Release announcements

Copssh version 4.9.3 comes with an updated Control Panel with following improvements:

• It is now possible to instruct the Control panel not to convert user names to lowercase. If you add the parameter below to the bin/copsshcp.config file, no conversion will find place:

[Options]
LowercaseUsername=0

The default behaviour is still conversion to lowercase.

• A chrooted sftp environment allowing isolated directories (access type Sftp) was only supported if the default service account (SvcCOPSSH) is selected. It is now supported for all kinds of service accounts including domain users.

• Copssh takes a service restart if a chrooted environment (access type Sftp) is specified during user activation, to avoid error messages about improper permissions on a chrooted directory.

cwRsync 5.4.0 installers contain the latest Rsync 3.1.1. It reintroduces socketpairs again in Cygwin setup as an attempt for better performance. We have also updated OpenSSL to 1.0.1h.

Changelog for Rsync 3.1.1

Nagwin version 2.2.1 contains the latest available Nagios Core 4.0.7 with bug fixes. It has also OpenSSH 1.0.1h addressing multiple security vulnerabilities (in the case you use Secure HTTPS via Nginx)

Changelog for Nagios Core:

FIXES

• Fixed bug #616: Unescape plugin output read from checkresult files, fix multiline perf data concatenation, and avoid extra memory allocation and copies. (Eric Mislivec)
• Fixed bug #609: Image on home page doesn't have correct image path prefix. (Derek Brewer)
• Fixed bug #608: Extra newline in service check timeout output string. (Mauno Pihelgas)
• Fixed bug #596: Crashes checking contact authorization for host escalations. (Alexey Dvoryanchikov - duplicates #590, #586)
• Fixed bug #496: Syntax error in exfoliation's common.css. (Karsten Weiss)

Copssh version 4.9.2 contains version 1.0.1h of OpenSSL addressing 6 security vulnerabilities announced recently.

The Secure Shell (SSH) is a different protocol from SSL or TLS.  OpenSSH relies on the OpenSSL library for access to the cryptographic primitives it provides, not for the TLS or SSL implementations.

Copssh is not vulnerable to those flaws.

Copssh 4.9.1 patch 1001 contains version 1.0.1h of OpenSSL addressing 7 security vulnerabilities announced recently. Even if most of the vulnerabilities affects the TLS implementation which are not used by Copssh, SSL/TLS MITM vulnerability (CVE-2014-0224) can affect ssl clients and servers.

Nagwin version 2.2.0 contains the latest available Nagios Core 4.0.6 with significant bug fixes.

Changelog for Nagios Core:

FIXES

• Fixed bug #600: Service Check Timeout State always returns OK (0) status (Mauno Pihelgas, Eric Stanley)
• Fixed bug #583: Status Check Output of (No output on stdout) stderr: (Eric Stanley - duplicate of bug #573)
• Fixed bug #573: Service checks returns (No output on stdout) stderr (Eric Stanley)
• Fixed bug #438: Reloads during downtime causes wrong availability calculations (Eric Stanley)
• Fixed feed updates when daemon can not access external networks (Eric Mislivec)

cwRsync 5.3.0 installers contain Rsync 3.1.1pre1 which was announced as a bug fix release on January 26th, 2014. It reintroduces socketpairs again in Cygwin setup as an attempt for better performance. We have also updated Cygwin, OpenSSH and OpenSSL to their latest available versions.

Changelog for Rsync 3.1.1pre1:

BUG FIXES:

• Fixed a failure to remove the partial-transfer temp file when interrupted (and rsync is not saving the partial files).
• Changed the chown/group/xattr-set order to avoid losing some security-related xattr info (that would get cleared by a chown).
• Fixed a bug in the early daemon protocol where a timeout failed to be honored (e.g. if the remote side fails to send us the initial protocol greeting).
• Fixed unintended inclusion of commas in file numbers in the daemon log.
• We once again send the 'f' sub-flag (of -e) to the server side so it knows that we can handle incremental-recursion directory errors properly in older protocols.
• Fixed an issue with too-aggressive keep-alive messages causing a problem for older rsync versions early in the transfer.
• Fixed an incorrect message about backup-directory-creation when using  --dry-run and the backup dir is not an absolute path.
• Fixed a bug where a failed deletion might not affect the exit code.
• Fixed a bug that caused a failure when combining --delete-missing-args with --xattrs and/or --acls.
• Fixed an itemize bug that affected the combo of --link-dest, -X, and -n.
• Fixed a problem with delete messages not appearing in the log file when the user didn't use --verbose.Improve chunked xattr reading for OS X.
• Removed an attempted hard-link xattr optimization that was causing a transfer failure.  (If you need to interact with an rsync 3.1.0 using --hard-links & --xattrs, you can specify --protocol=30.)
• We now generate a better error if the buffer overflows in do_mknod().Fixed a problem reading more than 16 ACLs on some OSes.
• Switched Cygwin back to using socketpair "pipes" to try to speed it up.
• Added knowledge of a few new options to rrsync.

