Release Notes for Version

Transcription

1 Release Notes for Version Created: September 27, 2012

2 Table of Contents What s New... 3 Enhancements... 3 Fixes... 3 System Requirements... 4 Stonesoft Appliances... 4 Build Version... 4 Product Binary Checksums... 4 Compatibility... 5 Browser and Client OS Compatibility... 5 Directory Services... 5 Upgrade Instructions... 6 Upgrade from Previous Version... 6 Upgrade from Prior Versions... 6 Known Issues... 7

3 What s New Enhancements The enhancements introduced in Stonesoft SSL VPN version are described in the table below. The following table lists the features briefly. Please consult the product documentation for more details. Enhancement It is now possible to modify OpenDJ Directory Service password from Web Console It is now possible to create custom protection rules in SSL VPN from Web Console Simplified OpenDJ configuration to enable/disable mirroring. Ability to configure default gateway address in initial configuration procedure Hashgen utility for hash generation Description In previous versions of the SSL VPN where OpenDJ was available as an internal directory service, the OpenDJ password could only be changed on the command line. Now it is possible to change the password from the OpenDJ section of the Web Console. The SSL VPN gateway is protected by a firewall instance activated by the sg-firewall command that runs automatically at system startup. You can create additional custom firewall rules from the Networking section of the Web Console. Administrator has now a simplified graphical interface to enable and disable OpenDJ Directory Service mirroring in Web Console, under OpenDJ section. The sg-reconfigure initial configuration procedure allows you to set the IP address for the default gateway of the primary Ethernet interface (eth0). This allows better connectivity to continue configuration in routed networks. The hashgen executable is included to simplify the generation of hash values with MD5 and G34911 algorithms for assessment purposes. Usage: hashgen [-t HASH_TYPE] <FILE_PATH> HASH_TYPE FILE_PATH The type of hash to compute (gost, sha1 or md5). If this option is omitted the default hash type is md5 The absolute path of the file, to be used for hash computation. Fixes Problems described in the table below have been fixed since Stonesoft SSL VPN version A workaround solution is presented for earlier versions where available. Synopsis IP Address Pool Netmask cannot be configured (#80811) Web Console System Information does not report correct information about filesystems (#82548) Backup fails partially with misleading indication if not enough space left on spool filesystem (#82913) MacOS X Access Client crashes with certain Tunnel Set configurations (#83249) Description When using an IP address pool, the netmask value is assigned to be class A if you use a 10.x.x.x IP address range or class C if you use a x.x address range. The Web Console System Information reports incorrect values and percentages about filesystems. When you create a backup through the Web Console and the spool filesystem is almost full, there is no indication that there is not enough space to save the backup file. As a result, only a partial backup is made. The Web Console incorrectly indicates that the backup creation finished. If the use of a Tunnel Resource is allowed in the Tunnel Set Access Rules but denied in the Tunnel Resource Access Rules, the MacOS X Access Client crashes when a user tries to access the Tunnel Resource. Workaround for Previous Versions Define a Virtual IP Address Pool range from a network that is routable to the SSL VPN and is not used in any tunnel set where Virtual IP-address is needed. None. Check that there is enough free space on the spool filesystem before creating a backup. None. 3 Stonesoft Management Center Release Notes for Version

4 Synopsis Selecting "Always trust command" in Windows Access Client causes crash (#83397) Remote Desktop SSO does not work in Windows 2008/2008R2 (#83623) Description When running the startup command of a Tunnel Resource, the Windows Access Client prompts the user to accept the command to be run. Selecting "Always trust command" in the dialog and proceeding causes the Access Client to crash. When a Tunnel Resource for Remote Desktop to a Windows 2008/2008R2 system is configured with SSO, Single Sign On is not performed. None. Workaround for Previous Versions In the Terminal Services/Remote Windows Services Host configuration on the Windows 2008(R2) server, select "RDP Security Layer" as the Security Layer instead of "Negotiate" or "TLS/SSL". The communication between RDP client and SSL VPN security gateway remains secured by the SSL tunnel. System Requirements Stonesoft Appliances Stonesoft SSL VPN version is supported on all Stonesoft SSL VPN appliances and on Stonesoft SSL VPN Virtual Appliances. Build Version The Stonesoft SSL VPN version build version is Product Binary Checksums sslgw_engine_ _i386.zip MD5SUM f eb32e2b7c4ea0201c7dcb8fa SHA1SUM 01ffd19a f86dd53d2696ed sslgw_engine_ _vmwarefw-esx.zip MD5SUM 2bb20c9f5c713320c c86203a2 SHA1SUM 46dc8e0f2b3474f511c f06e6a818368b 4 Stonesoft Management Center Release Notes for Version

