SafeWord PremierAccess Customer Release Notes

Transcription

1 SafeWord PremierAccess Customer Release Notes Product Version: R1sb52 Release Notes Issue Date: August 15, 2011 Last Updated: August 15, Product Description SafeWord PremierAccess by SafeNet is a two-factor authentication solution for Solaris. SafeWord makes it easy to deploy two-factor authentication to protect your most important assets and applications. It includes easy to use tokens (including hardware and software). 2. Version Summary 2.1. Release Description SafeWord PremierAccess is the next maintenance release for SafeWord PremierAccess 3.2.1, adding enhanced MobilePASS software token support. This release supports a full MobilePASS token policy, allowing a SafeWord administrator to define software token options per-user, like: choice of Event-Synchronous, Time-Synchronous, or Challenge-Response operation modes Software PIN required (yes/no) Device PIN length Attack Lockout settings A new automatic enrollment process minimizes user interaction needed during selfenrollment, while maximizing security through the use of DSKPP-based protocol. Currently, MobilePASS software tokens are supported on all common device platforms. MobilePASS BlackBerry currently supports the new features described in this CRN. Support will be extended to the full range of SafeNet-supported mobile devices, Page 1 of 7

2 including iphone, Android, Windows, J2ME, Windows Phone, Mac etc, in upcoming releases. This release is backwards compatible, and will support activation and use of the existing software token generation with manual activation. See the full list, and download the current software tokens at: The previous maintenance release of SafeWord came with two free MobilePASS software tokens to allow you to immediately test drive the new functionality. See section 4.3 details New Features and Enhancements SPA Scope SafeWord MobilePASS software tokens now support a full range of policy options: o Time/Event Sync, Challenge-Response o Software PIN required (Yes/No) o Device PIN length o PIN lockout policy SafeWord MobilePASS software tokens now support automatic self-enrollment via an industry-standard key provisioning protocol (DSKPP-based). See the SafeWord PremierAccess Administration Guide for MobilePASS Portal installation instructions. Added the ability to re-enroll existing MobilePASS authenticators, or the ability to support enrolling a user with multiple MobilePASS tokens. Added the ability to specify a name for a MobilePASS token, in order to distinguish it from other MobilePASS tokens the user may have assigned. Implemented various fixes and enhancements (see details in section 5). Added stability and security enhancements. This version is released for general availability. Please see Advisory Notes and Known Issues and Workarounds for any limitations and restrictions. Page 2 of 7

3 3. Released Components 3.1. Third Party Component Versions Component Version Java Runtime Environment 1.6.0_24 Apache MySQL OpenSSL 0.9.8q Expat 1.1 Tomcat JExcelAPI IAIK Regex BeanShell Page 3 of 7

4 4. Advisory Notes 4.1. How To Install This Patch To install this patch on your system, follow these procedures: 1. Ensure that all previously released SafeWord PremierAccess patches are installed. Patch is not cumulative. 2. Untar into a temporary directory the downloaded file called Patch32106.tar. You must use the tar utility from Gnu (gtar) to untar the distribution, since the Solaris tar utility will fail with a checksum error. The gtar utility is likely already installed on your Solaris 9 or Solaris 10 machine in the /usr/sfw/bin directory. If it is not, browse to for a copy (look for tar). 3. From the temporary directory, run the patch script:./applypatch.sh <absolute path to install> (<absolute path to install> is where PremierAccess is installed, for example /opt/securecomputing/premieraccess) Administration Console for Windows Installation The Administration Console for Windows is available with the patch 6 tarball. Please note that you MUST have the Java Runtime Environment 1.6 (or 1.5) installed and visible in the path in order to run Admin Console. When installing on Windows Vista, Windows 2008, and Windows 7, you must plan to work around user account access restrictions on the program files directory, documents and settings directory and other system directories not belonging to the user. These access restrictions are controlled by a new Windows feature called User Account Control, which can be turned on and off through the Control Panel -> User Accounts -> Turn User Account Control on or off. This setting defaults to on. If installing and running the Admin Console as a domain administrator or a built-in administrator, there are no access restrictions and therefore no workarounds to plan. If installing or running the Admin Console as a local administrator or a non-administrator, the following workarounds must be planned. Page 4 of 7

