Before we start
Would you kindly spend 5 minutes and give your feedback on the your deployment and issues? Thank you 馃檹
Subscribe to these major release notes as well as vulnerability alerts via email: 馃憠 https://warpgate.null.page/newsletter/
Survey results so far
Most responses were anonymous, and this is the public follow-up.
Some requested changes were already in progress while the survey was going on, and some were completed shortly afterwards.
The 0.27.x and 0.28.0 releases address several recurring requests form the survey: clustering, RDP clipboard redirection, faster playback of long terminal recordings, SSH command auditing, credential encryption at rest, and fixing IP restrictions for API tokens.
Other requests鈥攊ncluding SSO improvements, backup and upgrade guidance, observability, SSH certificates, and web-SSH file transfer鈥攔emain on the radar.
If you responded anonymously but would like a follow-up, feel free to re-submit the survey with your email address.
Features
Credential encryption at rest - #2386
Warpgate now offers encrypting database-stored target credentials at rest. You should enable it when using an external MySQL/PostgreSQL database.
Generate a master key with openssl rand -base64 32 and set it via the WARPGATE_ENCRYPTION_KEY environment variable to automatically encrypt all present and future credentials in the database on the next service restart.
SSH shell command auditing - #2407
Commands typed by the user in an SSH shell session now emit audit log events.
Seeking index for terminal recordings - #2419
Long terminal recordings now load incrementally in the UI. Only applies to recordings made in the new version.
Changes
- feat: Make target groups collapsible by @sravan-blitz in #2387
- fixed #2411 - support RDP clipboard redirection by @Eugeny in #2447
- allow admin to configure new tab preference by @LarsSven in #2396
- fixed #2395 - slim down connection instructions UI by @Eugeny in #2409
- link to user/target from session view by @Eugeny in #2450
Fixes
- allow editing credential policy even if the user no longer has a credential of that type by @Eugeny in #2405
- hash token and ticket secrets in the database by @Eugeny in #2410
- record password login failures even if password login is disabled by @Eugeny in #2408
- fixed #2392 - cast the log
valuesJSON column to text when searching by @huguesgr in #2417 - fixed #2412 - "check host key" returns jump host's key by @Eugeny in #2437
- fixed #2442 - rerunning setup creates a second admin role by @Eugeny in #2443
- count SSH pubkey failures towards IP blocking by @Eugeny in #2454
New Contributors
- @janisdombr made their first contribution in #2435
- @sravan-blitz made their first contribution in #2387
- @huguesgr made their first contribution in #2417
Full Changelog: v0.27.4...v0.28.0