5 Compatibility Browser and Client OS Compatibility Stonesoft SSL VPN version administration requires the use of a workstation with a TCP/IP network configured and a Web browser installed. To use the Application Portal, the connecting client must have TCP/IP configured and a Web browser installed. To use Tunnel Resources, such as client/server TCP/UDP-based applications, the connecting client must have TCP/IP configured and a Web browser compatible with Java or ActiveX technologies installed. To use the Stonesoft Web authentication method, the client must support Java technology to display the clickable webpad. To use the Stonesoft MobileID (Synchronized or Challenge) authentication method, the client must have MobileID software installed and seeded. For the full platform compatibility matrix for the functionalities described above, please see Technical Note Directory Services User information can be stored in an internal user directory, or one of the following external directory services can be used: Microsoft Active Directory 2003 Microsoft Active Directory 2008 Novell edirectory OpenLDAP Sun Java System Directory Server Oracle Internet Directory (authentication only) Tivoli Directory Server (authentication only) IBM RACF LDAP (authentication only) OpenDS 2.x OpenDJ NOTE You must use an external Directory Service or the new OpenDJ Directory Service for mirrored configurations. For additional information, please refer to the SSL VPN Administrator s Guide. 5 Stonesoft Management Center Release Notes for Version

6 Additionally, when using the Access Client on Windows Vista or Windows 7, the following requirements apply: Requirement Access Client on Microsoft Windows Vista and 7 requires administrator rights Stonesoft ActiveX Client Loader requirements Drive letter mapping in Windows Vista Description The Access Client requires administrator rights to run properly on Windows Vista and Windows 7 the first time it is installed. It automatically upgrades afterwards. To run the ActiveX Access Client loader successfully with Windows Vista UAC, you must add the Access Point server HTTPS address to the list of trusted sites in Internet Explorer. A single drive letter (for example, F :) cannot be used as a startup command in Windows Vista and Windows 7. All commands must be executed using runas to elevate to administrator mode since the mapping is done in administrator mode, and F: is not a valid executable. Use the following startup command instead: explorer /root, F: This works on both Windows XP and Windows Vista/Windows 7. Java Runtime Environment To run the Stonesoft Java Access Client, use Sun Java 1.6 Update 2 or later. Upgrade Instructions When upgrading mirrored systems, see the upgrade instructions in the SSL VPN Administrator's Guide, which is available from It is recommended to publish the configuration after a successful upgrade. Upgrade from Previous Version Stonesoft SSL VPN is upgraded from 1.5.x to through the Web Console or using the Remote Upgrade functionality in the Stonesoft Management Center. After the upgrade, log in to the SSL VPN Administrator interface and publish the updated configuration if the Publish button is highlighted. Upgrade from Prior Versions Stonesoft SSL VPN is upgraded from 1.4.x to through the Web Console or using the Remote Upgrade functionality in the Stonesoft Management Center. After the upgrade, log in to the SSL VPN Administrator interface and publish the updated configuration if the Publish button is highlighted. Direct upgrade from other versions to Stonesoft SSL VPN has not been tested although it may work. 6 Stonesoft Management Center Release Notes for Version

