StoneGate SSL VPN. Release Notes for Version 1.4.1

Transcription

1 StoneGate SSL VPN Release Notes for Version Created: April 6, 2010

2 Table of Contents What s New... 3 Enhancements... 3 Fixes... 3 System Requirements... 4 StoneGate Appliances... 4 Build Version... 4 Product Binary Checksums... 4 Compatibility... 5 Browser and Client OS Compatibility... 5 Directory Services... 5 Upgrade Instructions... 6 Upgrade from previous version... 6 Upgrade from version or prior versions... 6 Known Issues... 7

3 What s New Enhancements The enhancements introduced in StoneGate SSL VPN version are described in the table below. The following table lists the features briefly. Please consult the product documentation for more details. Feature SSL VPN Virtual Appliance now integrates vmxnet3 network driver. (#54862) TCP Port Forwarding informative message about rules to be added to SSL VPN internal firewall (#54746) File name change for sg-backup (#54678) License information included in sginfo to ease Support operation (#55577) Description Vmxnet3 high performance network interface card driver is now integrated in the SSL VPN Virtual Appliance, in addition to the existing support for e1000 and vxnet2 drivers. When you addsor edit a Port Forwarding listener to the Access Point, the following message is displayed: Port Forwarding enabled, change your firewall rules. Read TCP Port Forwarding Technical Note. The sg-backup command now produces a more meaningful filename to identify the version. The new filename structure is sgsslvpn_version_hostname_timestamp.tar.gz License information is now included in the sginfo file to make identification easier in Support operations. Fixes Problems described in the table below have been fixed since StoneGate SSL VPN version A workaround solution is presented for earlier versions where available. Synopsis sg-admin -upgrade fails during backup restoration. (#54693) After successful upgrade of mirrored configuration, odd log messages from Admin Service appear. (#55451) Abolishment does not work unless end-user has administrative rights. (#55902) Cosmetic error when removing a previously defined resource from the Application Portal. (#56050) Self Service is missing from Manage Accounts and Storage menu (#56536) Authentication Service crashes due to problems with connections to external servers (#56754) Description During backup restoration, the slapd daemon is restarted only after the sg-admin -upgrade command, casuing sgadmin-upgrade with internal ldap service to fail. After a successful upgrade of a mirrored configuration, irrelevant log messages may be received from the Administration Service of the slave node. The end-user must have administrative rights in the client operating system to use Abolishment. When the Make Resource Available in Application Portal option is disabled for a previously defined resource, the following error appears: The file "web_ressources_white_grey.png" could not be created. Please make sure that the Web server user has sufficient permissions for the directory "files/accesspoint/custom-files/wwwroot/wa/img/icons". The Web resource host <resource_name> was updated and the Application Portal item <Resource Description in App Portal> was deleted. +++ Due to a missing option in the license, the Self Service option is no longer visible in the Manage User Accounts and Storage menu in the SSL VPN Administrator interface. Problems in connectivity to external LDAP servers cause the Authentication Service to crash with the following log information: (nativeopen: socket: Too many open files) Workaround for previous versions After the backup restoration has finished, access the console as root and issue the following command: sg-admin upgrade None. The messages are harmless. The user must add the SSL VPN site to the Trusted Sites in Internet Explorer. None. The message is harmless and the resource definition is saved correctly. None None 3 StoneGate SSL VPN Release Notes for version 1.4.1

4 System Requirements StoneGate Appliances StoneGate SSL VPN version is supported on all StoneGate SSL appliances and on StoneGate SSL VPN Virtual Appliances. Build Version The StoneGate SSL VPN version build version is Product Binary Checksums sslgw_engine_ _i386.zip MD5SUM 9fc d51bc88aa04c9f311a SHA1SUM e dd7bfae7a48ec339f407c4af1dab2eca sslgw_engine_ _vmwarefw-esx.zip md5sum a5433fcf25afe17f72d05ccd744dff6b SHA1SUM 6430e25c3e956dd7f7beaacd84efe6238a840e6e 4 StoneGate SSL VPN Release Notes for version 1.4.1

