R&S Browser in the Box Release Notes

Transcription

1 R&S Browser in the Box Rohde & Schwarz GmbH & Co. KG Muehldorfstr. 15, Munich, Germany Phone: Fax: Internet: Subject to change R&S is a registered trademark of Rohde & Schwarz GmbH & Co. KG. Trade names are trademarks of the owners. The firmware of the instrument makes use of several valuable open source software packages. For information, see the "Open Source Acknowledgment" on the user documentation (included in delivery). The following abbreviations are used throughout this document: R&S Browser in the Box is abbreviated as R&S BitBox. BitBox 4.6 Rohde & Schwarz Cybersecurity PAD-T-M: /02.00/CI/1/EN

2 Contents Contents 1 Introduction Related Documentation Current Version and Improvements Browser in the Box Previous Version and Improvements Browser in the Box Browser in the Box Browser in the Box Browser in the Box Browser in the Box Browser in the Box Related Documentation and Overview BitBox Configuration BitBox.ini / custom.ini: Installer / Uninstaller Hints for Administrators Related Components BitBox Updates Internet Explorer Browser Switcher Mozilla Firefox and Google Chrome Browser Switcher Browser VM Preloading Feature Browser VM Delta Image Update Feature Windows 7 Machines Hints for End-Users R&S Cybersecurity 2

3 1 Introduction This document includes information on the current version and history of Browser in the Box including new features, modified features, and known issues. 1.1 Related Documentation The following documents are related to the Browser in the Box release notes: R&S Cybersecurity TrustedObjects Manager R&S Cybersecurity TrustedVPN R&S Cybersecurity BitBox Disk Image R&S Cybersecurity 3

4 2 Current Version and Improvements 2.1 Browser in the Box New Features Changed look and feel to Rohde & Schwarz Cybersecurity The look and feel of the whole Browser in the Box software have been adapted to fit the Rohde & Schwarz Cybersecurity design requirements. Preloading of browser VM and faster BitBox start By activation of this feature the browser VM will be preloaded in background when the windows user logs in to a user session in Microsoft Windows. This will make a subsequent start of the BitBox faster. Please read the feature description and tutorial in chapter 6. Enterprise Edition only. Support for new DISK-file format A new browser VM image format (DISK-file format) has been introduced. It enables the use of delta images (see next feature) and will replace the old legacy ZIP file format in the future. Support for delta updates of DISK-file format browser VM images With the delta updates of DISK-file format browser VM images in the future new browser VM images can be deployed with a reduced image size as not the complete browser VM will have to be transferred to the client PC, but only a small patch, which will be provided. Please read the feature description and tutorial in chapter 6. Enterprise Edition only. Google Chrome and Mozilla Firefox browser switcher The Google Chrome and Mozilla Firefox Browser Switchers are extensions installed to the local browser, which enables to open an Internet URL link on an Intranet webpage in Browser in the Box. This feature will be installed by separate installers. Enterprise and SMB Edition only. Configuration of cursor size The cursor size of the Windows-style cursor in a browser VM can be configured by specifying the cursor_size configuration parameter in BitBox.ini (check configuration options). Default is 24. Possible values are 24, 32, 48 and 64. Requires Chrome image or Firefox image For multiple file uploads the list of uploaded files can be left out When uploading multiple files and ask user is configured for file uploads the list of filenames, that should be uploaded can be left out by configuring the multiple_upload_message_no_filenames configuration parameter. Updated Oracle VirtualBox to The Oracle VirtualBox version BitBox is shipping has been updated to version This is only a bugfix release of VirtualBox and does not fix any security issues in VirutalBox or BitBox. Use file extension bitbox instead of encrypted for persistenent data of user Encrypted persistent data of the user in the user's roaming folder now has extension ".bitbox" instead of ".encrypted". Existing persistent data in the user's roaming folder will get renamed on the first start/stop of BitBox. R&S Cybersecurity 4

5 Improvements Downloading files to a download folder on file share throws an error When the user sets its download folder for BitBox downloads to a file share an error has been shown. This bug has been fixed. Furthermore the admin must set the option download_noexec to false in BitBox.ini to provide a working download. Deletion of TOM distributed browser certificates Fixed a bug where browser certificates were not removed from the client when removed on the TOM. If BitBox uninstaller could not remove files in use a reboot is triggered The uninstaller now asks for a reboot in case if some files in the BitBox install directory or in the BitBox program data directory could not be deleted during uninstall. Fixed behavior for non-silent Update installation In case if installer started in a non-silent mode has found an old version and the user confirmed that the old version should be uninstalled, the uninstaller of the old version will now be started in a non-silent mode as well and the reboot will be requested if necessary. Fixed file left overs in BitBox updates On a first start after update from an old version, BitBox now should be able to start even if some files were left over in the BitBox program data directory after uninstalling the old version. Fixed upload operation for universal AD Fixed a bug where the upload could fail if the AD user is a member of a universal AD group which contains objects from different domains. BitBox sometimes crashed on startup if font path has not been specified Fixed BitBox crash during snapshot creation in case if "fontsharingpath" is not specified in BitBox.ini. Cleanup of authenticated users The cleanup of authenticated users did not work properly and has been fixed. Changed Defaults A new default audio controller for browser VM The default audio controller for the browser VM has been switched to Intel HDA instead of AC97 to fix several issues with audio volume level. Internet Explorer BHO will not be installed as default The Internet Explorer BHO will not be installed automatically by default. Only if the admin passes the correct installation option it will be installed as well. Admins should use the standalone installer to install the Internet Explorer BHO from now on (same applies to the Google Chrome and Mozilla Firefox extension for local browsers). R&S Cybersecurity 5

