3.8.1 Release Notes

15 min

These Release Notes offer an overview of the enhancements, new features, and resolved issues incorporated into Kron PAM 3.8.1. For detailed instructions and information, please consult the Reference Guide.

Contact Us

Release Summary

Below is a comprehensive list of the changes, additions, and fixes integrated into the 3.8.1 version of Kron PAM.

Password Vault

More flexible configuration of password strength and length parameters has been introduced.

Password management support for MongoDB and Redis user accounts has been added to the Vault.

Flexible scheduling options for password change timing of dynamic accounts have been implemented.

An option to restrict password changes to predefined periodic password change windows has been added.

Support for managing user passwords via the MS Active Directory Root Domain in multi-domain environments has been added.

The ability to create Assigned Credentials for Private Vault Groups has been introduced.

Password Vault can now manage the passwords of Kron PAM users.

Assigned Credential assignments can now be listed from the Policy Tracking menu.

Realm-based authorization control for device connections via Vault for administrative users has been added.

Sensitive data exposure in Windows Event Logs during IIS Pool Account password management has been prevented.

Secrets Manager - AAPM Agent

Security and performance improvements have been implemented in the AAPM Agent.

Integration between Tenable Security Center and Password Vault has been improved.

Integration between Ansible and Password Vault has been improved.

Privileged Session Manager

Automatic user credential injection for su and sudo commands has been added.

Support for "Connect to Target Device" button using FQDN has been added.

Session termination capability (Kill Session) for OT/ICS Session Manager has been added.

Service Core ITSM integration for Session Manager has been implemented.

Secure Remote Access

Web session management via Secure Remote Access has been enabled.

Detailed debug logging for Secure Remote Access has been added.

Kron PAM Desktop Client & Kron PAM Mobile App

The ability to connect to devices in the device list via double-click within the Kron PAM Desktop Client has been added.

Portal Function permissions have been consolidated across the Kron PAM Desktop Client and Kron PAM GUI.

Both the Kron PAM GUI and the Kron PAM Desktop Client now offer the same session experience.

Managers can now modify reservation dates when approving requests through the Kron PAM mobile application.

Multi-Factor Authentication

Integration with external MFA vendors via the RADIUS client has been implemented.

Threat Analytics

Web Session Manager (HTTPS Proxy) logs can now be processed by AI-Based Threat Analytics.

System administrators can now mark detected anomalies as false positives.

Cloud Infrastructure Entitlement Management (CIEM)

A new dashboard and enhanced threat analysis capabilities have been introduced to CIEM.

Multitenancy

Tenant expiration date configuration has been introduced, with automatic tenant disablement after the defined expiration date.

Endpoint Privilege Management

An “Apply to All Agents” option has been added when creating advanced policies for EPM agents.

Remote start, stop, and uninstall capabilities for Linux and Windows EPM agents have been enabled directly from Kron PAM.

Kron PAM logging has been enhanced to clearly distinguish between block actions, elevation requests, run-as-admin requests, and elevated executions, providing improved visibility into policy-based operations.

Configurable maximum SSH session limits have been introduced at the agent group level, with user notifications displayed when the defined threshold is reached.

Local OTP generation and validation capabilities have been implemented on Windows and Linux EPM agents to support offline elevation and authentication scenarios when Kron PAM is unreachable.

Video recording support for sessions on Windows EPM agents has been added.

Support for subprocess exceptions has been introduced, allowing designated subprocesses to execute even when the parent process is subject to a block policy. This capability applies to all policy types.

Tunnel rule support (local and remote) has been reintroduced and integrated into the new agent architecture, including allow/deny actions and exception definitions.

Applications are now automatically launched by the agent upon successful OTP approval.

The Krongina service has been secured by requiring administrator OTP verification before it can be stopped.

A new logging system with configurable log levels has been implemented for the Windows EPM Agent to improve diagnostics and troubleshooting.

Session logs have been updated to display the protocol as “Windows Agent” instead of the generic “agent.”

A Linux agent mode has been introduced that operates without modifying OpenSSH configuration.

