servers function as mirror servers, synchronizing all of the Primary server's operations. In the event of the Primary server failure, administrators can convert any Read-Only server into the Primary server and reconfigure all other Read-Only servers to point to the new Primary server. Read-Only Servers can be configured from 'Admin >> Configurations >> Read-Only Server.'

New Feature

PAM360 Remote Connect - a Native Desktop Client for Remote Access
Introducing PAM360 Remote Connect—an independent desktop client for Windows, designed to facilitate direct remote access to Windows and SSH-based target resources without the need for multiple remote clients or web browsers. PAM360 Remote Connect harnesses the ability of Windows' native Remote Desktop client and the SSH Putty client to launch RDP and SSH-based connections from a centralized console. The lightweight desktop client directly leverages the PAM360 web application's privilege access governance to regulate remote access to the critical assets in your environment. It offers enhanced ease of use and a superior user experience with its faster and smoother RDP and SSH-based remote connections. Besides, it has auditing capabilities—the session audit trails are recorded in PAM360's web application. PAM360 Remote Connect is compatible with PAM360 build 5600 and above. To learn more and to download PAM360 Remote Connect, click here.

Bug Fixes

From build 5500 onwards, administrators were unable to delete a user profile if the user had created any type of resource discovery task. Also, if the user owned a discovery schedule, administrators were unable to transfer the schedule ownership to another user from 'Discovery >> Schedule.'

Security Fix

We identified several SQL injection vulnerabilities in the Search and Resource Group export operations that were caused by improper user input validation. These issues have been fixed.

New Feature

PAM360 now supports creating schedules for automatically discovering new privileged accounts during Linux, Network Devices, and VMware discovery.

Enhancements

• Earlier, users could configure SAML only for the Primary server. From now on, the users can configure SAML for the Secondary server also and access it when the Primary server is down/unavailable.
• The Dropbox SDK has been updated from 3.0.3 to 5.0.0. And, a short-lived access token will be utilized from now on.
• We have enhanced our security checks against Path Traversal, Local File Inclusion, Stored XSS, Reflected XSS, and DOM XSS vulnerabilities.
• PAM360 now communicates with agents using TLS 1.2 protocol, in addition to TLS 1.1 protocol.

New Query Reports:

• The new query report 'Personal Passwords Encryption' shows the encryption type of personal passwords and lets admins and admin privileged users know the encryption type (PAM360 key, Own key with storage, Own key without storage) used by different users.
• The new query report 'All Admin Users', in addition to the administrator user details, holds the details of custom user roles with administrator privileges.

Bug Fix

From build 5400, administrators were unable to import users through AD. The issue has been fixed.

Enhancements

• To validate the authenticity of the upgrade pack downloaded from our website, we have implemented a patch integrity verification, which will henceforth require importing an SSL certificate (available as a downloadable file) whenever the product is upgraded using the PPM file. It is only a one-time operation.
• From now on, PAM360 administrators can add filtered domain or service accounts into Windows Domain resources using the Windows Domain agent. Account filtering is achieved through regex patterns. For example, if you have a few service accounts in the AD with the name "sqlservice," the regex pattern of this account can be provided in the format: '*^sqlservice.' This operation will filter and import only the accounts with the name "sqlservice" into PAM360.
• Henceforth, if an administrator restricts the users from setting up the encryption passphrase for their personal passwords (under 'Admin >> General Settings'), the users can set up an 'encryption key' for their personal passwords from the 'Personal' tab. They are also free to choose between whether to store or not store the encryption key or use PAM360's encryption key.
• It is now possible to move the RESTAPI users to the client, wherein the RestAPI users can manage resources and accounts in all client organizations with complete access. Please note that this feature is applicable only for the MSP edition.
• The six system-created audit schedules - 'Resource Audit Purge Schedule', 'Resource Audit Digest Schedule', 'UserAudit Purge Schedule', 'UserAudit Digest Schedule', 'TaskAudit Purge Schedule', and 'TaskAudit Digest Schedule' have been merged into a single schedule - 'Audit Purge and Digest' Schedule.
• The system-created scheduled task 'Audit Update Schedule' has been renamed as 'Dashboard Chart Activity Schedule'. It is available under 'Admin >> Manage >> Scheduled Tasks.'
• Previously, when the 'Purge Audit Records' option was enabled, all the audit records older than the specified number of days were purged. From build 5400 onwards, users can choose to retain or delete audit records based on the operation type.
• From now on, MSP admins will be able to replicate audit operation type settings and audit purge settings across all client organizations.
• This release comes with a new set of RESTAPI functionalities as listed below:
  1. Associate a resource to a resource group.
  2. Dissociate a resource from a resource group.
  3. Fetch resource groups associated with a resource.
  4. Delete a resource group.
  5. Fetch ResourceGroupID.
  6. Reset Two-Factor Authentication.
• The database password for the HA setup, previously stored as plain text in the 'pmp_rr.conf' file, is now stored in an encrypted format.
• From now on, users can choose to disable the display of security-related notifications within the product. This can be done by administrators in the PAM360 interface under 'Admin >> General Settings.'
• While creating a custom report, users can now choose 'Previous Month' as a duration from which PAM360 must collect audit records.
• Earlier, in the Download File API, Resource ID and Account ID were passed as parameters via the URL. From now on, they can be passed in the input data.
• From this version onwards, DISABLEPASSWORDRESET can be added as a parameter in the 'Edit Account' API to disable the password reset option for accounts.
• From PAM360 build 5400 onwards, for additional security during self-service privilege elevation, the added applications/files will be verified using SHA256SUM.
  Also, we have separated the list of applications/files allowed for self-service privilege elevation under 'Admin >> Manage >> Allowed Apps/Scripts'.

