csudderth

Hello! Are there any updates on this?

Hello! Are there any updates on this request?

And for anyone reading...this was implemented in v1.3.0 a few weeks ago.

https://github.com/Devolutions/ansible-dvls/releases/tag/v1.3.0

Hi @csudderth! I'm glad you gave a shot to our ansible-module! My team is reponsible for its development. Any feedback is welcomed and I will make sure we discuss it with my team this week. We will keep you in the loop for that feature request.

@Richer Larivière

I have been using the new lookup plugin for a couple of weeks now with great success. Thank you for implementing this feature request and doing it so quickly!

I’m not sure who else is running their installations on Linux in Docker, but I’ve had issues upgrading with the following error:

PSU    | [07:16:07 INF] Universal.Server.Services.SystemPluginService Using database connection string: Data Source=/root/.PowerShellUniversal/psu.db
PSU    | [07:16:08 FTL]  Fatal error starting PowerShell Universal.
PSU    | System.TypeInitializationException: The type initializer for 'Devolutions.Cryptography.Native' threw an exception.
PSU    | ---> System.DllNotFoundException: Unable to load shared library 'DevolutionsCrypto' or one of its dependencies. In order to help diagnose loading problems, consider using a tool like strace. If you're using glibc, consider setting the LD_DEBUG environment variable:
PSU    | /home/Universal/DevolutionsCrypto.so: cannot open shared object file: No such file or directory
PSU    | /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by /home/Universal/libDevolutionsCrypto.so)
PSU    | libDevolutionsCrypto.so: cannot open shared object file: No such file or directory
PSU    | /home/Universal/DevolutionsCrypto: cannot open shared object file: No such file or directory
PSU    | /home/Universal/libDevolutionsCrypto: cannot open shared object file: No such file or directory
PSU    |
PSU    |    at Devolutions.Cryptography.Native.VersionSizeNative()
PSU    |    at Devolutions.Cryptography.Native.VersionSizeNative()
PSU    |    at Devolutions.Cryptography.Utils.Version()
PSU    |    at Devolutions.Cryptography.Native..cctor()
PSU    |    --- End of inner exception stack trace ---
PSU    |    at Devolutions.Cryptography.Native.GenerateKeyPairSizeNative()
PSU    |    at Devolutions.Cryptography.Native.GenerateKeyPairSizeNative()
PSU    |    at Devolutions.Cryptography.Managed.GenerateKeyPair()
PSU    |    at PowerShellUniversal.DevolutionsAuthenticationMethod.AddAuthentication(AuthenticationBuilder builder, IConfiguration configuration) in D:\a\powershell-universal\powershell-universal\src\PowerShellUniversal.Authentication\DevolutionsAuthenticationMethod.cs:line 33
PSU    |    at Universal.Server.Startup.ConfigureServices(IServiceCollection services) in D:\a\powershell-universal\powershell-universal\src\Universal.Server\Startup.cs:line 462
PSU    |    at System.RuntimeMethodHandle.InvokeMethod(Object target, Void** arguments, Signature sig, Boolean isConstructor)
PSU    |    at System.Reflection.MethodBaseInvoker.InvokeDirectByRefWithFewArgs(Object obj, Span`1 copyOfArgs, BindingFlags invokeAttr)
PSU    |    at System.Reflection.MethodBaseInvoker.InvokeWithOneArg(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
PSU    |    at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
PSU    |    at Microsoft.AspNetCore.Hosting.ConfigureServicesBuilder.InvokeCore(Object instance, IServiceCollection services)
