-
stable v0.2.0 -
- Password rules: minimum length (12 by default, Pterodactyl only asks for 8), uppercase, lowercase, digit and symbol each on or off, no username or email address in the password, and optionally a check against passwords known from data leaks (Have I Been Pwned, only 5 characters of the SHA-1 hash are sent; off by default). They apply on the account page, for forgot password and when an admin sets a password under Admin > Users, with a box to ignore them for that one password. Off until you switch them on; existing passwords stay valid.
- Old passwords: Account Guard notes password changes from the moment the rules are on, shows how many accounts still have an older password and asks them for a new one with one click.
- Session rules: sign in again after a number of days, and sign root admins out after a number of idle minutes.
- Application API keys: limit the admin keys from Admin > Application API to IP addresses or CIDR ranges (Pterodactyl only offers that for account keys), with a warning for keys without a restriction or unused for 90 days.
- Security status at the top of the admin page: root admins without 2FA, open and unused API keys, old passwords.
-
stable v0.1.0 -
- First release: suspend user accounts (signed out everywhere, API keys revoked, SSH keys put aside, optionally the servers suspended; unsuspend gives everything back), sign in as a user for root admins with a return bar and a log, require a new password from single users or groups, and require two-factor authentication for root admins, staff or all users with a grace period.
- Update notice: when a newer version is out, Admin > Extensions and the licence box on the admin page show it, with what is new. With the optional update helper (set up once as root), the update runs with one click after a backup of the panel files and the database.