Upgrades

• The internal security framework has been upgraded to the latest version to reduce the occurrence of vulnerabilities and improve overall security.
• The bundled PostgreSQL server has been upgraded from version 9.5.21 to 10.18.
• The Apache Tomcat server has been upgraded from version 8.5.32 to 9.0.54.
• The Rubyrep tool used for PostgreSQL replication has been upgraded from version 1.2.0 to 2.0.1.
• The Java platform used by PAM360 has now migrated from Oracle to the OpenJDK platform version 1.8 .0_252.
  In addition to supporting the JTDS JDBC driver to connect to the SQL server, PAM360 now supports the Microsoft JDBC driver, version 8.4.1.
• Apache Log4j has been upgraded to the latest version 2.17.2.

Bug Fixes

• From build 5200, when proxy server configuration was enabled, users using the latest version of Duo TFA experienced a premature authentication time-out during the second-factor authentication. This issue has been fixed.
• Earlier, users were unable to import empty user groups as both main and subgroups from the Active Directory (AD) and add AD sync schedules. This issue has been fixed.
• Earlier, during an active RDP session, when a user tried to drag and move the Ctrl+Alt+Del button within the RDP window, the Ctrl+Alt+Del command was executed. This issue has been fixed.
• Earlier, when file transfer during an RDP session was disabled, the folder drag arrow was visible in the RDP session window. This issue has been fixed now.
• Earlier, when a resource or an account is shared to a user, their username was printed as N/A in the syslog records. From now on, the syslog records will include the username of the user to whom the account or resource has been shared.
• Earlier, Azure AD users were unable to change the interface language when choosing Japanese as the default user language. This issue has been fixed.
• Earlier, users were unable to perform key rotation in the MSSQL database when the database backup path was set to any location other than the default backup location. This issue has been fixed.
• Earlier, a copy of the MSSQL database backup got saved in the default backup location, in addition to the backup file saved in the folder path specified by the user. This issue has been fixed.
• From build 5306, the 'Record SSH/Telnet Sessions' checkbox was not available for the 'Windows Domain' sync type. This issue has been fixed now.
• From build 5306, the 'SSH Port For Auto Logon' option was not visible in the 'Edit Resource' wizard for Network resource types such as Fortigate, VMware Vcenter, and Brocade. This issue has been fixed now.
• From build 5306, when the 'Windows Remote Desktop' option was disabled under 'Auto Logon Helper' for a particular resource type, the 'Record RDP Sessions' checkbox did not appear in the 'Add/Edit Account' wizard even when the 'RDP Console Session' option was enabled for that resource type. This issue has been fixed.

Behavior Change

The API handling code which earlier responded to the V1 API format of ServiceDesk Plus MSP will henceforth respond to their V3 API format.

New Features

• On-Demand Renewal of Certificates
  A 'Renew' option has been newly added under 'Certificates >> Certificates' that allows users to initiate the renewal of Self Signed, Root Signed, Microsoft CA Signed, and Agent-signed certificates, and also the certificates issued by third-party CAs. The renewed certificates will automatically inherit the deployed servers and their credentials.
• Certificate Discovery from UNC Shared Path for Windows, Linux, and Mac OS
  PAM360 now supports SSL certificate discovery from UNC (Universal Naming Convention) shared paths for Windows, Linux, and Mac OS machines. This feature allows users to discover SSL certificates stored in a folder path within a server, accessible by PAM360. After the discovery, PAM360 will consolidate the newly-discovered SSL certificates in its certificate repository. This option is also available during scheduled certificate discovery.
• Certificate Discovery in DMZ Machines using the KMP Agent
  It is now possible to discover the SSL certificates from directories in remote machines that are not directly accessible by PAM360—all through the KMP Agent. This option is also available during scheduled certificate discovery.
• Browser Deployment of Certificates
  From now on, deploying SSL certificates in browsers is possible from PAM360 for the following server types: Windows, Linux, and MacOS.
• SSH Key Association using "Elevate to root user" Option
  The new "Elevate to root user" option allows restricting users from directly accessing root users by disabling the root user login as a security measure. Enabling this option elevates a user login from a non-root user to a root user and associates keys to all other users on the server.
• New REST API
  The new REST API 'Deploy Certificate' has been added.
• SSL Certificate Rediscovery
  PAM360 now allows users to rediscover SSL certificates from the same source using the server details entered during the previous discovery operation.
• Integration with Buypass Go SSL and ZeroSSL
  PAM360 now integrates with Buypass Go SSL and ZeroSSL— two certificate authorities that use the Automatic Certificate Management Environment (ACME) protocol to provide free, secure SSL certificates. Users can now request, acquire, create, deploy, renew, and automate the end-to-end management of SSL/TLS certificates issued by Buypass Go SSL and ZeroSSL, all directly from the PAM360 web interface.
• Integration with ManageEngine Mobile Device Manager (MDM) Plus
  PAM360 now integrates with ManageEngine Mobile Device Manager (MDM) Plus to discover and deploy SSL certificates to and from the mobile devices managed by your MDM server, all using ManageEngine MDM APIs. PAM360 then lets you filter the discovered SSL certificates based on the OS type such as iOS, Android, Windows, Chrome OS, Mac OS, and Apple tvOS. It is also possible to export reports of the MDM certificates managed in the PAM360 repository within a selected period. Additionally, you can schedule periodic generation of MDM certificate reports.
• PAM360 allows you to globally modify the access level of the shared certificates.
• New REST API's, 'Share SSL Certificate to User', 'Share SSL Certificate to User Group', 'Share SSL Certificate Group to User', 'Share SSL Certificate Group to User Group', 'Revoke SSL Certificate from User', 'Revoke SSL Certificate from User Group', 'Revoke SSL Certificate Group from User', 'Revoke SSL Certificate Group from User Group', 'Create SSL Certificate Group', 'Delete SSL Certificate Group', 'Edit SSL Certificate Group', 'Generate an Agent Install Key', have been added.