6 Known Limitations Resizing will have a small delay when setting cursor_size parameter When setting the cursor_size configuration parameter to other value than the default a resizing operation in BitBox will take 2-3sec. This is a regression of VirtualBox and will be fixed in future releases of VirtualBox. Idle disconnect feature with activated preloading In case if idle network disconnect feature is enabled and BitBox is started from the preloaded state, the start page might fail to load initially and the user has to refresh the page manually. Uploading lots of files with upload confirmation dialog may take a while If the upload confirmation is enabled for a user, and a user uploads multiple files, it can take a few seconds until the user sees the confirmation dialog. The more files the user uploads at once, the longer this delay is. AC97 audio controller in Browser VM has volume level issues Setting the volume level to 100% while using the AC97 audio controller in Browser VM the sound won t have 100% level on Windows. This is a regression of VirtualBox and will be fixed in future releases of VirtualBox. AC97 audio controller will not be used by default in BitBox anymore so that users are only affected if the admin sets the AC97 audio controller explicitly. Downgrading of BitBox When downgrading from BitBox the admin will have to remove the list of authenticated users while uninstalling BitBox as the new format of list cannot be read by older BitBox versions. Furthermore when downgrading from BitBox the user will lose his persistent data and bookmarks as the file extension changed in BitBox The user could manually rename the file to make the persistent data and bookmarks work again. R&S Cybersecurity 6

7 3 Previous Version and Improvements 3.1 Browser in the Box Improvements Restriction of file:// protocol in Chrome VMs is configurable Via BitBox.ini or Custom.ini the restriction of the file:// protocol is now configurable, but still activated by default. See the configuration parameter list for more information. Proxy Basic Authentication for Java can be activated again Due to one of the latest Java 8 updates Oracle blocks Basic Authentication for authentication to a proxy. By enabling this option the Basic Authentication schema can be used again in Java. See the configuration parameter list for more information. Support for non-ascii characters in internal URLs Fixed a crash of BitBox in case if dispatch.pac is used and an internal URL with non-ascii chars is provided. Support for IRI URLs BitBox is now able to handle arbitrary URLs compliant to IRI (Internationalized Resource Identifier) Upload of too many files makes BitBox hang Fixed a bug where BitBox would hang in case if too many files are uploaded and "askuser" constraint is set for uploads. Internet Explorer maximized window gets resizing on opening internal URL In case the Internet Explorer window was maximized already then the call from BitBox to the Internet Explorer will open the new tab also in a maximized window instead of deleting the maximized state on each call. 3.2 Browser in the Box Improvements VirtualBox Updated Oracle VirtualBox to new bug fix release This is a security fix update for VirtualBox, which does not affect Browser in the Box, but VirtualBox in general. VPN Redundancy broken if first gateway is offline When first gateway in the gateway list received from TOM is offline no other gateway was asked for a connection so that redundancy did not work. This issue has been resolved. VPN Redundancy switch was broken for some gateways When the gateway connection broke up in some cases the switch to another VPN gateway did not work. This issue has been resolved. VPN SA timeout has been increased The timeout limit for creating SAs to VPN gateway has been increased so that it does not timeout if a connection has been established already. Fallback language incorrect after language switch The fallback language for not translated strings in Browser in the Box client sometimes was set not to English but to the last language used. This issue has been fixed. Quitting of TrayApp blocking in some cases In some situations the TrayApp blocks while quitting. This issue has been fixed. Crash of Browser in the Box while opening URL with spaces When opening an invalid URL containing whitespaces the Browser in the Box startup application crashed. This bug has been fixed. R&S Cybersecurity 7

