StoneGate SSL VPN. Release Notes for Version 1.4.5

Transcription

1 StoneGate SSL VPN Release Notes for Version Created: March 3, 2011

2 Table of Contents What s New... 3 Enhancements... 3 Fixes... 3 System Requirements... 4 StoneGate Appliances... 4 Build Version... 4 Product Binary Checksums... 4 Compatibility... 4 Browser and Client OS Compatibility... 4 Directory Services... 5 Upgrade Instructions... 5 Upgrade from Previous Version... 5 Upgrade from Version or Prior Versions... 6 Known Issues... 6

3 What s New Enhancements The enhancements introduced in StoneGate SSL VPN version are described in the table below. Feature New MobileID for Nokia N8 OpenDS is now officially supported as a Directory Service Directory Service user database migration support sginfo contains dmesg output from most recent and previous boot and shutdown sequences AES encryption for Access Client supported as Cipher Suites for Windows Vista/7 Description The Nokia N8 smart phone is based on a new version of Symbian and features a full touchscreen interface. The MobileID client application has been ported to this new platform to maximize usability for this new generation smart phone. When configuring an external Directory Service for StoneGate SSL VPN, it is now possible to use an OpenDS system. When moving a directory service from one server to another, it is now possible to copy the content of the user database to the new directory server. To ease troubleshooting and support operations, the sginfo diagnostic file contains dmesg command output from the most recent and previous boot and shutdown operations in the following format: dmesg-bootup-<date>-<time> dmesg-shutdown-<date>-<time> It is now possible to add AES-based cipher suites in the Access Point Global Settings for tunneled resources. Fixes Problems described in the table below have been fixed since StoneGate SSL VPN version A workaround solution is presented for earlier versions where available. Synopsis Access Client in Windows does not support 3DES and AES Strong Encryption (#64914) Error in license expiration calculation (#60808) Route netmask value inserted in Web Console is displayed incorrectly after saving changes (#61286) Appliance may freeze at boot when IP Address Pool is configured (#64175) OpenSSL vulnerability CVE (#64874) Description The Access Client in Windows environments is not able to negotiate 3DES or AES Strong Encryption for tunnel resources. It is not possible to limit the Cipher Suites to 3DES and/or AES for Access Clients in Windows XP. With some expiration dates, the license expiration information is not calculated correctly. A route netmask defined in the Web Console (for example, ) is displayed incorrectly once the changes have been saved. IP Address Pool configuration can cause the appliance to freeze at boot. The appliance responds to ping requests but does not allow console/ssh/web console/administrator interface interaction. CVE is a vulnerability related to the TLS server name extension in OpenSSL. The system implements TLS extensions, but the OpenSSL library has been upgraded to 0.9.8p, which is not vulnerable. Workaround for previous versions Add RC4 128 bit encryption to the supported Cipher Suites in Manage System -> Access Point -> Global Access Point Settings -> Cipher Suites. Install a temporary license with a longer expiration date. Add the route netmask manually using the run-at-boot script. Perform a cold reboot. Previous versions are not vulnerable because TLS extensions were not enabled. 3 StoneGate SSL VPN Release Notes for version 1.4.5

4 System Requirements StoneGate Appliances StoneGate SSL VPN version is supported on all StoneGate SSL VPN appliances and on StoneGate SSL VPN Virtual Appliances. Build Version The StoneGate SSL VPN version build version is Product Binary Checksums sslgw_engine_ _i386.zip MD5SUM c5a2535e10625c5da45dd2af8cf24f9d SHA1SUM 5991db66af8dbd965fd473fe6a878f98f0794c5a sslgw_engine_ _vmwarefw-esx.zip md5sum ad117b65e2acdf956e6f6d ea5 SHA1SUM ffcb4ac64d08d2f75b2d16ec0e1201f Compatibility Browser and Client OS Compatibility StoneGate SSL VPN version administration requires the use of a workstation with a TCP/IP network configured and a Web browser installed. To use the Application Portal, the connecting client must have TCP/IP configured and a Web browser installed. To use Tunnel Resources, such as client/server TCP/UDP-based applications, the connecting client must have TCP/IP configured and a Web browser compatible with Java or ActiveX technologies installed. To use the StoneGate Web authentication method, the client must support Java technology to display the clickable webpad. To use the StoneGate MobileID (Synchronized or Challenge) authentication method, the client must have MobileID software installed and seeded. For the full platform compatibility matrix for the functionalities described above, please see Technical Note StoneGate SSL VPN Release Notes for version 1.4.5