ENHANCEMENTS:

• Added the support/rsync-no-vanished wrapper script.
• Made configure more prominently mention when we failed to find yodl (in case the user wants to be able to generate manpages from *.yo files).

Nagwin version 2.1.0 contains the latest available Nagios Core 4.0.5 with security and significant bug fixes. We have also updated Cygwin binaries/DLLs and tools to their latest available versions. Exfoliation theme is also back as the default theme. Nagwin service handler is also improved to handle process termination better.

Changelog for Nagios Core 4.0.5:

FIXES

• Fixed bug #595: Nagios 4 security fix (Alexey Dvoryanchikov, Eric Stanley)
• Fixed bug #594: Nagios 4 fix contactgroups parsing (Alexey Dvoryanchikov, Eric Stanley)
• Fixed bug #577: Nagios 4 checks stalled when write to socket failed (Alexey Dvoryanchikov)
• Fixed bug #580: Nagios 4 memory leak (Eric Stanley)
• Fixed init script to remove the switching of users when performing configuration verification which was causing failures if nagios user was set to nologin (Scott Wilkerson)
• Fixed auto creation of RAMDISK via environment variables in init script to properly check existence using $RAMDISK_DIR environment variable. (Scott Wilkerson)
• Fixed unreferenced variable NagiosVarDir in daemon-init (Eric Mislivec)
• Fixed bug where audio alerts wouldn't work with a 0 height and width - http://support.nagios.com/forum/viewtopic.php?t=26387 (Scott Wilkerson)

Copssh version 4.9.1 installers contain OpenSSL 1.0.1g fixing Heartbleed security vulnerability. Related US-CERT Alert is here.

OpenSSL Security Advisory [07 Apr 2014] - TLS heartbeat read overrun (CVE-2014-0160)
A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64k of memory to a connected client or server.
Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1.
Thanks for Neel Mehta of Google Security for discovering this bug and to Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for preparing the fix.
Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.
1.0.2 will be fixed in 1.0.2-beta2.

Copssh doesn't use TLS and is not vulnerable to a Heartbleed attack.

Copssh 4.9.0 contains OpenSSH 6.6p binaries.

Changes since OpenSSH 6.5

This is primarily a bugfix release.

Security:

* sshd(8): when using environment passing with a sshd_config(5) AcceptEnv pattern with a wildcard. OpenSSH prior to 6.6 could be tricked into accepting any enviornment variable that contains the characters before the wildcard character.

New / changed features:

* ssh(1), sshd(8): this release removes the J-PAKE authentication code. This code was experimental, never enabled and had been unmaintained for some time.

* ssh(1): when processing Match blocks, skip 'exec' clauses other clauses predicates failed to match.

* ssh(1): if hostname canonicalisation is enabled and results in the destination hostname being changed, then re-parse ssh_config(5) files using the new destination hostname. This gives 'Host' and 'Match' directives that use the expanded hostname a chance to be applied.

Bugfixes:

* ssh(1): avoid spurious "getsockname failed: Bad file descriptor" in ssh -W. bz#2200, debian#738692

* sshd(8): allow the shutdown(2) syscall in seccomp-bpf and systrace sandbox modes, as it is reachable if the connection is terminated during the pre-auth phase.

* ssh(1), sshd(8): fix unsigned overflow that in SSH protocol 1 bignum parsing. Minimum key length checks render this bug unexploitable to compromise SSH 1 sessions.

* sshd_config(5): clarify behaviour of a keyword that appears in multiple matching Match blocks. bz#2184

* ssh(1): avoid unnecessary hostname lookups when canonicalisation is disabled. bz#2205

* sshd(8): avoid sandbox violation crashes in GSSAPI code by caching the supported list of GSSAPI mechanism OIDs before entering the sandbox. bz#2107

* ssh(1): fix possible crashes in SOCKS4 parsing caused by assumption that the SOCKS username is nul-terminated.

* ssh(1): fix regression for UsePrivilegedPort=yes when BindAddress is not specified.

* ssh(1), sshd(8): fix memory leak in ECDSA signature verification.

* ssh(1): fix matching of 'Host' directives in ssh_config(5) files to be case-insensitive again (regression in 6.5).

Portable OpenSSH:

* sshd(8): don't fatal if the FreeBSD Capsicum is offered by the system headers and libc but is not supported by the kernel.

* Fix build using the HP-UX compiler.