AD Bridge 24.2 release notes

November 21, 2024

• Agent: 24.2.0.745
• Windows: 24.2.0.25

ℹ️

Note

For installation requirements, see the following:

• For the agent, see Install Requirements for the Agent.
• For the management console, see Requirements to Use AD Bridge with Active Directory.
• For a list of supported platforms for the latest version of AD Bridge, see the Supported Platforms Guide.
• Supported Platforms Guides for previous versions of AD Bridge can be found in the AD Bridge Documentation Archive.

New features and enhancements:

• DButilities can now send events directly to ElasticSearch without configuring SQL server.

• A new event will be sent when only ElasticSearch is set up as a data endpoint. This can be used to get a report in ElasticSearch on the health of the collection server.

  • You can see the event by filtering for:
  • statusevent.CollectionServer : COLLECTORNAME

• There is a new option to configure the local parameters when SQL is not available. The Set Local Parameters option is now available on the Reporting Database Connection Manager and allows the configuration of ElasticSearch event batch size. If SQL or BI (or combo of both) is enabled, the Set Local Parameters option is disabled and this setting will come from SQL.

• Modify bundled ldapsearch utility to use kerberos

  • Active Directory users can use any of the new binaries without providing a username or password.

• Bundle a version of ldapmodify, ldapcompare, ldapdelete and ldapwhoami

These are additional binaries provided in /opt/pbis/bin

LDAPS support in ldapsearch:

To use TLS with the ldap binaries

• Trusted cert and client cert
  • recommend configuring these for the account in an ldaprc file. See ldap.conf(5)
  • Both TLS_CACERT and TLS_CERT are required
• Provide the mode and port with -H
  • -H ldaps://server.domain.com:636
  • -x is needed for simple authentication as GSS will not work with TLS

Before this release AD Bridge modified the system files directly after a backup(/etc/ssh/sshd_config). AD Bridge now copies the configuration into the subdirectory /etc/ssh/sshd_config.d/ so that the system files are not touched.

• Disabling ssh module restores main file and sub folder files
• On upgrade sshd_config settings use 30-ADBridge* files.
• New SSH files work with testprefix.
• Configure ssh with ADBridge files in /etc/ssh/sshd_config.d/
  • If files are found in sshd_config.d the system files are no longer modified.
  • Files are copied from /opt/pbis/share
  • There is a common file 30-ADBridge.conf and 2 depending on gssapi preferences.

If the module is not configured before AD Bridge is upgraded it should not be enabled after the upgrade.

• domainjoin-cli join --ignore MODULE removes entry from domainjoin.cfg

• Added note about the module configuration being saved.

• Detect and save if SSH was enabled on versions before 24.2

• Detect and save if nsswitch was enabled on versions before 24.2

• Detect and save if pam was enabled on versions before 24.2

• Save module options on domainjoin to /var/lib/pbis/domainjoin.cfg

• Retain nogssapi on upgrade

• Do not enable module on upgrade if not configured.

• Multiple nic with DHCP support with Network Manager

• Support pam_aucore file paths

• gdm pam files on RHEL9 platforms is now supported.

• Update hostname in Network Manager for DHCP interfaces

• The Status page in the BeyondTrust Management Console now displays the amount of RIDS currently in use.

Issues resolved