PSU    |    at Microsoft.AspNetCore.Hosting.GenericWebHostBuilder.UseStartup(Type startupType, HostBuilderContext context, IServiceCollection services, Object instance)
PSU    |    at Microsoft.Extensions.Hosting.HostBuilder.InitializeServiceProvider()
PSU    |    at Microsoft.Extensions.Hosting.HostBuilder.Build()
PSU    |    at Universal.Server.Program.Main(String[] args) in D:\a\powershell-universal\powershell-universal\src\Universal.Server\Program.cs:line 41
PSU    | Unhandled exception. System.TypeInitializationException: The type initializer for 'Devolutions.Cryptography.Native' threw an exception.
PSU    | ---> System.DllNotFoundException: Unable to load shared library 'DevolutionsCrypto' or one of its dependencies. In order to help diagnose loading problems, consider using a tool like strace. If you're using glibc, consider setting the LD_DEBUG environment variable:
PSU    | /home/Universal/DevolutionsCrypto.so: cannot open shared object file: No such file or directory
PSU    | /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by /home/Universal/libDevolutionsCrypto.so)
PSU    | libDevolutionsCrypto.so: cannot open shared object file: No such file or directory
PSU    | /home/Universal/DevolutionsCrypto: cannot open shared object file: No such file or directory
PSU    | /home/Universal/libDevolutionsCrypto: cannot open shared object file: No such file or directory
PSU    |
PSU    |    at Devolutions.Cryptography.Native.VersionSizeNative()
PSU    |    at Devolutions.Cryptography.Native.VersionSizeNative()
PSU    |    at Devolutions.Cryptography.Utils.Version()
PSU    |    at Devolutions.Cryptography.Native..cctor()
PSU    |    --- End of inner exception stack trace ---
PSU    |    at Devolutions.Cryptography.Native.GenerateKeyPairSizeNative()
PSU    |    at Devolutions.Cryptography.Native.GenerateKeyPairSizeNative()
PSU    |    at Devolutions.Cryptography.Managed.GenerateKeyPair()
PSU    |    at PowerShellUniversal.DevolutionsAuthenticationMethod.AddAuthentication(AuthenticationBuilder builder, IConfiguration configuration) in D:\a\powershell-universal\powershell-universal\src\PowerShellUniversal.Authentication\DevolutionsAuthenticationMethod.cs:line 33
PSU    |    at Universal.Server.Startup.ConfigureServices(IServiceCollection services) in D:\a\powershell-universal\powershell-universal\src\Universal.Server\Startup.cs:line 462
PSU    |    at System.RuntimeMethodHandle.InvokeMethod(Object target, Void** arguments, Signature sig, Boolean isConstructor)
PSU    |    at System.Reflection.MethodBaseInvoker.InvokeDirectByRefWithFewArgs(Object obj, Span`1 copyOfArgs, BindingFlags invokeAttr)
PSU    |    at System.Reflection.MethodBaseInvoker.InvokeWithOneArg(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
PSU    |    at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
PSU    |    at Microsoft.AspNetCore.Hosting.ConfigureServicesBuilder.InvokeCore(Object instance, IServiceCollection services)
PSU    |    at Microsoft.AspNetCore.Hosting.GenericWebHostBuilder.UseStartup(Type startupType, HostBuilderContext context, IServiceCollection services, Object instance)
PSU    |    at Microsoft.Extensions.Hosting.HostBuilder.InitializeServiceProvider()
PSU    |    at Microsoft.Extensions.Hosting.HostBuilder.Build()
PSU    |    at Universal.Server.Program.Main(String[] args) in D:\a\powershell-universal\powershell-universal\src\Universal.Server\Program.cs:line 41
PSU exited with code 139 (restarting)

