Keystrike Terminator
18 min
Current release
November 05th, 2026 version 4.1
- SFTP/SCP supported in Linux SSH terminator
- Keystrike now adds a second factor to SSH logins, for interactive shells and for file transfers such as SFTP and SCP. After the usual password or public key, the user sees a short, single-use code and types it. Their Keystrike client attests that a person typed the code at the keyboard of an enrolled device, and the host checks this before the session starts.
- Shells and file transfers: Interactive shells are still protected throughout the session as before, and now also get a check at login. File transfers have no typed input during the session, so the login check is their protection. If the second factor can’t run, shells are still allowed in and protected during the session, while file transfers are refused.
- RPM package for the Linux SSH terminator
- The Linux SSH terminator is now also available as an RPM package, alongside the existing tarball. Download it from the Linux SSH tab on the Installers page.
- Minor updates
- Security enhancements
- General bug fixes
Previous releases
Note: The information in the past release notes may have been superseded by subsequent release notes. Please review all current release notes carefully.
October 22nd, 2026 version 4.1.5976
- Touchscreen improvements
- Improved handling of touchscreen inputs across clients and terminators, ensuring that legitimate local touch interactions work as expected while preventing unauthorized touch inputs from remote sessions.
- Minor updates
- Security enhancements
- General bug fixes
September 14th, 2026 version 4.0
- Auto updates
- Windows terminators support automatic updates, which can be managed through configured update policies or initiated manually from the Admin Panel.
- Minor updates
- Security enhancements
- General bug fixes
August 27th, 2026 version 3.13
- Keystrike prompts on Windows secure desktop
- Prompts for dynamic user mapping and recovery codes are now displayed on the Windows Secure Desktop. This is a separate, protected screen used by Windows for sensitive security prompts. When it appears, the background dims to indicate that your regular apps are temporarily paused while you complete the prompt.
- Minor updates
- Security enhancements
- General bug fixes
August 13th, 2026 version 3.12
- Domain users on Linux
- The Linux (SSH) Terminator now supports domain user accounts in addition to local users, for example via SSSD.
- This allows Linux servers joined to an organization’s Microsoft Active Directory domain to use domain accounts, eliminating the need to create separate local Linux users.
- Better support for VM base images
- Terminators can now be installed on VM base images (golden images) without specifying organization and setup token parameters. When new VMs are created from the image, these parameters can be provided during initialization.
- Minor updates
- Security enhancements
- General bug fixes
February 19th, 2026 version 3.7
- Minor updates
- Security enhancements
- General bug fixes
December 15th, 2025 version 3.6
- Remote Desktop Support Expansion
- This update provides greater flexibility for environments using multiple remote access tools. Remote access compatibility now extends beyond Remote Desktop Protocol (RDP) to include:
- NinjaOne
- TeamViewer
- Splashtop
- GoToMyPC
November 6th, 2025 version 3.4
- Enhanced Linux (SSH) Support
- To expand broader enterprise compatibility, Linux (SSH) installation now supports additional Linux distributions alongside Ubuntu 22.04+:
- RedHat 9.7+
- Fedora 42+
- Debian 12.12+
- Minor updates
- Security enhancements
- General bug fixes
April 10th, 2025 version 3.2
- Minor updates
- Security updates
- Bug fixes
February 27th, 2025 version 3.1
- Linux (SSH)
- Initial release of the Linux Secure Shell (SSH) terminator.
- Terminator bypass
- Terminator Bypass policies are security exceptions that allow specific user accounts on a device to be excluded from Keystrike's protection. These policies enable the terminator on a device to remain in enforcement mode while permitting access for designated accounts that require entry without a Keystrike client.
- Security exceptions should be minimized and reviewed regularly. It is recommended to set an expiration time for each bypass policy to ensure temporary access control.
- Go to Security Policy > Terminator Bypass in the admin panel to configure.
February 6th, 2025 version 3.0
- Dynamic user mapping
- When dynamic user mapping is enabled, the terminator prompts the user to enter a 9-character code for the initial mapping.
- Windows Installer
- Updates can now be performed without requiring parameters, allowing seamless upgrades while preserving the existing configuration.
- In addition to installation via msiexec, the installer can now be executed directly, prompting for any necessary parameters if required.