5 Directory Services User information can be stored in an internal user directory, or one of the following external directory services can be used: Microsoft Active Directory 2003 Microsoft Active Directory 2008 Novell edirectory OpenLDAP Sun Java System Directory Server Oracle Internet Directory (authentication only) Tivoli Directory Server (authentication only) IBM RACF LDAP (authentication only) OpenDS 2.x NOTE An external directory service is required for a mirrored pair configuration. For additional information, please refer to the StoneGate SSL VPN Administrator s Guide. Additionally, when using the Access Client on Windows Vista, the following requirements apply: Requirement Access Client on Microsoft Windows Vista requires administrator rights StoneGate ActiveX Client Loader requirements Drive letter mapping in Windows Vista Java Runtime Environment Details The Access Client requires administrator rights to run properly on Windows Vista and Windows 7 the first time it is installed. Automatic upgrades after installation do not require administrator rights. To run the ActiveX Access Client loader successfully with Windows Vista UAC, you must add the Access Point server HTTPS address to the list of trusted sites in Internet Explorer. A single drive letter (for example, F :) cannot be used as a startup command in Windows Vista and Windows 7. All commands must be executed using runas to elevate to administrator mode since the mapping is done in administrator mode, and F: is not a valid executable. Use the following startup command instead: explorer /root, F: This works on both Windows XP and Windows Vista/Windows 7. To run the Stonesoft Java Access Client, use Sun Java 1.6 Update 2 or later. Upgrade Instructions When upgrading mirrored systems, see the upgrade instructions in the SSL VPN Administrator's Guide, which is available from It is recommended to publish the configuration after a successful upgrade. Upgrade from Previous Version StoneGate SSL VPN is upgraded from version to version through the Web Console or using the Remote Upgrade functionality in the StoneGate Management Center. After the upgrade, log in to the StoneGate SSL VPN Administrator interface and publish the updated configuration if the Publish button is highlighted. 5 StoneGate SSL VPN Release Notes for version 1.4.5

6 Upgrade from Version or Prior Versions StoneGate SSL VPN is upgraded from version to version through the Web Console or using the Remote Upgrade functionality in the StoneGate Management Center. After the upgrade, log in to the StoneGate SSL VPN Administrator interface and publish the updated configuration if the Publish button is highlighted. Direct upgrade from other versions to StoneGate SSL VPN version has not been tested. NOTE Starting from version 1.4.0, using StoneGate SSL VPN with the StoneGate Management Center requires a valid SSL VPN 1.4 license to be imported in the StoneGate Management Center. A StoneGate SSL VPN engine version or higher is counted as one unit in the StoneGate Management Center when the SSL VPN engine is managed by the StoneGate Management Center. Virtual StoneGate SSL VPN appliances are not counted as managed units in the StoneGate Management Center. For additional information on StoneGate SSL VPN licensing, please refer to the Stonesoft Price List. Known Issues The current known issues of StoneGate SSL VPN version are described in the table below. For an updated list of known issues, consult our Web site at Synopsis Description Workaround StoneGate SSL VPN Breaks Browser Domain- Based Security Model - Refs:CVE , CERT VU# (#55542) In a mirrored configuration, OATH database must be configured as an external database (#50490) Client Firewall does not work on Windows Vista clients (#40657) StoneGate SSL VPN breaks the browser domainbased security model. The vulnerability lies in the architecture of the SSL VPN solution. As a result of the vulnerability, all resources under a single SSL VPN domain may potentially steal or modify each other's active web content, such as web cookies. In a mirrored configuration with OATH activated, adding a secondary Authentication Service causes the following error message: "To validate if OATH is used on the configured Authentication Service-node (i.e. tokens are imported), it has to be started. A system with more than one Authentication Service-node cannot use a local database; it would result in data inconsistency." When a Client Firewall is configured for a resource, the Access Client stops working on Windows Vista. Recommended Actions: Deploy only trusted resources to the SSL VPN portal. Resources with significantly different security zones, such as resources hosted by different companies, should be deployed using Pooled DNS Mapping or Reserved DNS Mapping. Untrusted resources should not be deployed to the SSL VPN portal at all. If these types of resources are needed, they should be deployed as External Sites so that the SSL VPN portal gives a direct link to the resource, instead of making the client route the traffic to the resource through the SSL VPN portal. Please consult the StoneGate SSL VPN Administrator's Guide for further information about deploying Pooled DNS Mapping, Reserved DNS Mapping, or defining External Sites. Configure OATH in the SSL VPN Administrator (through Manage System - OATH Configuration - Database Connection) to point to an external URL (for example: jdbc:hsqldb:hsql:// :9001/:shutdown=true) Alternatively, you can disable OATH in the Web Console. Add the following three "Outgoing" rules for the Client Firewall: W.X.Y.Z-W.X.Y.Z 443 TCP Any Accept TCP Any Accept UDP Any Accept where W.X.Y.Z is the IP address of your access point. If using multiple access points, add a corresponding rule for each. 6 StoneGate SSL VPN Release Notes for version 1.4.5