8 3.3 Browser in the Box Improvements Open of URL in IE via Browser Dispatcher In case a new local URL has been opened in Internet Explorer via the Browser in the Box browser dispatcher at the same time when the Internet Explorer was closing an error occurred. This issue was fixed. Unable to start BitBox with wrong OpenSSL configuration If a local OpenSSL installation including configuration environment variables exists on the system where BitBox will be installed it might be possible that BitBox ended up in a state that it is unable to start. This limitation has been fixed. Standalone version only. 3.4 Browser in the Box Improvements Installation of Internet Explorer Browser Switcher configurable The installer has been extended to support the configuration parameter installbrowserhelperobject, which can be used to disable the installation of the Internet Explorer Browser Switcher (Browser Helper Object). By default the BHO will still be installed. Please check the configuration table for more information on how to use this option. 3.5 Browser in the Box Improvements VirtualBox Windows 10 Signature fixed The shipped VirtualBox version has been signed to work with latest Windows 10 UEFI builds that require drivers signed by Microsoft signing certificate. TrayApp crashes on certain machines On certain machines a crash of the TrayApp occurred when a new link was opened by the user. This bug has been fixed. System Report did not add VirtualBox service logs The VirtualBox service logs have not been added to the system report. This limitation has been resolved. BitBox is unable to close when pressing X button after standby When a user put his machine to standby mode and reactivated it again he was unable to close BitBox by pressing the X button in the VirtualBox window. This issue has been fixed. BitBox Browser Dispatcher did not raise minimized Internet Explorer window Fixed raising of the IE window when opening links via BiBox dispatcher in local browser. Under certain conditions it could fail, resulting in a link being open in a new IE Window rather than in a tab. Also fixed the case when IE window was maximized before opening a link (previously it would become un-maximized in such a case). Network not available in direct mode On faster machines a race condition may break the internal network between Browser VM and VPN client so that no networking is available in the Browser VM. This issue only occurred on direct mode and has been fixed. R&S Cybersecurity 8

9 3.6 Browser in the Box New Features Small Medium Business Edition Next to the Standalone and Enterprise Edition of Browser in the Box we also add a Small Medium Business Edition, which includes a standalone Browser in the Box installation with advanced toolchain. Please see the extra section about the SMB Edition for more information. LDAP User Authentication In case the user is already using an Active Directory authenticated user session the Browser in the Box client can be configured to use this authentication for the user authentication to the TrustedObjects Manager so that no user interaction is needed. Enterprise Edition only. Requires TOM or newer. Internet Explorer Browser Switcher The Internet Explorer Browser Switcher is an extension installed to the Internet Explorer, which enables to open an Internet URL link on an Intranet webpage in Browser in the Box. Enterprise and SMB Edition only. Cleanup of Authenticated Users List The list of authenticated BitBox users, which will be communicated to the TOM will be cleaned up after 90 days by default, so that VPN credentials won t last forever on client machines, TOM and Web Gateways. Enterprise Edition only. Deletion of Authenticated Users List is Optional The uninstaller has been modified so that by default the list of authenticated users will now be removed on an uninstallation of Browser in the Box, so that no new VPN certificate has to be generated for all users on all client machines after a BitBox version upgrade. Enterprise Edition only. Browser Configuration Files TOM-Distribution The browser configuration files for Chrome and Firefox images (e.g. default bookmarks or settings) can be distributed via the TOM. Enterprise Edition only. Requires TOM or newer. Browser Certificate Authorities TOM-Distribution The browser certificate authorities for Firefox images (e.g. company web CAs) can be distributed via the TOM. Enterprise Edition only. Requires TOM or newer. Installing BitBox with different VirtualBox Version Via setting a parameter to the BitBox installer it is possible to override the VirtualBox version check in the installer in order to install an older or viewer version of VirtualBox with BitBox. Avoid Restart of BitBox on Network Change On changing network from one external network to another (and direct internet access was allowed) no restart of the BitBox is required anymore. It is also possible to disable the required restart from external to internal by enabling this option in the BitBox configuration. Enterprise Edition only. R&S Cybersecurity 9

10 Improvements Default Preferred Website Language The default preferred website language in Chrome and Firefox images are now set based on the BitBox client language that was configured instead of using German for all sites fixed. For Chrome web browser only a new image is required not this new client version. Browser Switcher: Open new URL in IE Opening a link via the browser switcher resulted in a new window instead of a new tab for the local browser Internet Explorer. This issue was resolved. Timeout on downloading Disk Image from TOM The timeout for downloading disk images from TOM has been increased to get a better support on slow machines. BitBoxClient.exe without start command The BitBoxClient.exe command line interface tool can now be used to open a URL without the start parameter. This was a bug in Version 4.4.0, which has been fixed. R&S Cybersecurity 10

11 4 Related Documentation and Overview Version Document Updated TrustedObjects Manager Operations & Maintenance Manual Browser in the Box Administration Manual Browser in the Box User Manual R&S Cybersecurity 11