Enhancements

• MSCA Discovery with KMP Agent using Multiple Templates
  Users can now select up to five certificate templates while performing agent-based certificate discovery of local CA certificates. Before using this enhancement, please ensure the KMP Agent is upgraded to version 5300.
• Search-Enabled Custom Columns
  From build 5300 onwards, PAM360 allows you to search within custom columns for SSL Certificates and SSH keys.
• Multiple Servers List
  Now you can include multiple servers for certificates in SSL certificate expiry notifications.
• GoDaddy Certificates Import
  From now on, users can directly import the existing certificates from their GoDaddy account into the PAM360 repository.
• Local Disassociation of Keys
  It is now possible to dissociate keys locally if remote dissociation fails for users whose access has been discontinued.
• APIs - Serial Number as the Mandatory Field
  Earlier, the Serial Number field, which was optional in the below APIs, has now been made mandatory; To get a certificate, To get certificate keystore, and To delete a certificate.
• Serial Number in the getCertificateDetails Rest API
  In the getCertificateDetails Rest API, Serial Number has been added as an optional field; filling it fetches the details of that particular certificate alone.
• Users can now view all the certificates associated with a particular agent by clicking the 'Host Name' of the agent listed under 'Certificates >> Certificates >> Windows Agents'.
• Now, users can discover certificates issued by a particular Microsoft Certificate Authority just by entering the MSCA name in the text box provided, during discovery. Remember, this additional option will be available for PAM360 installations in Windows server machines only.
• Now, it is possible to add the Wildcard name in the SAN field while creating a CSR or a self-signed certificate. With the Wildcard certificates, one can secure an unlimited number of subdomains for a registered base-domain.
• Earlier, Certificate Expiry Notification emails sent to the email addresses specified in additional fields followed a fixed format. Now, the customization settings configured for notification emails in 'Admin >> SSH/SSL Config >> Notification Settings' will be applied to the emails sent via email addresses in the additional fields as well.
• PAM360 now supports scheduled SSL discovery and MS Certificate Store Discovery tasks with the KMP agent.
• Previously, the certificates due for expiry in 10 days or less got automatically renewed. Now, users will be able to customize the number of days to auto-renew the certificates before they expire.
• From now on, during CSR signing of SSL certificates using the KMP agent, it is possible to specify the Agent timeout value, in seconds.
• Henceforth, users will be able to select specific Certificates or Certificate Groups while generating the 'SSL Certificates Report' Schedule type (under 'Admin >> SSH/SSL Config >> Schedules >> Add Schedule').
• Users will now be able to add and edit the deployed servers list under 'Certificates >> Certificates >> Multiple Servers (icon)'. Newly added servers will be mapped with the latest certificate version in the certificate repository.
• PAM360 now supports IP range discovery for MS Certificate store discovery ('Certificates >> Discovery >> MS Certificate Store') using the PMP service with the domain Admin account. This allows administrators to discover certificates across networks.
• PAM360 now supports 'Load Balancer' Certificates discovery for Citrix devices. From build 5300 onwards, PAM360 also supports scheduled certificate discovery from Linux-based load balancers such as BIG-IP F5, Nginx, and Citrix.
• Certificates and CSR generation pages have been enhanced with the Random Password generation feature.
• Users can now select up to five certificate templates while performing template-based SSL certificate discovery.
• Users can now bypass proxy server settings while performing SSL certificate discovery. If this option is selected, PAM360 will bypass the proxy server and directly perform online certificate discovery. This option is also available during scheduled certificate discovery.
• Earlier, after certificate renewal, users will have to deploy MSCA/-self-signed certificates manually. Now, it is possible to deploy these certificates automatically if the user credentials are available.
• Users will now be able to choose the 'Certificate type' [CER/DER/P7B/CRT] and 'Keystore type' [JKS/PKCS/PEM/KEY] while deploying certificates to Windows and Linux machines and while exporting certificates.
• Now, it is possible to renew MSCA type Certificates with a new private key if a private key not available already.
• Support for ClouDNS to complete domain control validation while acquiring certificates from public Certificate Authorities.
• Support for AES256-encrypted PKCS12 Keystores while adding certificate Keystores.
• Henceforth, the SSL certificates can be manually mapped with deployed servers list to any server directly from Certificates >> Certificates >> More >> Add Deployed Server'.
• From now on, certificates/CSRs/certificate groups will have an email field to which the SSL expiry email notifications can be sent, where the expiry notification email address can be provided while creating the Certificate and CSR.
• A new option - Deploy to Microsoft certificate store user account, has been added, which facilitates the deployment of the Microsoft Store deployed certificates to the respective user accounts, besides deploying to the computer accounts.
• The SSL Certificate Expiry notification, set up under 'Admin >> SSH/SSL Config >> Notifications Settings >> Expiry', will now include Issuer, FingerPrint, and Serial Number fields in the Certificate Expiry email.
• From build 5300, the 'Certificates Audits' tab will be available under the 'Audits' tab, where, all the certificates audit related to all the users will be displayed. New REST APIs 'Get Password Policies' and 'Get Resource Types' have been added.