5 Compatibility Browser and Client OS Compatibility StoneGate SSL VPN version administration requires the use of a workstation with a TCP/IP network configured and a Web browser installed. To use the Application Portal, the connecting client must have TCP/IP configured and a Web browser installed. To use Tunnel Resources, such as client/server TCP/UDP-based applications, the connecting client must have TCP/IP configured and a Web browser compatible with Java or ActiveX technologies installed. To use the StoneGate Web authentication method, the client must support Java technology to display the clickable webpad. To use the StoneGate MobileID (Synchronized or Challenge) authentication method, the client must have MobileID software installed and seeded. For the full platform compatibility matrix for the functionalities described above, please see Technical Note 5566 Directory Services User information can be stored in an internal user directory, or one of the following external directory services can be used: Microsoft Active Directory 2003 Novell edirectory OpenLDAP Sun Java System Directory Server Oracle Internet Directory (authentication only) Tivoli Directory Server (authentication only) IBM RACF LDAP (authentication only) NOTE - External directory service is required for mirrored pair configuration. For additional information please refer to the StoneGate SSL VPN Administrator s Guide. Additionally, when using the Access Client on Windows Vista, the following requirements apply: Requirement Access Client on Microsoft Windows Vista requires administrator rights. StoneGate ActiveX Client Loader requirements Drive letter mapping in Windows Vista Details The Access Client requires administrator rights to run properly on Windows Vista and Windows 7. To run the ActiveX Access Client loader successfully with Windows Vista UAC, you must add the Access Point server HTTPS address to the list of trusted sites in Internet Explorer. A single drive letter (for example, F :) cannot be used as a startup command in Windows Vista and Windows 7. All commands must be executed using runas to elevate to administrator mode since the mapping is done in administrator mode, and F: is not a valid executable. Use the following startup command instead: explorer /root, F: This works on both Windows XP and Windows Vista/Windows 7. 5 StoneGate SSL VPN Release Notes for version 1.4.1

6 Requirement Remove AES cipher suites from Access Point configuration. Java Runtime Environment Details The AES ciphers in Vista/Windows 7 are not compatible with the SSL engine used in the Access Point. You must remove the AES ciphers from the Cipher Suites for your Access Point under Manage Global Access Point Settings. Remove the following ciphers: RSA_AES_128_CBC_SHA and RSA_AES_256_CBC_SHA. To run the Stonesoft Java Access Client, use Sun Java 1.6 Update 2 or later. Upgrade Instructions When upgrading mirrored systems, see the upgrade instructions in the SSL VPN Administrator's Guide, which is available from It is recommended to publish the configuration after a successful upgrade. Upgrade from previous version Upgrading the StoneGate SSL VPN from to is normally done through the Web Console or StoneGate Management Center Remote Upgrade functionality. After upgrade, log on to the StoneGate SSL VPN Administrator interface and publish the updated configuration if the Publish button is highlighted. Upgrade from version or prior versions If upgrading the StoneGate SSL VPN from version or prior versions to version 1.4.1, you must first upgrade to version 1.4.0, then to move to version as a later step. To upgrade to StoneGate SSL VPN version to 1.4.0, please refer to the appropriate Release Notes. NOTE Starting from version 1.4.0, using StoneGate SSL VPN with StoneGate Management Center requires a valid SSL VPN 1.4 license to be imported in StoneGate Management Center. StoneGate SSL VPN and higher physical appliance nodes consume 1 node count on the SMC when managed by StoneGate Management Center. StoneGate SSL VPN Virtual Appliances do not consume any node count. For additional information about StoneGate SSL VPN Licensing, please refer to the Stonesoft Price List. 6 StoneGate SSL VPN Release Notes for version 1.4.1

7 Known Issues The current known issues of StoneGate SSL VPN v1.4.1 are described in the table below. For an updated list of known issues, consult our Web site at Synopsis Description Workaround StoneGate SSL VPN Breaks Browser Domain- Based Security Model - Refs:CVE , CERT VU# (#55542) In mirrored configuration, OATH database must be configured as an external db. (#50490) WINS Forwarding in Tunnel Set does not work. (#33675) Client Firewall does not work on Windows Vista clients (#40657) Configuring Directory Service as MS AD setting RootDN with a container class object is not accepted.(#50034) Use of IP pool address with Active FTP does not work on a Vista system. (#50028) StoneGate SSL VPN breaks the browser domainbased security model. The vulnerability lies in the architecture of the SSL VPN solution. As a result of the vulnerability, all resources under a single SSL VPN domain may potentially steal or modify each other's active web content, such as web cookies. In a mirrored configuration with OATH activated, adding secondary Authentication Service causes the following error message: "To validate if OATH is used on the configured Authentication Service-node (i.e. tokens are imported), it has to be started. A system with more than one Authentication Service-node cannot use a local database; it would result in data inconsistency." Even if configuration of WINS forwarding is allowed in the Administration Service, the settings are not applied. When a Client Firewall is configured for a resource, the Access Client stops working on Windows Vista. This is a Microsoft Active Directory-specific problem. Organizational Unit is not an allowed child object of the class "containers" within the Active Directory default schema. "ou=accounts,..." is an Organizational Unit. Hence "ou=accounts" can't be added to "cn=users,..." since "cn=users,..." is a container (objectclass=container,objectcategory="cn=cont ainer,cn=schema,cn=configuration,..." RootDN should start with an Organizational Unit ( OU="...",... ). Using an SSL VPN resource for active FTP with an IP Address Pool from a Windows Vista machine fails when the server starts the transfer. The problem is caused by the IP address used in the PORT command, which is not the same IP address assigned from the IP pool. Recommended Actions: Deploy only trusted resources to the SSL VPN portal. Resources with significantly different security zones, such as resources hosted by different companies, should be deployed using Pooled DNS Mapping or Reserved DNS Mapping. Untrusted resources should not be deployed to the SSL VPN portal at all. If these types of resources are needed, they should be deployed as External Sites so that the SSL VPN portal gives a direct link to the resource, instead of making the client route the traffic to the resource through the SSL VPN portal. Please consult the StoneGate SSL VPN Administrator's Guide for further information about deploying Pooled DNS Mapping, Reserved DNS Mapping, or defining External Sites. Configure OATH in SSL VPN Administrator (Manage System - OATH Configuration - Database Connection) to point to an external URL (for example: jdbc:hsqldb:hsql:// :9001/:shutdown=tru e ) Alternatively, you can disable OATH in the Web Console. None. Add the following three "Outgoing" rules for the Client Firewall: W.X.Y.Z-W.X.Y.Z 443 TCP Any Accept TCP Any Accept UDP Any Accept Where W.X.Y.Z is the IP address of your access point. If using multiple APs, add a corresponding rule for each. In the SSL VPN Administration interface, configure RootDN to set Organizational Unit as not part of a container. For example, OU=Accounts,DC=DOMAIN,DC=COM or OU=Accounts,OU=SSLVPN,DC=DOMAIN,DC=C OM Use passive FTP or an FTP program that allows setting the client IP address to be used for the PORT command. 7 StoneGate SSL VPN Release Notes for version 1.4.1