12 5 BitBox Configuration The following new configuration parameters have been introduced in Browser in the Box 4.6 version. 5.1 BitBox.ini / custom.ini: Parameter autostartbitbox=<1 0> Section: [installer] Default: 1 preloading=<true false> Section: [default] Default: false image_update=<true false> Section: [default] Default: false x_delta_buffer_size_limit=<integer> Section: [default] Default: 512 cursor_size=<24,36,48,64> Section: [default] Default: 24 multiple_upload_message_no_filenames=<true false> Section: [default] Default: false Description Enables the preloading feature at installation time. To enable this feature also for BitBox itself please add the specific option in BitBox.ini Enables the preloading feature itself. The preloading feature must be installed at installation time. Enterprise Edition only. Enables the delta update feature for DISK-file format disk images. Enterprise Edition only. Sets the used RAM buffer size for calculating DISKfile format browser VM images based on the delta update feature. Will only be used when delta update feature is enabled. Enterprise Edition only. Sets the cursor size of the Window style cursor in browser VM. Chrome or Firefox browser VM image are required. Do not list all file names when uploading multiple files at once and ask user constraint is enabled. 5.2 Installer / Uninstaller Parameter -autostartbitbox=0 Description Disables the preloading feature at installation time. To enable this feature also for BitBox itself please add the specific option in BitBox.ini R&S Cybersecurity 12

13 6 Hints for Administrators 6.1 Related Components The latest version of related components are as follows: - TOM TrustedVPN Please also check the release notes for the browser images as they will be released separately from the Browser in the Box. 6.2 BitBox Updates Please read the update section in the Administration Manual for an introduction on how to update Browser in the Box. 6.3 Internet Explorer Browser Switcher In order to install and use the Internet Explorer Browser Switcher so that external URLs on intranet pages are opened in BitBox automatically Microsoft.NET 4.5 Framework must be installed. As of Windows 10 this is a Windows Feature to be installed. On Windows 7 and 8/8.1 a separate installer from Microsoft is needed. Internet Explorer 8 or newer is required. Dispatch.pac distribution via TOM or local is required for this feature. The Internet Explorer BHO will be provided as a standalone installer as well. 6.4 Mozilla Firefox and Google Chrome Browser Switcher The Browser Switcher for Mozilla Firefox and Google Chrome will be provided as a standalone installer only. Please install them separately if needed. 6.5 Browser VM Preloading Feature To enable the browser VM preloading feature please make sure that two requirements are met: 1. Do not disable the autostartbitbox setting (enabled by default during installation) 2. Do enable the preloading feature in Custom.ini/BitBox.ini (disabled by default) Please make also sure that a preloading is online possible if at preloading time BitBox is starting in internal mode. If BitBox starts in hotspot mode or external mode (direct R&S Cybersecurity 13

14 mode) the browser VM will not be preloaded and a normal startup will be executed as soon as the user requests the BitBox instance. Furthermore please also note that by activating this feature at logon time of a user the Browser VM will be preloaded and therefore the needed resources (especially RAM) will be reserved for the Browser VM. 6.6 Browser VM Delta Image Update Feature To enable the browser VM delta image update please activate the feature in Custom.ini/BitBox.ini it is disabled by default. As this feature is currently only available via manually distribution no TOM support is provided at this point. To use this feature please make sure that the source disk image is available in manually or installation disk image folder (browser VM images in DISK-file format are only supported). Patches will be places to the patches folder, which is located next to the manually, installation and online disk image folders. As soon as the BitBox service recognizes that a patch is available it will search for the source file. It that is also available it will apply the patch and therefore create the target DISK-file format browser VM image. Multiple patches will be applied in serial. Please note that all intermediate images will be created and not removed automatically. If you notice a very slow patch application please try to reduce the xdelta RAM buffer, which can be configured the Custom.ini/BitBox.ini. Especially on machines with 4GB of RAM and less this may be the case. R&S Cybersecurity will provide patches for all new disk images releases in future (from version n-1 to version n, where n is the latest version). If you have modified disk images feel free to contact our support to use the new DISK-file format and the delta update feature. 6.7 Windows 7 Machines As of January 2016 new signing certificates are only using the SHA2 hash algorithms for signatures. By default those algorithm is not supported by Windows 7 32/64bit. Please make sure that the following update is installed so that the R &S Cybesecurity GmbH signature and driver singing of the VirtualBox installation are supported. Windows 7 32/64bit Update: KB Furthermore make also sure that the following hotfix is installed on your Windows 7 32/64bit machines. Otherwise SHA2 certificates are ignored in the certificate store of trusted publishers, which will pop up three messages on Windows 7 machines when installing VirtualBox. Windows 7 32/64bit Hotfix: KB R&S Cybersecurity 14

15 Please also check the FAQ entry for VirtualBox installation and certificates to get more information on how to handle those certificate changes: R&S Cybersecurity 15

16 7 Hints for End-Users None. R&S Cybersecurity 16