Behavior Change

From now on, all certificates with unique serial numbers will be listed under the 'Certificates' tab. However, the existing users can manage their already added certificates from the History section, which has now been moved under the 'Column Chooser'.

Bug Fixes

• The KMP agent got duplicated when re-installed from a different IP address. This issue has been fixed.
• The 'Common name' column sorting issue in the 'Certificate Sign Report' wizard has been fixed.
• The issue in MSCA auto-renewal with the EC key has been fixed.
• Get Templates issues that existed with the non - English languages have been fixed.
• Under 'Admin >> SSL Certificates >> IIS Binding', binding list retrieval failed for bindings with a protocol other than HTTP/HTTPs. This issue has been fixed.
• Earlier during Digicert import, PAM360 failed to import client/personal certificates into PAM360. This issue is now fixed.
• Earlier, the date format had the month as a part of the value, due to which sorting did not work. Now, this issue has been resolved by modifying the date format in the CSV file to be the standard date format.
• Earlier, while discovering certificates using a load balancer, there were problems with commands other than the standard Linux commands. This issue has been fixed.
• Get templates issue has been fixed for CA name-based fetch.
• Previously, the proxy configuration was not supported in GlobalSign integration, due to which users with proxy were unable to use the integration. This issue has been fixed now.
• Earlier, it was possible to add or modify IISBinding only by giving the 'hostname'. This issue has been fixed, and now 'hostname' is not mandatory to create or update IISBinding.
• Earlier, MSCA templates showed the OID instead of the template name. This issue is fixed.
• During SSL discovery, discovery from servers with mutual authentication failed. This issue has been fixed now.
• MSCA discovery, when carried out using an agent without any filter, failed. This issue is fixed now.
• There was an issue in exporting the certificates as password-protected zips when password protection for exports was enabled under 'Privacy Settings'. This issue has been fixed now.
• There was a failure in Linux deployment from the ServiceDesk Plus request. This issue has been fixed now.
• Earlier, when the custom settings option 'View Support Information' was enabled for a custom user role, the users with that role were unable to access the 'Support' option from the profile drop-down. This issue is fixed now.
• Earlier, when a new category was created from the 'Personal' tab with an existing category name, the product did not display an error message. This issue is fixed now.
• Earlier, if the category name seen from the 'Personal' tab contained the special character '&', the category details were not shown in the display area. This issue is fixed now.
• Earlier, when a new resource was created using the 'Create Resource' API, and the 'Resource URL' field was left blank, users could not edit the resource attributes in the PAM360 UI. This issue is fixed.

Security Fixes

• An XSS vulnerability (ZVE-2021-0956) that occurred during Load Balancer discovery has been fixed.
• A SQL injection vulnerability identified in the PostgreSQL password reset functionality is fixed.
• A path traversal vulnerability identified in the role report section is fixed by adding proper validation steps for the download file path of the report.
• Earlier, users could reopen a closed remote SSH session window from the browser history page and reinitiate the remote connection without requesting for the password of the resource again. This issue is fixed.

Enhancements

• Password Reset - From Multiple Wizards
  Users will hereafter be able to reset passwords, both individually and in bulk, from 'Resources >> Password Explorer >> Admin Actions'; Expired Passwords, Conflicting Passwords, and Policy Violations.
• SAML SSO configuration for Client organizations
  The SAML SSO configuration, which was earlier available for MSP organizations alone, is now available for Client organizations as well, thereby allowing client organizations to build their own SAML setups.
• New Authentication mode of Azure AD user import
  Previously, during the 'User Access Token' method of Azure AD user import, the 'Oauth' token could not be fetched when TFA was enabled. As a resolution to this, we have introduced a new Authentication mode of Azure AD user import - 'App-Only Access Token'.
• Enhanced Password Policy
  The existing password policy has been enhanced by introducing new constraints and additional features, such as improved default attributes for Strong and Medium password policies, the introduction of password limit, the addition of new attributes, such as password similarity and sequences, the ability for Admins to add and manage up to 5 dictionaries, Dictionary word check, Obvious Substitution (LEET) word check, Password Strength Meter, Sample Password Generator, New Password Generator, etc. These would be of great help to administrators in setting highly secure password policies.
• Access Control & Domain Account Restrictions
  Earlier, a user with access to a domain account can log into any resource shared with them using the domain account. Henceforth, Domain account restrictions can be implemented for target resources, i.e., Windows domain account users can be granted access to specific resources alone, which they originally want to access, instead of all resources shared with them. Also, please note, from this release, we have blocked the Password Request API for domain accounts alone.
• Portuguese Language Support
  PAM360 is now available in the Portuguese language.
• Duo-TFA SDK Update
  The third-party Two-Factor Authentication software Duo Security is now upgraded from v2 to v4. Once PAM360 is upgraded to build 5200, the Duo Security update will be applied automatically to the existing integration.
• Additional Query Reports
  Two new default query reports for users having access to the browser extension and users who don't have access to the browser extension have been added.
• New Resource Type
  A resource type, Cisco Nexus OS, has been introduced in this release.

Behavior Changes

• The API handling code which earlier responded to the V1 API format of ServiceDesk Plus On- Premises and ServiceDesk Plus Cloud will henceforth respond to their V3 API format.
• The Authentication mechanism of ServiceDesk Plus Cloud has been updated from the older Authtoken based method to OAuth 2.0. Additionally, hereafter, the entries in the ticketing system columns can be validated against the entries in PAM360 to check for any inconsistencies. Earlier, it was possible to check the entries in PAM360 only.