8 Web Console used through Application Portal: switching to mirror mode does not generate mirror.conf file for replication. (#47252) Support for special characters is not complete Hardware Assessment Plugin fails to detect MAC addresses because of case sensitivity (#57085) SSH Traffic Snooping does not work properly (#56296) If backup has FQDN in filename restoration from Web Console does not work. (#57921) When the Web Console is accessed through the Application Portal, switching to mirror mode does not generate the mirror.conf file needed for replication. There have been some minor issues when using special characters in paths. The Hardware Assessment plugin version 2.1 in SSL VPN version adds the ability to detect MAC addresses, in addition to the existing detection capabilities for MotherBoard, RAM, and HDD Serial Numbers. If the MAC address of the Network Interface Card to assess is specified in upper case, Assessment fails. Although a checkbox to enable SSH traffic snooping is available in the Tunnel Resource SSO configuration, it does not have any effect on logging. If the backup file contains a Fully Qualified Domina Name (FQDN), for example sslvpn.example.com, instead of a simple hostname, for example sslvpn, backup restoration does not work in the Web Console. Perform the "Switching to mirror mode" operation from a direct connection to the Web Console and not through the Application Portal. Contact Stonesoft Support if problems occur. Specify the MAC Address of one or more of the NICs present in the system in lower case, no matter what separator is used (";", ":", "-", " ", or nothing) None Rename the backup file in spool/backups/<filename> to match the correct syntax. For example: sgsslvpn_version_hostname_timestamp.tar.gz or sg-backup.hostname.timestamp.tar.gz 8 StoneGate SSL VPN Release Notes for version 1.4.1

9 Copyright and Disclaimer Stonesoft Corporation. All rights reserved. These materials, Stonesoft products, and related documentation are protected by copyright and other laws, international treaties and conventions. All rights, title and interest in the materials, Stonesoft products and related documentation shall remain with Stonesoft and its licensors. All registered or unregistered trademarks in these materials are the sole property of their respective owners. No part of this document or related Stonesoft products may be reproduced in any form, or by any means without written authorization of Stonesoft Corporation. Stonesoft provides these materials for informational purposes only. They are subject to change without notice and do not represent a commitment on the part of Stonesoft. Stonesoft assumes no liability for any errors or inaccuracies that may appear in these materials or for incompatibility between different hardware components, required BIOS settings, NIC drivers, or any NIC configuration issues. Use these materials at your own risk. Stonesoft does not warrant or endorse any third party products described herein. THESE MATERIALS ARE PROVIDED "AS-IS." STONESOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO, THE INFORMATION CONTAINED HEREIN. IN ADDITION, STONESOFT MAKES NO EXPRESS OR IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR USE WITH RESPECT THE INFORMATION CONTAINED IN THESE MATERIALS. IN NO EVENT SHALL STONESOFT BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL OR INCIDENTAL DAMAGES, INCLUDING, BUT NOT LIMITED TO, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING FROM THE USE OF THESE MATERIALS, EVEN IF ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH DAMAGES. Trademarks and Patents Stonesoft, the Stonesoft logo and StoneGate are all trademarks or registered trademarks of Stonesoft Corporation. Multi-Link technology, Multi-Link VPN, and the StoneGate clustering technology-as well as other technologies included in StoneGateare protected by patents or pending patent applications in the U.S. and other countries. All other trademarks or registered trademarks are property of their respective owners. Stonesoft Corporation Itälahdenkatu 22A FI Helsinki Finland Tel Fax Stonesoft Inc Crown Pointe Parkway Suite 900 Atlanta, GA USA Tel Fax Copyright 2010 Stonesoft Corporation. All rights reserved. All specifications are subject to change.