Pangolin 1.26: Session Management, SSH Logs, and Auto Windows Updates

Pangolin 1.26 is here with a focus on sessions. The headline features are resource session management, continuous session revalidation for identity providers, and SSH session logs with full command transcripts. This release also adds automatic download and install of updates on Windows, custom DNS records on domains delegated to Pangolin, and custom auth page domains for self-hosted deployments.

Release Highlights

Resource Sessions

Public resources issue a session after someone authenticates, so later requests don't ask them to sign in again. Until now there wasn't a single place to see who still held those sessions or cut one off early. Resource Sessions lists every active session across your public resources: who holds it, which resource it's for, how they authenticated, and when it expires. You can revoke any session to force re-authentication.

Open Public Resources → Sessions. Expand a row for client details recorded when the session was created, including IP, location, browser, and device. Search, sort, and filter by actor, resource, and method. Authentication and request logs also link through to the resource session behind each entry.

You can also revoke an active session. Revoking a session requires the user to re-authenticate to that specific resource regardless of whether they have an active SSO session.

See the resource sessions docs.

Continuous Session Revalidation

By default, a user who signs in with an external identity provider keeps their Pangolin session until it expires or they log out, even if the account in the IdP is later disabled or the IdP session is revoked. Continuous session revalidation fixes this. Pangolin periodically checks with the IdP that the login is still valid. If the IdP has revoked it, Pangolin ends the user's sessions, including linked resource sessions and approved client sessions from that login.

Revalidation is configured per identity provider and is off by default. Turn on Continuous Session Revalidation on the IdP, and make sure the IdP client can issue refresh tokens. Only an explicit rejection from the IdP ends sessions, so an IdP outage won't log everyone out.

Details, scopes, and the revalidation interval are in the session revalidation docs.

SSH Session Logs

SSH session logs record each SSH session opened to your resources through Pangolin SSH mode: who connected, to which resource and site, as which system user, for how long, and a transcript of the commands run. That covers both browser SSH on public resources and private SSH reached with the Pangolin client.

Open Logs → SSH Sessions. Expand a row for session details and the command transcript. Set SSH Session Log Retention in org security settings to turn logging on (the default of 0 days leaves it off). Export to CSV when you need the full command history outside the dashboard.

Sessions in Standard SSH Server mode are passed through to your SSH server and aren't logged here. Use your server's own logging for those.

See the SSH session logs docs.

Automatic Updates on Windows

The Windows client can now download updates in the background and install them the next time Pangolin quits or starts. Turn on Automatically Download and Install Updates in preferences, or set autoDownloadUpdatesEnabled to true in the config file. Updates download in the background without prompting the user and install the next time Pangolin quits or starts.

The same automatic download and install behavior already works on Mac. Platform details are in the Windows and Mac client docs.

Custom DNS Records

When you delegate a domain to Pangolin with NS records, you can now manage the rest of that zone from Pangolin too. Custom DNS records cover MX, SPF, DMARC, verification records, and hostnames that point outside Pangolin, so you can hand over the whole domain without leaving mail or other records behind at your old provider.

Open the domain under Domains, go to Records, and add the records you need before you change nameservers. Custom records only apply to domain-delegation (NS) domains.

See custom DNS records.

Custom Auth Page Domains on Self-Hosted

You could already open an org login page at https://<dashboard_domain>/auth/org/<orgId>. That path is organization-only and is what users hit for organization-scoped identity providers: those IdPs only show up on that org's login page, so you have to visit it for a specific org to pick the IdP and sign in.

Custom auth page domains let you serve that same page under a different domain than the dashboard. That option was previously limited to Pangolin Cloud. In 1.26 it works on self-hosted Pangolin too, so resource authentication and IdP login can land on a domain you control.

Open Settings in the organization sidebar, pick a domain, and save. You need a custom domain on the organization first.

See the custom login page docs.

General Improvements and Bug Fixes

As always, this release also includes various UI improvements and bug fixes throughout the product.