Note: If your current Ticketing System is ServiceDesk Plus On-Premises or ServiceDesk Plus Cloud, this upgrade pack will disable the integration and delete the complete integration data. You will have to reconfigure the ticketing system again. So, make sure you save a backup of the advanced configurations in the form of screenshots for reference.

Bug Fixes

• In build 5000, when the Admin users from the MSP org scheduled reports in the Client org, they received Zero bytes reports. This issue has been fixed now.
• From build 5000, Additional fields were missing from the Bulk edit page of resources. This issue has been fixed now.
• From build 5000, users with the Password Administrator role were unable to perform 'change role' or 'delete user' operation - to change to a Password user or a Password Auditor, even when no resources or accounts were present under 'Transfer Approver privileges. This issue has been fixed now.
• Earlier, in schedules, created for AD groups during resource or user discovery, groups with an ampersand (&) in their names could not be edited. This issue has been fixed.
• In earlier builds, the PAM360 dashboard froze and the server ran out of memory due to the overload of audit data. This issue has been fixed.
• In build 5000, in the 'Account Addition' password field, the character & was displayed as &. This issue has been fixed.
• From build 5000, users could not create the Password reset Listener. This issue has been fixed now.
• Earlier, users faced an issue with the mouse scroll during RDP and VNC remote sessions initiated through Google Chrome version 89. This issue has been fixed.
• Earlier, when password synchronization was enabled for any organization (MSP or a Client ORG), PAM360 executed the task only for the organizations under MSP. This issue has been fixed now.
• Earlier, users were unable to use the operators >= and <= in the LDAP search filter queries during user import from an LDAP domain. This issue has been fixed.
• When the PAM360 and KMP agents were installed in the same machine, the data used for the agents' authentication was stored in the same place in the registry, causing the overwriting of the agents' data, thereby making the agents non-functional. This issue has been fixed.
• The automated scheduled task introduced for dashboard optimization caused the database connections to become unavailable, for some time, for a few users. This issue has been fixed now.
• When Two-Factor Authentication was enabled, the legal banner and the privacy policy banner links in the Login page (enabled from the 'Rebrand' wizard) did not show up/work. We have resolved this issue.
• Earlier, for some users, after configuring Duo TFA, the requests that were supposed to be sent to the PAM360 access URL were directly sent to the PAM360 server. This issue has been fixed now.
• Earlier, the 'Edit User' action did not work for certain users. We have resolved this issue.
• Previously, the password entered in 'Importing users from AD wizard >> specify the user name and password manually' did not get saved due to a password encoding issue. This issue has been fixed.
• Earlier, users were able to export offline passwords even when the export password was disabled using the export URL. This issue has been fixed now.

Security Fixes

• When users configured X-Forward-For in PAM360, there was a possibility to bypass web access restriction by setting the X-Forward-For header manually. This issue has been fixed now.
• A Cross-Site Scripting (XSS) issue found in the edit LDAP server details page has been fixed.
• There existed a vulnerability from version 4.0.0 that permitted the retrieval of masked non-website resource type passwords as clear-text, by capturing the API call of the PAM360 browser extension and replacing the password ID of website account passwords. This vulnerability occurred under any or all of the following circumstances; with the user type roles only, with the password masking option enabled by the Admin under 'General Settings', and only to the shared passwords. This issue reported by Sandeep Saxena (CVE-2021-31857), has been fixed.
• A user enumeration issue has been fixed.
• Users with access to the PAM360 server, running in a machine with a few policies configured, were able to view the IIS web.config passwords as cleartext in the event log.

Enhancements

• We have introduced four new RESTAPIs: Fetch UserGroupID, Configure Remote Password Reset for Linux resources, Share Resource and Share account to User Group.
• Henceforth, remote connections initiated using SSH key-based authentication, and remote authentication using the domain account or using the 'Currently Logged in AD account' option will work with the new SSH terminal.
• Previously, it was possible to initiate remote connections using the Auto Logon Gateway feature to Windows, Windows Domain, Linux, and Cisco resources only. From build 5100 onwards, it is possible to initiate remote connections to all SSH-based resources.
• In earlier builds, the upload file size limit for SSH File Transfer Protocol-based (SFTP) file transfer was 300 MB, which was inadequate. Now, the file size limit has been upgraded to 6 GB.

Bug Fixes

• When Two-Factor Authentication was enabled, the legal banner and the privacy policy banner links (enabled from the 'Rebrand' wizard) in the Login page did not show up/work. This issue has been fixed.
• The SSH terminal page was unresponsive when ALT+Tab keys were used to switch to Windows and return to the Terminal. This issue has been fixed now.
• When a user with Administrator or Connection user privileges tried to initiate an RDP session to a Windows resource, or an account is shared with them at the resource group level, the system threw a password inaccessible error, which has been resolved.
• Shared resources and accounts, with 'Manage' level permission, viewable from the Resources and the old Connections views, were not visible from the new Connections tab. We have fixed this.