5 If installing SafeWord as a domain administrator or a built-in administrator, but running the Admin Console as a local administrator or a non-administrator, you must choose to install on a non-restricted directory or turn off user account control after installation. If installing and running the Admin Console as a local administrator or a non-administrator, you must turn off user account control before installation. You must choose to install on a non-restricted directory or leave user account control turned off after installation. If installing in a non-restricted directory, user account control may be turned back on after installation is complete. Instructions for installing the Administration Console for Windows: 1. Remove any previous version of the Admin Console by following the instructions for uninstalling below. 2. Locate the file AdminConsoleForWin.zip and copy to any temporary directory located on the target Windows machine. 3. Unzip the file AdminConsoleForWin.zip in the temporary directory. 4. From the temporary directory, double-click the file InstallAdminConsole.vbs. 5. Accept the license agreement by clicking Yes in the dialog box. 6. Specify the installation directory. To accept the default location, click OK in the dialog box. Or edit the location and then click OK in the dialog box. 7. A dialog box indicating successful installation will be displayed. Click OK to finish. 8. Close the license agreement window. 9. To start the Administration Console, click the start menu shortcut from Start -> Programs -> Secure Computing -> PremierAccess -> AdminConsole. Instructions for uninstalling the Administration Console for Windows: 1. Delete the directory Secure Computing\PremierAccess\AdminConsole, located under the Program Files directory or the Program Files (x86) directory. If Admin Console was installed using a non-default location, delete that directory instead. 2. Delete the directory Secure Computing\PremierAccess\Lib, from the same location as step Delete the start menu shortcut by navigating to Start -> Programs -> Secure Computing -> PremierAccess -> AdminConsole, then right-click on AdminConsole, then select Delete. Page 5 of 7

6 4.3. Instructions for importing demo MobilePASS licenses The maintenance release came with two free MobilePASS software tokens to allow you to immediately test drive MobilePASS software token functionality. These tokens are placed in the file <Admin Console Install-dir>\ SoftwareEvalTokens.dat. To import them: 1. Start the Administration Console; For Windows: Click the Start menu shortcut from Start -> Programs -> Secure Computing -> PremierAccess -> AdminConsole. For Solaris : Start the Administration Console by executing the <SafeWord Install Directory>/Premier Access/AdminConsole/client.sh script. If you are using the file manager, locate and click the client.sh icon. 2. Login to the Administration Console as an administrator. 3. Select File -> Import -> Software/Hardware authenticators. The Locate Authenticator Import File window appears. 4. Click the Browse button and select the SoftwareEvalTokens.dat file in the Admin Console Install-dir, and then click the Next button. 5. Select the admin group that you wish to use for the MobilePASS tokens, and then click the Next button. 6. Click the Import button. Wait for the import to complete. A success message informing you that two tokens have been imported will appear. 7. Click No when the message to import more hardware/software tokens appear.e 8. Exit the token import process. 9. The demo licenses are now imported. You can verify the same by finding the authenticators by doing the following: a. From the Administration Console select Find -> Authenticators -> Software/hardware Authenticators. b. In the Search options, select Authenticator, begins with, Eval, and then click the Find button. Two authenticators named EVAL-SOFTWARE-1 and EVAL- SOFTWARE-2 appear in the search results. See the latest version of the SafeWord PremierAccess Administration Guide for more details about the MobilePASS feature. Page 6 of 7

7 5. Resolved Issues and Enhancements 5.1. In this Release Issue# Synopsis Added fix to AAA startup script to ensure correct AAA initialization Support caching of RADIUS clients file to improve authentication performance Support for new etoken GOLD 7.0 import files Addressed issue with MobilePASS activation code parsing , Security enhancements. Upgrade OpenSSL to leverage the latest security enhancements. Known Issues and Workarounds Issue# Synopsis Workaround If the user closes their BlackBerry device before setting the device PIN, enrollment is not completed. User is enrolled on the backend only, and not on the client. New MobilePASS Portal will not run on same machine as the SafeWord Enrollment Server due to Tomcat conflicts. Reenroll the client. Run MobilePASS portal on different machine 7. Publications Document Name Description Location SafeWord PremierAccess Administration Guide.pdf SafeNet MobilePASS Software Administration Guide Updated Admininstration Guide for Solaris The most up-to-date MobilePASS software information Page 7 of 7