Authyo RDP Guard for Linux (SSH) — What's New (v1.1.6)

Updated: 2026-07-13
Applies to: Authyo RDP Guard for Linux — the pam_authyo PAM module for SSH and
other PAM-aware services.
Verified on: Ubuntu 22.04 LTS, Rocky Linux 9 (RHEL 9 / Alma 9 compatible).

Download: the latest packages are on your Authyo dashboard download page.
Debian/Ubuntu: authyo-gatekeeper_1.1.6-1_amd64.deb
RHEL/Rocky/Alma/Amazon Linux/Fedora: authyo-gatekeeper-1.1.6-1.x86_64.rpm

This release brings the Linux SSH guard to feature parity with Windows on
anti-lockout: you can never be locked out of your server when the OTP step can't
run. No configuration changes are required — the new safety behavior is on by
default.

At a glance

Change	What it means for you
Never-stuck sign-in (anti-lockout)	When `pam_authyo` can't run the OTP step, your SSH login completes with your normal password instead of being denied.
No-contact no longer locks you out	A box with no / misconfigured contacts previously denied login. It now falls through to password auth.
Outage-safe	An Authyo outage or an unverifiable server policy also fall through to password (overrides the fail-closed policy).

pam_authyo now guarantees a way in whenever it cannot perform the OTP
challenge. In each of these situations it steps aside and lets the normal
password module complete the login (PAM ignore), instead of failing the login:

no OTP contact is configured for the signing-in user,

Authyo is unreachable (network/outage),

a server-authoritative policy could not be verified.

This is on by default.

Behavior change to be aware of: previously, a server with no deliverable
contact returned an authentication error (a lockout). As of 1.1.6 that server
steps aside to password auth instead. If you relied on that hard failure, see
Strict mode below.

What it does not do (your security is intact)

pam_authyo never authenticates you by itself. It only drops the OTP
requirement and hands off to your password module — your normal Unix/SSH
password is still required. (Keep the module stacked as

auth required
pam_authyo.so

after your password module, as in the install guide.)

A working OTP is still enforced — a delivered code entered wrong is still
rejected.

The remote kill-switch still denies. If you Disable a server from the
portal, login is blocked outright.

Strict mode (optional)

To make a server block rather than allow a password-only login when OTP can't
run, set the new policy flag in /etc/authyo/gatekeeper.conf:

{
  "policy": {
    "neverLockOut": false        // strict: fail closed when OTP can't run
    // ... your other policy settings ...
  }
}

Re-run sudo authyo-configure --test and confirm you can still get in from a
second SSH session before you rely on it. Default is true (never-stuck).

Note: Team Login is a Windows-only feature and does not apply to Linux SSH.

Upgrade notes

Install the new package:

Debian/Ubuntu: sudo apt install ./authyo-gatekeeper_1.1.6-1_amd64.deb

RHEL/Rocky/Alma: sudo dnf install ./authyo-gatekeeper-1.1.6-1.x86_64.rpm

No SSH restart required for new sessions; existing sessions are unaffected.

No config changes required. neverLockOut defaults to true, so an existing
gatekeeper.conf without the key automatically gets the never-stuck behavior.

Golden rule: always confirm you can still log in from a new SSH session
(sudo authyo-configure --test + a second terminal) before closing your current
one.

Quick reference — Linux SSH prompt

Type the OTP, or:

R — resend (tries your next channel)

B — I have a backup code (or paste XXXX-XXXX-XXXX directly)

If the guard can't run OTP (no contact / Authyo down), you'll be handed to the
normal password prompt automatically (unless neverLockOut is set to false).

Authyo RDP Guard for Linux (SSH) — What's New (v1.1.6)

At a glance#

1. Never-stuck sign-in (anti-lockout)#

What it does not do (your security is intact)#

Strict mode (optional)#

Upgrade notes#

Quick reference — Linux SSH prompt#

At a glance

1. Never-stuck sign-in (anti-lockout)

What it does not do (your security is intact)

Strict mode (optional)

Upgrade notes

Quick reference — Linux SSH prompt