New Features

• Connection Settings
  PAM360 now offers advanced configuration settings for remote connections added to the product, which are customizable for SSH, RDP, and VNC connections, thereby improving the overall user experience while initiating connections from PAM360 to the respective remote resources. Some of the advanced settings include changing the SSH terminal type, modifying the desktop composition for RDP connections, changing the encoding type of VNC connections, etc.
• Secure File Transfer
  PAM360 now allows bi-directional file transfer between two systems through the SSH File Transfer Protocol (SFTP). Users can accomplish this by installing the SFTP server in the target remote systems. There is no proposed size limit for file transfer through the secure file transfer mechanism, therefore allowing PAM360 to authenticate the connection and transfer large files without the risk of security breaches. Besides file transfer, PAM360 permits bi-directional upload and download of files between the user's machine and the remote connection they have established, without the need for a remote session. This upload and download mechanism is made possible through the Secure Copy Protocol (SCP).
• Enhanced Connections
  This release comes with a more polished 'Connections' tab that serves as a one-stop platform to view all the added Connections, Favorites, and Connection Groups. The tab holds some useful options, such as a new secure file transfer option, and a new search filter that facilitates the search of resources within the tab using Name, DNS name, or type of OS. All the connections have the following quick access control buttons; Connect, Request, Checkin, Checkout, Remote App, and Upload/Download files.
• Remote App
  PAM360 now allows you to connect to specific applications, already configured as 'Remote Apps', in target systems. Adding Remote Apps to RDP connections increases accessibility and ease of use when connecting to remote machines. Remote Apps are of great utility to IT admins in making the privileged sessions easier to control, as they limit users' access to selected applications.
• Gateway Settings
  From this release, users can customize 'Gateway settings' in PAM360, under 'Admin >> Connections'. Users can edit and control the cipher suites used for SSL communication, set up a different port, choose SSL protocols to be used for securing remote connections initiated from the product, customize HTTP header log settings, etc.
• New SSH Terminal
  From this release, users can avail of a new lag-free SSH Terminal that uses the WebSocket API and is faster and more responsive.
• Landing Server for Windows
  Provision to launch secure, one-click RDP access to remote devices in data centers with complete password management. Administrators can now configure landing servers and their login credentials and associate them with the resources managed by PAM360. They can then launch one-click connections with the remote resources, without worrying about the intermediate hop, thus providing them the same experience as the direct connection.
• Azure MSSQL Support
  PAM360 now supports Azure MSSQL as the backend database. It also allows PostgreSQL to Azure MSSQL instance migration.
• New Certificate Format - PEM
  A new certificate format, Privacy Enhanced Mail (PEM), has been added, in addition to the already available certificate export formats, Keystore and PFX, where the PEM format is used for digital certificates and keys, deployed in web server platforms (e.g., Apache).
• Support for GoDaddy DNS
  PAM360 now supports GoDaddy DNS to complete the domain control validation procedure while acquiring certificates from public Certificate Authorities, along with the already available DNS support types, Azure DNS, Cloudflare DNS, Amazon route 53, and RFC2136 Update. Using GoDaddy DNS, users can update the DNS record for GoDaddy domain validation from the PAM360 portal itself.

Enhancements

• Previously, it was possible to configure access control settings at the resource level only, which were applicable for all the accounts under the resource. Now, it is possible to set password access control independently for each account under a resource, without affecting the access control configurations of other accounts in the resource. This ability to set unique configurations for each account helps users maintain unparalleled security levels for each account, based on requirements. Remember, the account-level access control configuration takes higher precedence over the resource-level access control configuration.
• This release comes with an exclusive page for 'Windows Agents', accessible from the SSL tab, from where users will be able to perform all agent-specific operations such as SSL Discovery using agent, deployment of SSL certificates in certificate groups using agent and CSR Signing with MSCA agent.
• Certificate deployment in multiple servers has now been made simpler by using an agent, provided the agent is running in the server to be deployed, and both the agent name and the server DNS name are the same.
• Now, auto-renewal of certificates is possible for the 'MSCA using agent' sign type as well, from 'Settings >> SSL >> Certificate Renewal'.
• The 'Certificate Sign Report' comes with the following MSCA/Third party CA signing details; Certificate Authority, Certificate Template, Sign Type column.
• The 'Certificate Renewal report' comes with the 'Renewed By' column relevant to MSCA and 3rdPartyCA renewal details.
• A new option 'Reissue Certificate' has been added under 'SSL >> GlobalSign' that allows users to request GlobalSign to reissue an SSL certificate.
• The new 'GlobalSign Orders Report' allows the GlobalSign orders to be added as individual reports, which provide a detailed view of certificate orders requested from the GlobalSign CA
• From now on, users can add a "Key Comment' while importing a new SSH key and editing an existing key from the repository. Also, users can avail the checkbox "Update comment in associated users" to update the Key comment to the associated end servers automatically.
• Now, it is possible to add additional properties to a certificate while creating it, by using the 'Advanced Options' menu. It allows users to choose from a list of Key Usage and Advanced Key Usage properties, and add them to the new certificate. Examples for the Key Usage properties include; Digital Signature, Decipher Only, Encipher Only, and Certificate Sign.
• The DigiCert CA page has been enhanced with a new menu 'Show' that has four options, Expired, Revoked, Rejected, and Others, used to filter the DigiCert CA list view.
• Now, while adding or modifying the Certificate Groups, it is possible to set 'additional fields' also as one of the 'By Criteria' filters for certificates.
• While creating an additional field, users are allowed to choose if it is applicable for SSH/SSL/both. The 'Additional fields' option is now available under 'Settings'.
• New REST APIs 'GET CSR list' and 'Sign CSR' have been added.
• The 'Expiry Notification' has been enhanced with the custom mail content, 'Title' and 'Signature'.
• The 'Certificate Renewal Report' page under the 'Reports' tab now comes with a column chooser.
• Users can now view all the certificates associated with a particular agent by clicking the 'Host Name' of the agent listed under 'SSL >> Windows Agents'.
• Now, users can tailor schedules by adding custom email content and a unique signature.
• Now, users can discover certificates issued by a particular 'Microsoft Certificate Authority' just by entering the MSCA name in the relevant text box during discovery. Remember, this additional option will be available in PAM360 installations running in Windows machines only.
• Now, it is possible to add the Wildcard name in the SAN field while creating a CSR or a self-signed certificate. With the Wildcard certificates, one can secure an unlimited number of subdomains for a registered base-domain.
• Earlier, Certificate Expiry Notification emails sent to the email addresses specified in additional fields followed a fixed format. Now, the customization settings configured for notification emails in 'Notification' and 'Schedule' tabs will be applied to the emails sent via email addresses in the additional fields as well.

