Endpoint Privilege Management for Unix & Linux 26.2

✨ Enhancements

Certificate revocation

This release introduces certificate revocation for EPM-UL managed certificates. EPM-UL servers (license, policy, log servers) now maintain certificate revocation lists (CRLs), distribute them to endpoints, and provide administrative control over revocation through both the command line and the REST API.

Certificate revocation (CRL) support for default certificates

For deployments using default, EPM-UL–generated managed certificates, EPM-UL servers now maintain revocation lists and clients have a distribution method to retrieve them. Revoked certificates are rejected during the TLS handshake by the endpoint that validates them. Revocation of a client certificate therefore takes effect only where client certificate validation has been enabled, which is not the default. See "Revocation notice when client certificate enforcement is not enabled", below.

ℹ️
For more information, see Certificate revocation.

Revoke and reinstate certificates with pbdbutil --cadata --revoke

A new revoke operation accepts a certificate ID (obtainable from pbdbutil --cadata -l, but use -lll for clarity) together with a standard reason code. A companion document describes how to release a revocation hold, and how to re-enroll a host with a new certificate to reinstate it after a permanent revocation.

ℹ️
For more information, see CA database options.

Revoke all certificates belonging to a specified machine

Revocation can target a machine name rather than requiring an individual certificate ID, so revoking an entire host does not take multiple calls.

Delegated revocation after loss of the root CA or a critical sub-CA

Revocation authority is not bound to the issuing CA's private key, meaning the loss of a root CA or sub-CA server does not mean the loss of the ability to revoke certificates issued by it. Delegated revocation allows revocations to be issued after the loss of the issuing CA. Do note that such delegation must be prepared early, before the loss of the CA. It is not a recovery mechanism that can be applied after the fact.

ℹ️
For more information, see Delegated certificate revocation.

Import custom CRL files

Customers can supply their own CRL files, which are validated and then distributed to endpoints.

ℹ️
For more information, see Delegated certificate revocation.

Clients detect revocations without waiting for the next revocation check

The EPM-UL communication protocol carries the last CRL update timestamp, so a client that detects its local CRLs are stale re-fetches them immediately during the handshake.

ℹ️
For more information, see Delegated certificate revocation.

CRL regeneration performed by a scheduled task

CRL files are regenerated periodically to keep their validity window moving forward. The regeneration is done by a scheduled task so that current CRLs are ready in advance.

ℹ️
For more information, see Delegated certificate revocation.

Revocation notice when client certificate enforcement is not enabled

Because client certificate validation is not enforced by default, revoking a client certificate displays a message stating that the revocation is only enforced if clientcertificates is configured on the servers and clients, and the clients present their certificates with keywords sslpbruncertfile and sslpbrunkeyfile.

New settings to control certificate and CRL time skew

Two keywords, certbackdateskew and crlbackdateskew, allow these to be tuned independently, so sites can apply backdating windows to prevent clock skew from causing rejections of certificates or CRLs based on a comparison to a certificate’s or CRL’s not Before date and time.

ℹ️
For more information, see Keywords.

Certificate visibility and reporting

pbdbutil --cadata -l, -ll and -lll now provide more information to help identify certificates

The short listing, -l, shows each certificate's id, type, and expiry. The longer listing, -ll, adds the start of the validity period and the machine's UUID and FQDN, taken from the certificate's SAN. The longest listing, -lll, adds the subject, the SHA-256 fingerprint, the issuing host, and whether the certificate has been revoked. This makes it possible to identify which machine a certificate belongs to without inspecting the file system, which matters for certificates that no longer exist on disk following a renewal.

ℹ️
For more information, see CA database options.

Filtering and sorting for certificate and revocation data

The cadata certificate (-l) and revocation (-L) listings support sorting and filtering, including filtering by date.

ℹ️
For more information, see CA database options.

Revoking host recorded in revocation data

The pbdbutil --cadata -LL output identifies the machine that performed each revocation, and that field can be used as a filter.

ℹ️
For more information, see CA database options.

Multiple FQDNs per host (multi-homed support)

A single EPM-UL UUID or machine can be associated with more than one FQDN, so multi-homed hosts no longer require workarounds.

Other enhancements

policyacktimeout now defaults to no timeout for on-premises deployments

policyacktimeout was introduced for SaaS deployments, where its short default caused on-premises policies that take longer than ten seconds to authorize a pbrun to abort without useful diagnostics. The on-premises default is now -1 (no timeout). Sites that want a timeout can set the keyword to a value suited to their environment.