- Instead of the full dispatch url, the organization domain is now passed to the installers.
- Proxy configuration
- If the device can only connect to dispatch through an explicit proxy, an optional proxy parameter can be passed to the installer.
October 24th, 2024 version 2.4.2025
- Updates
- Security updates
- Bug fixes
September 2nd, 2024 version 2.3.1789
- Recovery codes
- In case of an emergency it may be necessary to disable enforcement mode for a terminator session by entering a recovery code.
- Information regarding recovery codes can be found under Configuration in the admin panel
- Other updates
- Security updates
- Bug fixes
May 21st, 2024 version 2.0.1386
- Terminator protects admin processes
- The terminator now protects processes that "run as admin", that were previously out of scope.
- Faster install and reduced footprint
- The new terminator has a much smaller footprint and a faster install process.
- Terminator startup time
- The terminator startup time is drastically improved.
- Last known config
- If, for some reason, the terminator can't communicate to dispatch, the last known config, e.g. for enforcement mode, is still enforced.
- Better session handling
- The terminator has better detection of connection and session interruptions and reconnects quicker.
- Local logging
- Log file location has changed, with logs now stored in %programdata%\Keystrike\Logs
- Other updates
- Security updates
- Bug fixes
February 22nd, 2024 version 1.2.1018
- Webhook messages sent when enforcement mode is toggled
- When terminators are switched between modes, then a notification is sent if a webhook is configured. This will also be reflected in activity logs
- Improved Error Logging:
- More details have now been added to the Event viewer logs.
- Improved key handling:
- False negatives, where legitimate keystrokes are in rare cases flagged as unattested should now be a thing of the past.
- Bug fixes:
- Terminators get configs right away when they are added to a group.
December 14th, 2023 version 1.0.704
- Terminator checks for legit SSL certificate from Dispatch
- For companies using http proxy servers or firewalls with SSL inspection, the dispatch domain or IP address needs to be whitelisted.
- Install tokens:
- Install tokens are now required for installing terminators, this token can be found and regenerated in the Setup & Installers page in the admin panel.
- Log rotation:
- The terminator log is rotated every day and the past seven days kept before being deleted.
- Stopping the service process, stops sessions:
- When a user (SYSTEM privileges needed), stops the KeystrikeTerminator service, all KeystrikeTerminatorSession processes are now stopped, rather than having to stop them separately.
October 11th, 2023 version 0.5.442
- Improved session disconnect time:
- Client terminator sessions now disconnect sooner when remote session is closed.
- Improved context capture:
- Terminator is now logging context for all alerts reported not just the first alert event in a particular process.
September 18th, 2023 version 0.4.376
- New Emergency brake sequence:
- The combination for switching from Enforcement to audit mode has been changed. Instructions are placed in the setup pages in the Admin panel
August 24th, 2023August 24th, 2023 version 0.3.309
- Terminator running as a Windows service:
- The terminator now runs as a windows service, with a separate terminator session process per user logging into the remote host. The service runs as System ensuring that a terminator session is running for every user.
- MSI Installer:
- The Terminator is now installed using MSI. Instructions and examples for running the installer can be found in the setup pages in the Admin panel.
- Configuration File:
- It’s now possible to set the log-level, terminator mode, dispatch URL and regular expression patterns to map users between clients and terminators in a config file. Instructions and examples are placed in the setup pages in the Admin panel.
- Terminator in Event Viewer:
- Events from the Terminator are now sent to the Event Viewer in Windows. This applies to starting and stopping Terminators, not keyboard related events.
- Emergency Brake:
- Switch from Enforcement mode to Audit mode. If for some reason you can not establish a session between a client and a terminator it is possible to switch to audit mode (where keystrokes are logged but not blocked)
- Bug fixes & Improvements
- Performance enhancements for faster load times.
July 4th, 2023July 4th, 2023 version 0.2.234
- Mouse Support
- The terminator now has the ability to block mouse clicks in Remote Desktop Sessions. This means that in addition to not being able to type, an attacker can not click with the mouse on a remote host.
- In enforcement mode mouse clicks are blocked and trigger alert.
- In audit mode the mouse clicks are allowed to pass through but trigger alerts.
June 14th, 2023June 14th, 2023 version 0.1.213
Initial release to production for Pilot customers