Bug Fixes

• An issue in Download file API has been fixed.
• Server certificate update failed in case of Key Store with multiple alias names. This has been fixed.
• The root and intermediate certificates of PEM format got added as separate entries in the certificates repository. This has been fixed now.
• Agent got duplicated when re-installed from a different IP address. This has been fixed.
• The 'Common name' column sorting issue in the 'Certificate Sign Report' wizard has been fixed.
• The issue in MSCA auto-renewal with the EC key has been fixed.
• Get Templates issues that existed with the non - English languages have been fixed.

Security Fixes

• A Cross-Site Scripting (XSS) issue that occurred due to the absence of output encoding in the Resource name while masking password, theme type, skin color, Category name of the Personal tab, web app connections, and user sessions of the Audit tab has been fixed.
• The TLS of the SSL agent in PAM360 has been upgraded to version 1.2 and is configurable in 'Agent.conf '.
• Earlier, during API calls, the Authentication token was passed as a request parameter. Hereafter, each API call made to the application requires the Authentication token to be passed in the request header.
• Earlier, the Keystore password of the certificate uploaded into the server was appended in the URL, which posed a security risk. From now on, the Keystore password will be sent as the 'RequestBody' to maintain optimal security.
• A local File Intrusion issue that occurred during the MS store discovery has been fixed.

New Features

• Expiry Notifications for SSL Certificates
  PAM360 now enables users to discover, import, and configure expiry notifications for SSL certificates hosted in the following Amazon Web Services: AWS Certificate Manager (ACM) and AWS Identity and Access Management (IAM).
• Self-signed Certificates Auto Renewal
  PAM360 now supports automated renewal of self-signed certificates along with Microsoft CA certificate renewal.
• SSL Certificate Deployment and Binding - IIS Server
  From now on, you can both deploy a certificate to the IIS server and also bind it to the desired website in the IIS, all from the PAM360 interface itself, without the need to access the IIS server separately. Also, an option has been provided to automatically restart the IIS server for the deployment and binding to take effect, thereby eliminating the need for the manual restart from the IIS end.
• Additional Fields PAM360 now brings you the 'Additional Fields' feature, configured from 'Admin >> SSH/SSL' that is used to include any additional information about SSH keys and SSL certificates, stored in the repository. There are four different categories to add the additional fields: character, numeric, date and email. Users can choose to add or remove the additional fields from SSH and SSL views.
• Column Chooser
  This version of PAM360 comes with the 'Column Chooser' feature that allows users to show or hide columns at runtime, and also rearrange the columns from the current view via drag-and-drop.
• Pretty Good Privacy (PGP) Keys
  PGP encryption is used to enhance cryptographic privacy and authentication for online communication by encrypting and decrypting texts, emails, files, etc. It uses a combination of data compression, hashing, and public-key cryptography to boost confidentiality. Now, PAM360 brings you this PGP functionality in the form of PGP key generation, where the keys are used to encrypt the data like emails, texts, etc. Create, store and manage PGP keys under 'Admin >> SSH/SSL'. Modify the key description anytime, export private/public keys, export keys to multiple email ids, and generate, view, and schedule reports. You can also send expiry notification emails to admins. This feature allows you to share and collaborate information securely among your trusted groups of users and businesses.
• GlobalSign
  PAM360 now supports integration with GlobalSign SSL—a trusted Certificate Authority and a leading cloud-based PKI solutions provider. This integration enables users to request, acquire, import, deploy, renew and automate the end-to-end lifecycle management of SSL/TLS certificates issued by GlobalSign, directly from the PAM360 web interface.
• Certificate Deployment using Agent
  PAM360 can already deploy and bind certificates to IIS servers belonging to the domain, where PAM360 also resides. Now, PAM360 can also deploy certificates to IIS servers in demilitarized zones and also bind them to websites in IIS, all using an agent. This makes PAM360 more scalable, as it can deploy and bind certificates in IIS servers, irrespective of whether they are in the same or different domain.
• CSR Signing using Agent
  In addition to the already available two sign types, namely, 'MS Certificate Authority' and 'Sign with Root', used to sign certificates from PAM360, a third sign type 'MS Certificate Authority with Agent' has been introduced. This new sign type is mainly used to sign certificates originating from a distinct domain, i.e., other than the domain to which PAM360 belongs.
• Integrating with Ticketing Systems
  PAM360 now integrates with enterprise ticketing systems namely ServiceDesk Plus (on-premise) and ServiceNow. This integration ensures that automatic service requests are created in the ticketing environment to notify administrators of SSL certificates that are at the risk of expiring and certificates that are deemed vulnerable after a vulnerability scan in PAM360. Users can set notification policies to govern the frequency of service request creation for expiring and vulnerable tickets.