I’ve even tried with a fresh installation and still get the same result. This is upgrading from ironmansoftware/universal:5.6.13-ubuntu-20.04 to devolutions/powershell-universal:2026.1.0-ubuntu-20.04. Even running devolutions/powershell-universal:2026.1.0-ubuntu-20.04 as a new installation without my data seems to have the same results. Every other version update I’ve done has been smooth sailing.

Hello csudderth,

I appreciate the quick response.

After testing Close-DSSession followed by Exit in PowerShell, we can reproduce this issue only on macOS.

I will report the issue, and an internal ticket will be opened.

Could you confirm whether you can close the PowerShell session without Close-DSSession?

Best regards,

@Patrick Ouimet

Patrick,

And thank you as well for the quick response. Y'all are always a pleasure to work with. I can confirm I am able to close a Powershell session normally on both macOS and Linux. On macOS, I can reproduce the issue every time. On Linux, it seems to be sporadic, which lines up with my CI/CD pipeline using the Devolutions.Powershell module freezing ocassionally at the end of the script it was running. The last time I tested, it was on a Debian image and it took me 3 times before I got it to exhibit the hanging on exit, so it may take several tries.

Hey Patrick,

Thanks for reaching out. Sorry for leaving out the version info! The module is the latest verison at the time of writing (2025.3.3) and my version of Powershell is 7.5.4. I've now been able to reproduce this consistently. It seems to be on the session disconnect and not the connection. If you've ever run Close-DSSession at any point in the session and try to exit, it seems to freeze. I was able to reproduce this consistently on both my local macOS machine and a Linux environment.

Powershell hangs whenever I try to exit whenever I have used a Devolutions.Powershell cmdlet during the session. Even when I run New-DSSession with invalid credentials and never actually make a connection, it makes Powershell freeze on exit. I first noticed this in a Gitlab CI/CD pipeline on a Linux Docker runner. The Powershell script would run successfully but would hang indefinitely at the end sometimes. Others, it would end just fine. I was able to recreate this on my Macbook as well. All I did was attempt a New-DSSession and it would intermittently hang when trying to exit. There doesn't seem to be any consistency or pattern to it unfortunately. The only workaround that has been successful is using [Environment]::Exit(0) to forcefully exit instead of exiting normally. Is this a known issue? I'm happy to provide any further debugging details if possible.

I see there is already an operator for syncing Devolutions Server credentials as Kubernetes secrets: https://github.com/Devolutions/dvls-kubernetes-operator

I think another fantastic approach would be to integrate with the External Secrets Operator: https://external-secrets.io/

It has support for a number of other credential vaults and I would love to see Devolutions Server support.

It is the former: have the ability for Tenable to retrieve credentials from Devolutions Server to be used in scans.

Tenable (both Tenable Security Center and Tenable.io) integrates with several vault & PAM solutions for credentialed scans:

https://docs.tenable.com/security-center/Content/Credentials.htm

I would love to request a similar Devolutions integration for Tenable so I can vault & manage credential lifecycle in Devolutions Server instead of putting the passwords directly in Tenable for credentialed scans.

Hi Maxim,

Thank you so much for the notification. I see the latest version for macOS is still 2025.3.6.9. Will the fix be coming to that platform soon as well?

A few requests in order of importance to me

I think it would be great to be able to enable "dynamic resize" in web RDP sessions by default:

Also, would it be possible to have the top bar be auto hiding and have it appear on mouse hover? I've seen other web RDP solutions implement something similar as a floating button that expands on hover. I think that extra bit of screen real estate on the top would make a huge difference, especially on smaller laptop screens.

And finally, would it be possible to have an option to open the connection in a new tab? I think this would be a great for that extra screen real estate without having to go full screen.

Thank you so much for the consideration. This is a great suite of products and I am a huge fan.

Incredible! Thank you so much. Just to clarify, is this only in the macOS version or will it be in the Windows version as well? My team has both operating systems.

When RDM authenticates with Devolutions Server, it makes several requests to /.well-known/openid-configuration, /.well-known/jwks, and /api/connect/. None of these requests have a user agent, which means our Cloudflare configuration blocks it due to the user agent being empty. We can make some exceptions to the Cloudflare rules, but I would love to request that any API calls that RDM makes to DVLS will have a user agent.

Thank you so much for the consideration! I'm still in the tinkering stage, but I actually planned on spending a lot more time with it in the coming weeks, so I'm more than happy to share any additional feedback I may have.

The operatingSystem attribute should suffice. That attribute on our RHEL family servers (RHEL, Rocky Linux, AlmaLinux) have "redhat-linux-gnu" as the value and our Ubuntu servers have "pc-linux-gnu."

I hope this helps!

Hi Luc,

Thank you so much for the response! I was planning on trying to develop a custom provider. If I get it working well, I'd love to contribute back with that script. But to answer your question, yes our Linux machines are in an OU in AD. Essentially, it would SSH in to Linux devices it discovers in AD and rotate the password of a specified local account. Even if it were a toggle in the scan configuration that these were Linux devices, that would work.

