November 05th, 2026

5 min

TerminatorTerminator:

Keystrike now adds a second factor to SSH logins, for interactive shells and for file transfers such as SFTP and SCP. After the usual password or public key, the user sees a short, single-use code and types it. Their Keystrike client attests that a person typed the code at the keyboard of an enrolled device, and the host checks this before the session starts.

Shells and file transfers: Interactive shells are still protected throughout the session as before, and now also get a check at login. File transfers have no typed input during the session, so the login check is their protection. If the second factor can’t run, shells are still allowed in and protected during the session, while file transfers are refused.

The Linux SSH terminator is now also available as an RPM package, alongside the existing tarball. Download it from the Linux SSH tab on the Installers page.

Alert pages have been redesigned so you can see trends at a glance, filter to what matters and better understand each alert session.

Terminator Alerts page with a date range, filters, an time series chart and a richer alert session table.

Alert session details include an explanation banner, a plain-language summary of the alert type where applicable.

Terminator session timeline: shows the terminator session, the Keystrike session, the client connection and exactly when the alerts occurred, so you can see whether alerts happened inside a secure session or while the client was disconnected.

Recovery code use and cancelled user mappings are better highlighted in the alert lists.

Open in Activity Logs: jumps straight to the matching activity log entries for deeper investigation.

Alerts are still recorded in the activity logs and sent to your configured webhooks as before; this change affects how they are presented in the admin panel.

Filters now use a compact filter bar throughout the admin panel, including Alerts and Activity Logs. Large advanced filter panels have been replaced by a date range picker, the most common filters as chips, and Add filter for anything else. Only the filters you use take up space, which leaves more room for the results.

The Terminator bypass list now shows how many times each bypass policy has been used and when it was last used. This makes it easier to spot unused exceptions that can be removed. Usage is tracked from this release onward, so earlier use is not included.

Terminator, user, client, device, terminator bypass and alert pages now have an Open in Activity Logs button. It opens the activity logs already filtered to that item, so you can see its full history in one click.

Device pages now have an Open in Atlas button. It opens Atlas filtered to all remote access to and from that device, so you can see its connections at a glance.

Atlas now tells internal (private) IP addresses apart from external (public) ones and shows which kind each connection uses. You can filter on this with the filter builder or by asking a question in plain language, such as “connections from external IPs”. This makes it easier to spot remote access coming from outside your network, or internal hosts connecting out to the internet, and to combine it with other conditions like protocol or trust level.