Enhancements

• PAM360 now provides additional insights on agent activity such as heartbeat interval, latest response time and operation performed.
• For scheduled SSL expiry tasks, users now have the option to choose whether or not, to receive email notifications when no certificates in that particular schedule are nearing expiration.
• PAM360 offers automatic bundling of individual private key (.key) files and certificate files (.cer/.pem) into 'JKS' and 'PKCS' keystore file formats and provides export option for the same.
• Two extra categories have been added to the criteria-based certificate group creation: AWS service and Certificate template.
• Now, it is possible to use the PAM360 service account credentials for authentication while deploying certificates in Windows servers.
• Henceforth, while creating a certificate, users can provide ephemeral access (validity in hours and minutes) to the certificates created, after which the certificate auto-expires. This eliminates the need for compulsory permanent access credentials to access target systems and also explicit access repeal.
• It is now possible to perform SNI-based SSL discovery using the Common Name and IP Address combination.
• The option to filter certificates based on the key length and signature algorithm within specific expiry days has been added to the 'getAllSSLCertificates' Rest API.
• It is now possible to customize notifications and their intervals. Users can now choose not to receive notifications regarding the expired certificates, and send a separate email and customized subject per certificate, from 'Admin >> SSH/SSL >> Notification Settings'. The same actions can be done while creating new schedules under 'SSH/SSL >> Schedules >> Add Schedule', where you have to select the Schedule Type as 'SSL Expiry'.
• Earlier, PAM360 allowed signing and deployment of certificates only from Windows systems. Now, it is possible to perform certificate signing and deployment to Windows systems from Linux installations through agents.
• It is now possible to provide customized subjects in 'Schedules'.
• In RestAPI, the fetch details format is modified is such a way that the "details" attribute holds all the data. The following is the modified API list; GetCertificateDetails, getallsslcertificates, getAllSSLCertsExpiryDate, sslCertSingleDiscovery, sslCertRangeDiscovery, getallsshkeys, GetSSHKey, GetSSHKeysForUser and GetAllAssociatedUsers.

Bug Fixes

• Previously, certificate deployment failed if the field "Store Password" contained a space character while creating certificates from 'Certificates → Create'. This has now been fixed.
• Previously, when performing bulk operations, the "Create and Deploy" action failed when executed on SSH user groups, for RSA and DSA signature algorithms. This has now been fixed.
• Previously, when there was a "space" character present in a certificate group name, attempting to fetch the SSL certificates report pertaining to that group from the Reports tab threw the following error: "Invalid field format". This has now been fixed.
• Previously, even after the certificate private key was imported and attached to a certificate in PAM360' certificate repository, the "Export Keystore/PFX" was still disabled. This has now been fixed.
• During all AD-related operations performed from the PAM360 interface, the 'Connection Mode' got saved as 'No SSL' only, even if the 'SSL' mode was chosen. This issue has been fixed now.
• Earlier, MSCA signing supported 'java keytool' CSR only. Now, from this release, all CSRs will be supported by MSCA signing. During certificate creation, all values entered in the SAN field were all together categorized as 'DNS' only. Now, the values are segregated as 'DNS' and 'IP Address' categories.
• When a set of resources is shared with a user(s) with varying access permissions, and when different access permission is granted for one of those resources, the access permission of all the other resources also got changed. This issue has been fixed now.

Security Fixes

• A SQL injection vulnerability identified in 'Audit Reports' has been fixed.
• A Cross-Site Scripting (XSS) issue that occurred due to the absence of output encoding in the user input has been fixed.
• Earlier, the Keystore password of the certificate uploaded into the server was appended in the URL, which posed a security risk. From now on, the Keystore password will be sent as the 'RequestBody' to maintain optimal security.

New Features

• AWS EC2 Discovery
  This build comes with the option to discover AWS EC2 instances and their associated privileged accounts, in addition to the already available Windows, Linux, VMware and Network device discovery. Discover the AWS EC2 instances by providing the access key and secret key of AWS IAM users. Discover the privileged accounts associated with each AWS EC2 instance by providing the SSH private key (.pem) of the relevant instance at the time of discovery. You can also discover AWS EC2 instances from multiple regions.
• Integration with the Automation Anywhere RPA Tool
  ManageEngine PAM360 integrates with Automation Anywhere, Robotic Process Automation (RPA)-powered platform that automates software processes using bots. PAM360 renders a bot that helps you automatically fetch passwords from the PAM360 secure vault without manual intervention. This bot is capable of working in combination with other bots in Automation Anywhere to create a complete endpoint management workflow.

Enhancement

• Periodic Password Integrity Check
  For resource groups, an option is already available to check if the passwords stored in the PAM360 database are in sync with the passwords in the target devices. Now, a new option 'Periodic Integrity Check' is added that allows you to schedule tasks to run on a specific day/time, or at regular intervals of the specified day(s), or on a specific day of a month. The password integrity check will happen periodically based on the schedule set. Unlike the former option, you can use the new option to check the integrity of the passwords in the desired groups at your convenient schedules.

Bug Fixes

• During RDP sessions, it was not possible to copy texts using the keyboard shortcut 'Ctrl+C'. This was due to a breakage in the content security policy header enabled in PAM360 build 4000. This issue has been fixed.
• From build 4000, while updating LDAP details, LDAP users alone got removed from the user group. This issue is fixed now.
• From build 4000, SSH sessions did not get recorded when the option 'Enable splitting of SSH and Telnet session recordings into multiple files' was enabled under 'General Settings--> Miscellaneous'. This issue occurred in FQDN servers or when the DNS name contained IP address. This issue has been fixed.