This dcument utlines: 1. Update Instructins Avcent ACS 6000 Advanced Cnsle Server Release Ntes, Versin 2.4.0.25 August 31, 2012 2. Appliance Firmware Versin and Language Supprt Infrmatin 3. Features/Enhancements 4. Bug Fixes 5. Knwn Issues 1 Update Instructins NOTE: Please refer t the ACS 6000 Installatin/Administratin/User Guide fr detailed instructins n updating the ACS 6000 cnsle server t versin 2.4.0. In rder t have all features listed in this release available thrugh DSView management sftware, DSView sftware versin 3.7.1 r later and ACS 6000 cnsle server plug-in versin 2.4.0.4 are required. After the ACS 6000 cnsle server firmware has been upgraded t versin 2.4.0, it is mandatry that the web brwser cache f any system which intends t be cnnected t the ACS 6000 cnsle server web interface is cleared. T d this, press Ctrl-F5 frm the brwser. ACS 6000 cnsle server firmware versin 2.4.0 prvides an internal mechanism which preserves the existing cnfiguratin when upgrading frm firmware versin 2.2.0. Hwever, it is strngly recmmended that yu back up the system cnfiguratin befre the firmware versin is upgraded. 2 Appliance Firmware Versin and Language Supprt Infrmatin Appliance/Prduct Firmware Type Versin Filename Part # Avcent Cyclades ACS 6000 Cnsle Server Opcde V_2.4.0.25 FL0585-024.bin FL0585-024.bin.md5 FL0585-024 3 Features/Enhancements NOTE: Please refer t the ACS 6000 Installatin/Administratin/User Guide and/r Cmmand Reference Guide fr details abut features supprted by the ACS 6000 cnsle server versin 2.4.0. Majr features f the ACS 6000 cnsle sever versin 2.4.0.25 include: CAS prfile supprts the fllwing prtcls: Telnet, SSH, Raw Mde, Telnet-SSH, Telnet-Raw Mde, Telnet-SSH-Raw Mde and SSH-Raw Mde. CAS prfile supprts the cnfiguratin f TCP prts fr SSH sessin and fr Raw Mde sessin. Lcal Data Buffering supprts rtatin by time, means data buffering file will be clsed and renamed with date when the time is achieve. Allw cnfiguratin f shell script t be called when there is a match in the alert string. Allw administratr t reset the serial prts statistics via UI. Majr features f the ACS 6000 cnsle sever versin 2.4.0.19 include: Supprt DSView sftware versin 4.
OpenSSL upgrade frm versin 0.9.8t t 0.9.8x because f the fllwing security issues: CVE-2012-1165, CVE-2012-2333, CVE-2012-2110, CVE-2012-2131, CVE-2012-0884 Majr features f the ACS 6000 cnsle sever versin 2.4.0.17 include: Apache upgrade frm versin 2.2.20 t 2.2.22 because f the fllwing security issues: CVE-2011-3192, CVE-2012-0021,CVE-2012-0031 and CVE-2012-0053 OpenSSL upgrade frm versin 0.9.8r t 0.9.8t because f the fllwing security issues: CVE-2011-4108, CVE-2011-4109, CVE-2011-4576, CVE-2011-4577, CVE-2011-4619 and CVE-2012-0027 Kerbers applied patch t fix security issue: CVE-2011-4862. Majr features f the ACS 6000 cnsle sever versin 2.4.0.12 include: A standalne ACS 6000 cnsle server will nt require a pwer device license t manage the Server Technlgy Sentry family f Switched Cabinet Pwer Distributin Units (CDUs), Smart Cabinet Pwer Distributin Units (Smart CDUs), switched CDU Expansin Mdule (CW/CX), Pwer Twer XL (PTXL) and Pwer Twer Expansin Mdule (PTXM) pwer devices. Majr features f the ACS 6000 cnsle sever versin 2.4.0.11 include: Apache upgrade frm versin 2.2.17 t versin 2.2.20 because f the fllwing security issues: CVE-2011-0419 and CVE-2011-3192. Majr features f the ACS 6000 cnsle server versin 2.4.0 include: The ACS 6000 cnsle server uses an embedded FIPS 140-2-validated cryptgraphic mdule (Certificate #1051) running n a Linux Pwer PPC platfrm per FIPS 140-2 Implementatin Guidance sectin G.5 guidelines. A custmer can enable r disable the FIPS mdule via the OBWI r CLI. With every update, the appliance will rebt and the SSH keys will be re-generated. The fllwing applicatins will be in FIPS mde f peratin when FIPS mdule is enabled: HTTPS, SSHv2, SNMPv3 and ADSAP2. The time perid t bt up the appliance will be lnger when the FIPS mdule is enabled because f the pwer-up self test (it takes almst 10 minutes). The time perid t establish an SSH sessin will be lnger when the FIPS mdule is enabled because f the verificatin f the integrity f the cryptgraphic mdule. Web user interface usability enhancements: My Cmputer: new ptin t transfer a file frm/t the appliance t/frm the