7 Configuring Directory Service as Microsoft Active Directory and setting RootDN with a container class object is not accepted (#50034) Use of IP pool address with Active FTP does not work on a Vista system (#50028) Web Console used through Application Portal: switching to mirror mode does not generate mirror.conf file for replication (#47252) Support for special characters is not complete Standard Resource configuration for Outlook Web Access 2010 does not work correctly (#53679) Windows 7 32 and 64 bit with SP1 freeze when client application accesses dynamic tunnel set (#67923) This is a Microsoft Active Directory specific problem. An Organizational Unit is not an allowed child object of the class "containers" within the Active Directory default schema. "ou=accounts,..." is an Organizational Unit. Hence "ou=accounts" cannot be added to "cn=users,..." since "cn=users,..." is a container (objectclass=container,objectcategory="cn=contai ner,cn=schema,cn=configuration,..." RootDN should start with an Organizational Unit (OU="...",...). Using an SSL VPN resource for active FTP with an IP address pool from a Windows Vista machine fails when the server starts the transfer. The problem is caused by the IP address used in the PORT command, which is not the same as the IP address assigned from the IP address pool. When the Web Console is accessed through the Application Portal, switching to mirror mode does not generate the mirror.conf file needed for replication. There have been some minor issues when using special characters in paths. Standard Resources configured using the wizard for MS Outlook Web Access 2007 do not work correctly with MS Outlook Web Access 2010 because some required cookies are missing from the default configuration. If the user has Service Pack 1 installed, Windows 7 32 and 64 bit freeze when a client application tries to access a dynamic tunnel set. In the SSL VPN Administration interface, configure RootDN to set the Organizational Unit as not part of a container. For example, OU=Accounts,DC=DOMAIN,DC=COM or OU=Accounts,OU=SSLVPN,DC=DOMAIN,DC=COM Use passive FTP or an FTP program that allows setting the client IP address to be used for the PORT command. Switch to mirror mode through a direct connection to the Web Console and not through the Application Portal. Contact Stonesoft Support if problems occur. In the Web Resource Advanced Settings, insert the following list of Cookies to check: UserContext,sessionid,cadata,PBack,OutlookSessio n,logondata,cookietest,owacsdc,asp.net_sessioni d,msexchecpcanary,ecpcookietest,tzid,ecpupdate dusersettings,mstrpgld1,mstrpgld2 Configure static tunnel sets, and enable the usage of the Pure Java Access Client in tunnel set advanced settings tab. 7 StoneGate SSL VPN Release Notes for version 1.4.5

8 Copyright and Disclaimer Stonesoft Corporation. All rights reserved. These materials, Stonesoft products, and related documentation are protected by copyright and other laws, international treaties and conventions. All rights, title and interest in the materials, Stonesoft products and related documentation shall remain with Stonesoft and its licensors. All registered or unregistered trademarks in these materials are the sole property of their respective owners. No part of this document or related Stonesoft products may be reproduced in any form, or by any means without written authorization of Stonesoft Corporation. Stonesoft provides these materials for informational purposes only. They are subject to change without notice and do not represent a commitment on the part of Stonesoft. Stonesoft assumes no liability for any errors or inaccuracies that may appear in these materials or for incompatibility between different hardware components, required BIOS settings, NIC drivers, or any NIC configuration issues. Use these materials at your own risk. Stonesoft does not warrant or endorse any third party products described herein. THESE MATERIALS ARE PROVIDED "AS-IS." STONESOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO, THE INFORMATION CONTAINED HEREIN. IN ADDITION, STONESOFT MAKES NO EXPRESS OR IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR USE WITH RESPECT THE INFORMATION CONTAINED IN THESE MATERIALS. IN NO EVENT SHALL STONESOFT BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL OR INCIDENTAL DAMAGES, INCLUDING, BUT NOT LIMITED TO, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING FROM THE USE OF THESE MATERIALS, EVEN IF ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH DAMAGES. Trademarks and Patents Stonesoft, the Stonesoft logo and StoneGate are all trademarks or registered trademarks of Stonesoft Corporation. Multi-Link technology, Multi-Link VPN, and the StoneGate clustering technology-as well as other technologies included in StoneGateare protected by patents or pending patent applications in the U.S. and other countries. All other trademarks or registered trademarks are property of their respective owners. Stonesoft Corporation Itälahdenkatu 22A FI Helsinki Finland Tel Fax Stonesoft Inc Crown Pointe Parkway Suite 900 Atlanta, GA USA Tel Fax Copyright 2011 Stonesoft Corporation. All rights reserved. All specifications are subject to change.