Depot 0.8.0

Depot 0.8.0 tightens who can open remote sessions in which mode, makes every plan rule match what each plan includes, opens every compliance framework to every plan, and adds Linux packages. Existing roles keep the remote access they have today. Session recording is off until a profile turns it on, so check the upgrade notes if you rely on recorded sessions.

Highlights

• Role management. Create and edit roles, restore built-in defaults, and change a person’s roles from the console. See Manage roles.
• Permission for each remote access mode. Starting a session needs remote:initiate and the permission for the mode the endpoint’s policy picks. See Permission for each mode.
• Time limits you can turn off. Set a session or idle time limit to 0 to turn it off. A limit no profile sets keeps its default. See Limit session length.
• Every framework on every plan. SOC 2, HIPAA, PCI DSS 4.0, CJIS, NIST SP 800-171, NIST SP 800-53, CMMC Level 2, ISO/IEC 27001, DISA STIG, the Microsoft security baseline, and CIS Benchmarks are available on Home Lab and Essentials too. See Compliance framework baselines.

Added

Linux packages

Enroll a device offers Debian / Ubuntu x64 (.deb), Debian / Ubuntu arm64 (.deb), RPM Linux x64 (.rpm), and RPM Linux arm64 (.rpm). Each download is a .zip with the package, the enrollment configuration, and installation steps. The package installs the agent and the tray app. The tarballs are still offered. See Install and enroll the agent.

Compliance remediation alerts

On Home Lab and Essentials, which do not include the service desk, a control’s page offers Create remediation alerts instead of a ticket. Each selected endpoint gets one alert for the setting, and the alert closes the next time the endpoint reports the setting as compliant, or an approved exception covers it. See Create remediation alerts.

Role management

Settings > Roles lets you create, clone, edit, and delete roles. Edit a role’s permissions by area and review what you are adding and removing before you save. Built-in roles other than Owner can be edited and have Restore defaults. Owner always holds every permission. Someone who is not an owner cannot give a role, or a person, permissions they do not hold, and a refusal names the permissions involved. On Settings > Team, Roles on a person’s row changes the roles they hold. Only an owner can give, take away, disable, or enable the Owner role. See Manage roles.

Documentation on every plan

Home Lab, Essentials, and Enterprise can design asset layouts and write process templates for their own organization, under Documentation > Asset layouts and Process templates. MSP keeps its practice library. See Assets and asset layouts and Vendors, licenses, and processes.

Changed

Compliance

• No framework baseline requires session recording. The recording floor is removed from the SOC 2, HIPAA, PCI DSS, CJIS, NIST SP 800-171, NIST SP 800-53, CMMC Level 2, and ISO/IEC 27001 baselines. Outpost’s reading of these frameworks found no control that requires session recording, so declaring one no longer depends on a plan that records sessions. See Baseline settings by framework.
• Every framework can be declared on every plan, Home Lab and Essentials included. Before 0.8.0, those plans offered only DISA STIG, the Microsoft security baseline, and CIS Benchmarks.

Remote access

• Session recording is off by default on every plan. Before 0.8.0, remote_access.recording_required defaulted to on, so Enterprise and MSP recorded every session no profile turned it off for. In 0.8.0, sessions are recorded only where a profile turns recording on. See Record remote sessions.

• Before 0.8.0, remote:initiate was enough to open a session in any mode the endpoint’s policy allowed. In 0.8.0, a session also needs remote:unattended, remote:attended, remote:consent, or remote:escorted for the mode the policy picks. A Consent required session to the sign-in screen also needs remote:unattended. Outpost checks again at each change of signed-in user, and records each refusal in the audit log.

• Before 0.8.0, a session or idle time limit of 0 meant the default. In 0.8.0, 0 turns the limit off. With no profile setting a limit, the defaults are unchanged: 1 hour for a session, and 5, 10, and 30 minutes for the idle warning, pause, and end. A limit set by any other applicable profile still applies, and so do framework floors such as PCI DSS. See Remote access policy settings.

Plans

• Your Outpost checks your plan with the Outpost service every 15 minutes. When it cannot reach the service, it uses the last plan it verified for up to 72 hours. After that, plan-gated features are refused until it reconnects. See How your plan is checked.
• Session recording follows the plan. On Home Lab and Essentials, remote_access.recording_required is hidden in the profile editor, and a profile that requires recording cannot be applied. A profile that already required recording keeps working: sessions run unrecorded, and the viewer says so. See Session recording.
• Live chat is part of the service desk, on Enterprise and MSP. On Home Lab and Essentials, people cannot start a chat or see past chats from the tray app. A chat already running when the plan changes can finish. See Live chat.

Fixed

• Password managers such as 1Password can save and use passkeys for the console. Before 0.8.0, adding or using a passkey could open the browser’s own prompt, such as Windows Hello, instead of the password manager.

Security

Remote sessions enforce the permission for each access mode, so a role decides which modes its holders can use. Before 0.8.0, any technician with remote:initiate could open a session in any mode the endpoint’s policy allowed, including unattended sessions. The update gives every role that holds remote:initiate all four mode permissions, so no technician loses access.

Known issues

• A relayed remote session with no time limit ends after about 24 hours. Sessions over a direct connection are not affected. To keep a long session, reconnect before then. See Limit session length.

Upgrade notes

Outpost manages the hosted service update. Before it reaches you, check the following.

• Session recording. On Enterprise and MSP, sessions that were recorded only because recording was on by default stop being recorded after the update. To keep recording them, turn on remote_access.recording_required in a profile assigned to those endpoints. A profile that already sets it, including one converted from a remote access profile, keeps its value. To check, open Profiles > Effective config for an endpoint. See Choose which sessions are recorded.

• Remote access and roles. The update grants remote:unattended, remote:attended, remote:consent, and remote:escorted to every role that holds remote:initiate, built-in or custom, so existing roles keep today’s access. To narrow how technicians connect, remove mode permissions from their role in Settings > Roles, or set the modes an endpoint allows with remote_access.allowed_modes in a profile. See Manage roles and Configure access modes and consent.

• Time limits set to 0. When remote access profiles became ordinary profile settings, Outpost copied their time limits, including 0 values that meant the default. The update removes those copied 0 values, so the profiles keep the default limits. Any other 0 turns its limit off. Check Profiles > Effective config for an endpoint to confirm the limits that apply.

• Agents older than 0.4.0. An agent older than 0.4.0 ends a remote session that has no time limit 24 hours after the session starts. A change of signed-in user near that point can end the session slightly earlier on those agents. Update agents to 0.4.0 or later for sessions with no time limit. See Agent 0.4.0 and Agent updates.

• Live chat in the tray app. On Home Lab and Essentials endpoints with an agent older than 0.4.0, the tray app shows Live chat is not available right now. and suggests opening a ticket, rather than saying that live chat is not available on the computer.