cmputer where the brwser is running. The ptin is available fr the fllwing peratins: Save Cnfiguratin, Restre Cnfiguratin, Upgrade Firmware and Pwer Management Upgrade Firmware. Make sure the brwser allws yu t stre a file in the cmputer fr the Save Cnfiguratin peratin. Event Ntificatins: There are new events when the FIPS mdule is enabled: Event 16 FIPS cmpatible OpenSSL self test failed Event 17 Service in FIPS mde Event 18 Service in nn-fips mde Lgin Banner supprt: The administratr can enable and cnfigure the lgin banner via the OBWI and CLI. The lgin banner is supprted by the fllwing sessins: Telnet, SSHv2, OBWI and cnsle. Grup authrizatin: There is nw a new sessin idle timeut attribute: If the grup authrizatin that the user belngs t des nt have the sessin idle timeut cnfigured, the appliance sessin idle timeut will be applied fr the sessin. (Available in patch release v 2.2.0-19.) Supprt cnfiguratin via Btp request: The Btp Cnfiguratin Retrieval ptin allws the entire unit cnfiguratin t be retrieved ver Btp/TFTP during bt and during DHCP renewal. There are tw ways t push a cnfiguratin during a DHCP request/renewal. The cnfiguratin can be sent as file created
by the Save Cnfiguratin appliance system tl, r it can be sent as a CLI script t be executed under the cmmand line scripting interface. (Available in patch release v 2.2.0-19) Feature Alert Strings: Supprts regular expressin in the cnfiguratin f the string. (Available in patch release v 2.2.0-19.) Multiple Ruting Tables: This feature is supprted: This feature allws a custmer t cnfigure different netwrks by built-in Ethernet interface (ETH0 and ETH1) and t have ne default gateway fr each interface. This feature wrks nly fr IPv4 netwrk and requires static cnfiguratin f the IP address in bth interfaces. (Available in patch release v 2.2.0-19.) 4 Bug Fixes Patch release v 2.4.0.25 bug fixes include: SSH sessin t serial targets des nt shw errr messages when using rt user t lg-in. (L3-65686410). Patch release v 2.4.0.24 bug fixes include: Cisc pinut feature wrks in new units (FPGA versin 3). (L3-65683251 and L3-65685211) Patch release v 2.4.0.19 bug fixes include: Security issues in OpenSSL are fixed (see Feature/Enhancements) (L3-65673035). OBWI and CLI accept a cntrl character in the cnfiguratin f CLI cmmand in the Lgin Prfile cnfiguratin (L3-65674591). OBWI and CLI accept dt (. ) as part f the hstname in Appliance Name cnfiguratin. This name will be sent as part f the lg message t remte syslg servers.(l3-65672468) Patch release v 2.4.0.17 bug fixes include: Custmized time zne is stred during the Save Cnfiguratin cmmand t be restred via the Restre Cnfiguratin feature. (L3-65642054). Telnet sessin t the serial prt des nt translate CR t LF. (L3-65645567) /etc/shadw file is readable nly by rt user. (L3-65640351). Multi-sessin feature: Data traffic t sessins des nt stp when there is at least ne sessin able t receive data frm the serial prt. CLI allws custmer t type Lgin Banner with multiple lines using the fllwing instructins: Type the text between duble qutes and enter new line as \\n (duble back-slash plus character n ). (L3-65660471). Security issues in Apache, OpenSSL and Kerbers are fixed (see Feature/Enhancements). (L3-65662941, L3-65666162, L3-65666512). Tacacs+ accepts pund character ( # ) as part f the secret key. (L3-65654553). Patch release v 2.4.0.11 bug fixes include: The fllwing files have new Linux permissins (L3-65640351): /etc/shadw: read nly rt user /etc/passwd: read/write nly rt user /etc/grups: read/write nly rt user OBWI and CLI accept a cntrl character in the cnfiguratin f ptins fr the ts_menu in the Lgin Prfile cnfiguratin (L3-65640514). (See next bullet fr cntrl character explanatin.) The appliance allws a custmer t use a cntrl character t send a break t the serial prt during a sessin against the serial prt, when the Break Sequence is cnfigured with a valid cntrl character. A valid cntrl character is a string with tw characters: the caret ( ^ ) is the first ne, fllwed by a letter r ne f the fllwing special characters: square bracket ( [, ] ), backslash ( \ ), caret ( ^ ), underscre ( _ ). (L3-65628203). The IP alias and TCP prt alias f the serial prt are nt available in the appliance when the status f the serial prt is cnfigured as disabled.