7 Known Issues The current known issues of Stonesoft SSL VPN version are described in the table below. For an updated list of known issues, consult our Web site at Synopsis Description Workaround Stonesoft SSL VPN Breaks Browser Domain-Based Security Model - Refs:CVE , CERT VU# (#55542) In a mirrored configuration, OATH database must be configured as an external database (#50490) Configuring Directory Service as Microsoft Active Directory and setting RootDN with a container class object is not accepted (#50034) Use of IP pool address with Active FTP does not work on a Vista system (#50028) Stonesoft SSL VPN breaks the browser domainbased security model. The vulnerability lies in the architecture of the SSL VPN solution. As a result of the vulnerability, all resources under a single SSL VPN domain may potentially steal or modify each other's active web content, such as web cookies. In a mirrored configuration with OATH activated, adding a secondary Authentication Service causes the following error message: "To validate if OATH is used on the configured Authentication Service-node (i.e. tokens are imported), it has to be started. A system with more than one Authentication Service-node cannot use a local database; it would result in data inconsistency." This is a Microsoft Active Directory specific problem. An Organizational Unit is not an allowed child object of the class "containers" within the Active Directory default schema. "ou=accounts,..." is an Organizational Unit. Hence "ou=accounts" cannot be added to "cn=users,..." since "cn=users,..." is a container (objectclass=container,objectcategory="cn=cont ainer,cn=schema,cn=configuration,..." RootDN should start with an Organizational Unit (OU="...",...). Using an SSL VPN resource for active FTP with an IP address pool from a Windows Vista machine fails when the server starts the transfer. The problem is caused by the IP address used in the PORT command, which is not the same as the IP address assigned from the IP address pool. Recommended Actions: Deploy only trusted resources to the SSL VPN portal. Resources with significantly different security zones, such as resources hosted by different companies, should be deployed using Pooled DNS Mapping or Reserved DNS Mapping. Untrusted resources should not be deployed to the SSL VPN portal at all. If these types of resources are needed, they should be deployed as External Sites so that the SSL VPN portal gives a direct link to the resource, instead of making the client route the traffic to the resource through the SSL VPN portal. Please consult the Stonesoft SSL VPN Administrator's Guide for further information about deploying Pooled DNS Mapping, Reserved DNS Mapping, or defining External Sites. Configure OATH in the SSL VPN Administrator (through Manage System - OATH Configuration - Database Connection) to point to an external URL (for example: jdbc:hsqldb:hsql:// :9001/:shut down=true) Alternatively, you can disable OATH in the Web Console. In the SSL VPN Administration interface, configure RootDN to set the Organizational Unit as not part of a container. For example, OU=Accounts,DC=DOMAIN,DC=COM or OU=Accounts,OU=SSLVPN,DC=DOMAI N,DC=COM Use passive FTP or an FTP program that allows setting the client IP address to be used for the PORT command. 7 Stonesoft Management Center Release Notes for Version

8 Customized icons uploaded using the Browse function do not appear in icon library (#64916) Access Client for Mac does not work on Snow Leopard (10.6.x) if firewall is enabled (#82978) Tunnel Set Advanced Settings for Local Lookup do not work on Mac and Linux clients (#67796) Customized icons that have been uploaded to custom-files/wwwroot/wa/img/icons using the Browse function in the Administrator Interface do not appear in the icon library. Having the Mac OS X firewall enabled on a computer running Mac OS X Snow Leopard (10.6.x) prevents the Access Client from working correctly. When configuring a Tunnel Set, Local Lookup entries configured in the Advanced Settings are not taken into consideration on Mac and Linux clients. Upload the customized icons for each resource on the resource definition page. Temporarily disable the firewall on Mac OS X when using the Access Client with Stonesoft SSL VPN. Use DNS redirection to an internal DNS server to resolve the names for protected resources. 8 Stonesoft Management Center Release Notes for Version

9 Copyright and Disclaimer Stonesoft Corporation. All rights reserved. These materials, Stonesoft products, and related documentation are protected by copyright and other laws, international treaties and conventions. All rights, title and interest in the materials, Stonesoft products and related documentation shall remain with Stonesoft and its licensors. All registered or unregistered trademarks in these materials are the sole property of their respective owners. No part of this document or related Stonesoft products may be reproduced in any form, or by any means without written authorization of Stonesoft Corporation. Stonesoft provides these materials for informational purposes only. They are subject to change without notice and do not represent a commitment on the part of Stonesoft. Stonesoft assumes no liability for any errors or inaccuracies that may appear in these materials or for incompatibility between different hardware components, required BIOS settings, NIC drivers, or any NIC configuration issues. Use these materials at your own risk. Stonesoft does not warrant or endorse any third party products described herein. THESE MATERIALS ARE PROVIDED "AS-IS." STONESOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO, THE INFORMATION CONTAINED HEREIN. IN ADDITION, STONESOFT MAKES NO EXPRESS OR IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR USE WITH RESPECT THE INFORMATION CONTAINED IN THESE MATERIALS. IN NO EVENT SHALL STONESOFT BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL OR INCIDENTAL DAMAGES, INCLUDING, BUT NOT LIMITED TO, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING FROM THE USE OF THESE MATERIALS, EVEN IF ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH DAMAGES. Trademarks and Patents Stonesoft, the Stonesoft logo and StoneGate are all trademarks or registered trademarks of Stonesoft Corporation. Multi-Link technology, Multi-Link VPN, and the Stonesoft clustering technology-as well as other technologies included in Stonesoft-are protected by patents or pending patent applications in the U.S. and other countries. All other trademarks or registered trademarks are property of their respective owners. Stonesoft Corporation Itälahdenkatu 22A FI Helsinki Finland Tel Fax Stonesoft Inc Crown Pointe Parkway Suite 900 Atlanta, GA USA Tel Fax Copyright 2012 Stonesoft Corporation. All rights reserved. All specifications are subject to change.