ℹ️
For more information, see policyacktimeout.

pblocald.socket connection limits aligned with pbmasterd and pblogd

MaxConnections=25000 and TriggerLimitBurst=0 have been added to pblocald.socket, matching the existing pbmasterd and pblogd socket units and preventing systemd from rate-limiting the socket under load.

Removed the libxml2 dependency from binaries that do not use it

libxml2 was linked by all binaries on all platforms while being used only by pbbench on Solaris. The dependency has been eliminated.

Corrected shelllogincludedfiles in the demo RBP policy and the policy language

The variable name was misspelled as shelllogincludefiles in the Policy Language Guide and in the demo role-based policy. Both have been corrected.

Corrected shellforbiddencommands in the demo RBP policy

The variable name was misspelled as shellfobiddencommands in the demo role-based policy and has been corrected.

Platform support

Additional supported platforms

Additional supported platforms:

Debian 13 (Trixie)
SUSE Linux Enterprise 16
SUSE Linux Enterprise Server 15 (ppc64le)
Ubuntu 26.04 LTS with kernel 6 and 7
Ubuntu 24.04 LTS with kernel 7

Sudo Manager support for Ubuntu 26.04

The Sudo Manager install path used a separate platform check from the general installer, causing sudomgrinstall to reject Ubuntu 26.04 even though pbinstall accepted it. Ubuntu 26.04 is now recognized by both.

Sudo Manager does not support sudo-rs, the reimplementation of sudo written in Rust, which is now the default on Ubuntu 26.04. If sudomgrinstall detects that the system's sudo is sudo-rs, it will display an error and abort the installation.

ℹ️
Ubuntu 26.04 without libwtmpdb: pbinstall and package installer automatically set recordunixptysessions to no to prevent runtime errors.

Third-party library upgrades

All third-party libraries are at their latest releases at the time of this release:

OpenSSL 3.5.7
Curl 8.21.0
OpenLDAP 2.6.14
Kerberos (krb5) 1.22.2 (no change)
jansson 2.15.1
libedit 20260512-3.1
libevent 2.1.13
SQLite 3.53.4
unixODBC 2.3.14 (no change)
lighttpd (pblighttpd) 1.4.82
PuTTY (pbssh) 0.84

🛠️ Issues resolved

Product area	Description	Resolution
ACA (Advanced Control and Audit)	`pbrun pbless` (and `pbvi`, `pbnvi`, `pbumacs`, `pbmg`) did not apply ACA rules.	The EPM-UL shell utilities now honor ACA file rules when launched through `pbrun` or from an ACA-managed PTY. A rule denying read access is enforced consistently regardless of which utility opens the file.
ACA (Advanced Control and Audit)	`find` was not rejected by ACA rules on Solaris clients.	`find` now returns a permission denied message on Solaris, consistent with other commands.
ACA (Advanced Control and Audit)	With an ACA role in the policy, `pbksh` and `pbsh` failed when run as root.	`pbksh` and `pbsh` no longer fail for root when the policy contains ACA statements and the license enables ACA. The misleading `1009 ACA policy not enabled` message in `pbmasterd.log` no longer appears in this scenario. This issue affected v24.1.4 and later.
Certificates	Certificate renewal did not fail over correctly, and license servers were randomized.	Renewal now fails over to other policy servers as well as license servers, tries each host in the list rather than only the first one found, and no longer randomizes the order in which license servers are contacted.
REST and logging	`pbrest.log` recorded SSL and connection errors for license updates when interoperating with older REST services.	Errors raised when a current REST service contacts an older license server are now handled without logging spurious `curl err=7` and `curl err=60` failures against `/REST/v2/license/updates`.
Security	Dynamic-linker variables were propagated into a privileged exec.	The execution layer now unconditionally strips dynamic-linker, locale, and iconv environment variables before executing a delegated command, so they cannot be inherited from the submitting user's environment when the command runs as the run user. This applies to `iologactioncmd` as well.
Security	Event log rotation did not check the security of the target directory before creating it.	The rotation target path, including symlinked components, is now validated before the directory is created.
Other	An I/O logged delegated `pbrun` or `pblocald` command that emitted a large volume of output could hang.	A change made in v25.1.6 to address a separate hang replaced a single timed wait in the I/O channel with a repeated short-timeout loop, which could block the I/O loop for up to five minutes on high-latency or saturated links. The command's output pipe then filled and the session deadlocked. Waiting behavior on the control channel has been corrected so that large output over slow connections completes normally. This issue affected v25.1.6 and later.