Patch release v 2.4.0.9 bug fixes include: Bnding activates primary interface (ETH0) during fallback peratin. (L3-65627546) The IP alias f the serial prts des nt affect the remte sessin t the appliance (ssh/telnet sessin against appliance). (L3 65622292) The Enterprise OID is the ACS 6000 cnsle server family OID (Enterprises.10418.16) in the SNMPTRAP message and in the ACS6000-TRAP-MIB.asn file. (L3 65614727) The Serial Viewer uses the SSH prt cnfigured in the Security Prfile. (L3 65623184) A lgin f the rt user in the appliance s cnsle prt will perfrm authenticatin using the cnfigured appliance authenticatin type. An ACS 6000 cnsle server allws an administratr t enable fallback lcally, nly fr the rt user in the appliance s cnsle prt. The cnfiguratin is available n the Appliance Authenticatin page (by default it is disabled). (L3 65627586) The OBWI wrks with Internet Explrer9 and Firefx 5 clients. The prductin script nw crrectly reprts Ethernet test results. Savecnf and restrecnf cmmands have the ptin t transfer a cnfiguratin file t/frm TFTP server. (L3 65630647) Wiz cmmand in CLI shws the default gateway cnfigured via OBWI/CLI when the methd is cnfigured as static. (L3 65634438) The restrecnf cmmand restres serial prts cnfiguratin between appliances with different number f serial prts. (L3 65634439) Other bug fixes include: Telnet Send Break cmmand sends the break signal t the target device. (L3 65582372). In the CLI, the C ptin allws a custmer t execute a CLI cmmand in n-interactive mde. (L3-65589589). The SNMP cmmunity name nw supprts special characters. (L3-65602362). The SNMP answer fr sysobjectid is the Prduct Object ID. The lgging cnfiguratin depends n the cnfiguratin f Data Buffering, such as, the lgging cnfiguratin will be effective nly if the Data Buffering status is cnfigured as enabled. (L3-65605084). The syslg message header shws nly the hst name f the appliance. (The string src_dev_lg@ was remved frm the syslg message). The CPU inf nw shws the crrect prcessr name: 440EPX. The ACS 6000 cnsle server supprts a chain f PM 10/20/30A PDUs with versin 1.9.1. Minimum value fr Sessin Idle Timeut is 90 sec. The SNMPTRAP message with Enterprise OID as specified in the ACS6000-TRAP-MIB file (L3-65614727) is fixed. Regular users can run cli applicatin frm the shell prmpt. (L3-65618098) =============================================================================== 5 Knwn Issues =============================================================================== This release cntains the fllwing knwn issues: The DSView sftware authenticatin type des nt wrk when the FIPS mdule is enabled. Firmware Upgrade fr a PDU under the Pwer Management- PDU nde has the fllwing restrictins: Multi-selectin is available nly fr PM x000 PDU family May return errr when mre than ne PDU is selected fr the peratin. In this case, click in the Pwer Management- PDU nde in the left menu. The status f a PDU will shw up as Nt Available. Wait, then click in the nde again. When the status changes t Online, select the PDU again and click Rebt (the PDU requires a rebt after firmware upgrade). Wireless LAN devices (PCMCIA cards 16/32 bits and USB) are nt supprted. NIS, IPSec and NFS data lgging are supprted ver IPv4 nly. The utlet table under the PDU Devices drill-dwn menu in the web interface is nt autmatically refreshed after a cycle actin fr SPC pwer devices and Server Technlgy PDUs. The user needs t click the Refresh buttn. Changes in cnfiguratin related t sessin (including Idle Timeut and Appliance Sessin Data Lgging) are nly effective in the next lgin.
T use keys in SSH sessins, the authenticatin type shuld be cnfigured as lcal. In a CAS prfile, the ptins fr Aut Discvery and Aut Answer are mutually exclusive. Bth cannt be enabled in the CAS Prfile cnfiguratin fr ne prt. If Aut Answer is selected in the Serial Prt 1, Aut Discvery cannt be cnfigured in the Serial Prt 1, because bth features wrk with prbes and matches, thugh in a different way. Aut Answer tries t match the input. When it matches, it sends the utput string Aut Discvery sends the prbe string and waits fr the input t match with the match string that will handle the target name. Fr SPC pwer devices and Server Technlgy PDUs, the maximum value fr a plling interval is 20 secnds. The paste cnfiguratin generated by the list_cnfiguratin cmmand shuld nt have mre than 80477 characters. The PPP cnfiguratin thrugh the OBWI and CLI in the Dial-In pages is failing in the first time. This requires a re-cnfiguratin f the PPP fields. The PM PDU firmware versin 1.9.2 des nt recgnize the currseg cmmand. A chain f PDUs that has tw segments/circuits shuld have the same versin (fr example: all PM PDUs with v 1.9.2 r all PM PDUs with v 1.9.1). The Event # 308 PDU Firmware Upgrade Result will nt be generated when the PDU is an Avcent Pwer Management Pwer Distributin Unit (PM PDU). The OTP Aut Refresh peratin in the DSView 3 sftware is failing t restart the sequence number fr the OTP user. The custmer shuld lg in t the appliance using rt user and run the piepasswd c <username> cmmand, and type the passphrase as asked fr. Emersn and Emersn Netwrk Pwer are trademarks r registered trademarks f Emersn Electric C. Avcent, DSView and Cyclades are trademarks r registered trademarks f Avcent Crpratin. All ther marks are the intellectual prperty f their respective wners. This dcument may cntain cnfidential and/r prprietary infrmatin f Avcent Crpratin, and its receipt r pssessin des nt cnvey any right t reprduce, disclse its cntents, r t manufacture r sell anything that it may describe. Reprductin, disclsure, r use withut specific authrizatin frm Avcent Crpratin is strictly prhibited. 2012 Avcent Crpratin. All rights reserved.