First off, I apologize if this is in the wrong location! I've been reviewing the Ansible module and I think it's great, but I would also love a lookup plugin for fetching credentials so that I wouldn't have to necessarily fetch credentials in a task in a playbook.

Here is another product that does this:

https://galaxy.ansible.com/ui/repo/published/delinea/ss/docs/tss/

The advantage of this is I could have the lookups directly in inventory and group variables and then could expose the vault ID, URL, API key, etc via variables. The Delinea example is a little messy and I'm sure there's a better way to do it.

Currently with Linux servers, it appears you have to specify them individually for local account discovery. We domain-join all of our Linux servers and I would love to be able to do local account discovery for domain-joined Linux servers based on OU like you can do domain-joined Windows devices today. I would also like for this to include both local account credential discovery/rotation as well as managing SSH keys for that local account. I would also like to be able to specify the name of that local account. The credentials being used for discovery could be the same ones specified for the Active Directory provider.

I was actually logging in to make this same feature request! Just to add, people will commonly put the public key in the altSecurityIdentities attribute. I have also seen others create a custom sshPublicKey attribute and use that. Here is some non-paywalled documentation for how to set this up if it helps:

https://rayancrasta.hashnode.dev/linux-ssh-key-password-auth-for-users-stored-in-active-directory

Ideally, it would store the public key in the specified AD attribute and then store the private key with the AD credentials in DVLS.

Paul, thank you so much for the explanation and ticket. I really appreciate it!

I am now experiencing password rotation and heartbeat failures on accounts in the Protected Users group after upgrading to DVLS version 2025.3.3.0. Once I remove the accounts from the group, everything works as expected. It appears that DVLS is using NTLM authentication instead of Kerberos. I get the following audit log in the domain controller when the user is in the Protected Users group at the time of rotation & heartbeat:

NTLM authentication failed because the account was a member of the Protected User group.

Account Name: [Redated Account Name]

Device Name: [Redacted Domain Controller Name]

Error Code: 0xC000006E

In DVLS, I am getting an LDAP Code 49 failure when attempting the heartbeat or password rotation. Interestingly enough, password rotation & heartbeats work for members of the Protected Users group if the provider is set to use LDAP instead of LDAPS account, which isn't ideal. I am happy to provide more logs if needed, but not really sure where to go from here.

Hi Michel,

I'm actually good to go here. It was an issue on the Cloudflare side. If anyone runs into any issues in the future, check your workers if you have any on your Cloudflare account.

I'm not sure if this would be a Gateway issue or a Cloudflare issue, but thought I'd ask here as well. I do have a support case open with Cloudflare as well.

I have a Devolutions Server with gateways and I am currently unable to access any web sessions while proxied over Cloudflare. This happens with both using a tunnel and without using a tunnel. When not using a tunnel, as soon as I set the DNS record to a gray cloud, it works great. I have tried this with two different gateway servers so far with the same results. Here is a sample of the logs when connecting:

2025-10-16T20:29:56.725672Z INFO listener{port=7171}:https{client=172.18.0.1:37338}:request{method=GET path=/jet/rdp}: devolutions_gateway::middleware::log: duration=33.316µs status=101 Switching Protocols

2025-10-16T20:29:56.755589Z ERROR listener{port=7171}:https{client=172.18.0.1:37338}:request{method=GET path=/jet/rdp}: devolutions_gateway::api::rdp: RDP failure client=172.18.0.1:37338 error="couldn’t read clean cleanpath PDU: WebSocket protocol error: Connection reset without closing handshake: WebSocket protocol error: Connection reset without closing handshake: Connection reset without closing handshake"

On the Cloudflare logs, I am just seeing a 500 status on the edge servers, but no status code at all for the origin. Internally, everything works as expected. While inspecting tunnel logs, I do not see any X509/SSL errors (at first I was getting these until I specified the hostname in the TLS settings on Cloudflare Tunnel) and get no errors at all.

Unfortunately, I don't have much else to go on and while I believe this is an issue on the Cloudflare side, has anyone seen this and dealt with this before?