Linux agents can now report their agent version information to PAM, aligned with the existing behavior of the Windows EPM Agent API.

Session logs have been updated to display the protocol as “Linux Agent” instead of the generic “agent.”

Platform Features

TLS v1.3 support for the TACACS+ Server has been implemented.

Group-based log authorization through the Portal Function feature has been added.

User import capability from Entra ID (Azure AD) via Microsoft Graph API has been added.

OAuth authentication support for email server integration has been implemented.

SMS notifications are now sent when approval requests are generated.

The “session connection reason” field is now included in session logs forwarded to SIEM systems.

Operational incompatibilities between approval workflows and time restriction policies have been resolved.

Fix Package - 3.8.1-patch1 Release Notes

Password Vault check-out comment parameter is now enabled by default

Desktop Client: Linux Ubuntu .deb file did not open after download, crash and freeze, copy-paste problem and white screen issue fixed

File transfer issue interrupted during RDP sessions was fixed

Resolved the issue where the Vault returned an invalid password for Web Application accounts

Resolved the Web Application account creation failure caused by the missing selenium-side-runner

Resolved the agent filtering error in AAPM Agent

Resolved the issue where the scroll bar was not displayed in SSH sessions

Resolved the issue where scheduled reports could not be saved

Resolved the issue where the Policy Group column was empty on the Policy screen

Resolved the PTA log display order issue

Resolved the issue where devices were not added under the configured Root Device Group during LDAP integration

Resolved the incorrect agent status issue in Windows EPM Agent

Fix Package - 3.8.1-patch2 Release Notes

Resolved the issue where the Master Instance IP was also displayed as port and protocol in Vault

Resolved the password reset failure with superuser on Linux targets.

Resolved the Vault superuser lock issue.

Resolved the issue where application request logs did not show all successful and failed requests.

Resolved the user listing error in the Web UI.

Resolved the high CPU usage issue in Web UI.

Resolved the issue where local users could not change their own password.

Resolved the issue where the approval mailbox configuration could not be edited and saved.

Corrected “Tamper Proof” to “Tamper Evident” in the log screens. Resolved the issue where RAP users required admin rights.

Fix Package - 3.8.1-patch3 Release Notes

Added new RDP Windows shortcut key support.

Added the ability to view AAPM tokens.

Added support for viewing and copying long device group names.

The “Assigned Credential” menu is now customizable.

Corrected a typo in an LDAP device integration parameter name.

Resolved the password rotation via API issue.

Resolved the Tenable integration error.

Resolved the Application Configuration edit issue.

Resolved the password rotation failure when the super user is retrieved from a vault created with an AD configuration.

Resolved the Application Trigger error.

Resolved the child node rotation issues, including false success status, errors with connection and escalation users, and the missing parameter.

Resolved the Application Request logs issue.

Resolved the RPAM single device connection limit issue.

Resolved the issue where the perimeter firewall could not be accessed.

Resolved the issue where active sessions were displayed as offline in Wire to Session.

Resolved the SSH proxy session and Wire to Session failure.

Resolved the Desktop Client multi-tab connection failure issue.

Resolved the HTTPS Proxy screen freeze after credentials were entered.

Resolved the HTTPS Proxy slowness issues.

Resolved the issue where register tokens could not be generated on mobile devices.

Resolved the missing remote application search option in policy tracking.

Resolved the Show in Device Tree error.

Resolved the device reservation account selection error.

Fix Package - 3.8.1-patch4 Release Notes

Resolved the SAML login issue in Desktop Client.

Added support for new SSH Kex algorithms.

The user group is now displayed in the Profile menu.

Adjusted the disclaimer message font size.

Resolved the Policy Tracking and Log pages slowness.

Resolved the Superset CSV/Excel export issue.

Resolved the issue where the OTP cache remaining time was not displayed.

Resolved the RPAM single device connection limit issue.

Resolved the Tenable integration error.

Resolved the issue where SIEM packages were sent multiple times.

Resolved the password rotation via API issue.

Resolved the HTTPS Proxy line feed/carriage return termination error.