Release announcements

Public key authentication (PKA) allows a user to connect to the Copssh server without sending a password over the Internet. PKA uses a key pair: a private key and a public key. The private key represents user's  identity and should be kept in a secure place and protected with a passphrase. The corresponding public key is automatically added to the list of public keys accepted by the user on the Copssh server.

Copssh Control Panel is now updated with a management framework for PKA administration:

• Wizard for creation of key pairs: Select key types rsa, dsa and ecdsa with supported keylengths, save private keys with an optional passphrase and add the public key to the list of authorized keys.

• Remove a public key from the list of authorized keys.

• Update comment and/or options fields of a public key

NB! This is just an attempt to make PKA setup easier. If you are a seasoned PKA veteran, you can update the underlying system files directly according to your requirements.

It's been observed that auto-populating the user list from domains with many users is very time consuming and leads to hangs and problems. User Activation Wizard in the Control Panel uses now a text entry field for domain users or if the local host is a domain controller. Auto-populated user list is still the preferred way to select local users on hosts which are not domain controllers.

Copssh 4.1.0 contains also the security patch for OpenSSL 0.9.8r. Se the previous blog for more information.

MD5 Signature:
0d3a00e538711a27067310317adab517 *Copssh_4.1.0_Installer.zip

SHA256 Signature:
2e1df2656dd64a7d5e71e6890ef30ce615b60ed046baab6101ad40f4b0515bf6 *Copssh_4.1.0_Installer.zip

Download: http://itefix.no/i2/download

OpenSSL team has published a security advisory addressing OCSP stapling vulnerability. Incorrectly formatted ClientHello handshake messages could cause OpenSSL to parse past the end of the message.

Recommended action: Users of OpenSSL should update to the OpenSSL 1.0.0d (or 0.9.8r) release, which contains a patch to correct this issue. If upgrading is not immediately possible, the source code patch provided in this advisory should be applied.

Copssh 4.0.4 security patch 100 will update your current OpenSSL binaries to version 0.9.8r. A service start is required. You can use command line switch '/S' for silent installation.

MD5 Signature:
c453f9b7de300c407a232a5f58983630 *Copssh_4.0.4_Security_Patch_100_Installer.zip

SHA256 Signature:
ffe1b8cd6a5d87d4da7579bf3d2094bb499b77d6596f7e112cbf933ac3faa3e5 *Copssh_4.0.4_Security_Patch_100_Installer.zip

Download: http://itefix.no/i2/download

Adolsign supports now multiple signatures with multiple attributes by using the configuration file adolsign.config. In addition, you can filter signatures based on group membership or values in AD. Have a look at examples at the end this blog.

Adolsign can now copy not only simple files but directories by the directive --addfile.

Command line switches for default signatures don't take an argument anymore. They apply only for the signature specified in command line.

By specifying the new option --utf8, you will be able to instruct Adolsign  to use UTF-8 (Unicode) decoding/encoding during template processing.

Adolsign.config examples:

adolsign.config
Description

[Signature corporate]
Group=Domain Users
Vcard=1
NewDefault=1
ReplyDefault=1
AddFile=corporate.png
AddFile=corporate.css

•  Process template files only if the user is member of Domain Users group. You can specify multiple groups. Adolsign will proceed if the user is member of at least one group.
•  Produce a Vcard
• This signature is default for new and reply messages
• Copy files corporate.png and corporate.css from the directory where Adolsign is started from.

[Signature \\SRV\netlogon\CompanyX]
field_company=CompanyX
Vcard=0
NewDefault=0
ReplyDefault=0
AddFile=CX-images
AddFile=CX.css

• Process only if AD-value for company name contains CompanyX. Comparisons are based on regular expressions and  case-sensitive. You can specify AD-fields multiple times, even the same attribute!
•  Don't produce a Vcard
• This signature is not a default one for new and reply messages
• Copy directory CX-images and CX .css from \\SRV\netlogon as well

** SECURITY UPDATE ** - OpenSSH 5.8p

Fix vulnerability in legacy certificate signing introduced in OpenSSH-5.6 and found by Mateusz Kocielski.

Legacy certificates signed by OpenSSH 5.6 or 5.7 included data from the stack in place of a random nonce field. The contents of the stack do not appear to contain private data at this point, but this cannot be stated with certainty for all platform, library and compiler combinations. In particular, there exists a risk that some bytes from the privileged CA key may be accidentally included.

A full advisory for this issue is available at: http://www.openssh.com/txt/legacy-cert.adv

2. UPDATE - Control Panel 2.0.3

More stable support for domain user activation (Use domainname\user to logon).
Bugfix. Empty activated user list after completing wizard

MD5 Signature:
da3ca0dd294db57767ca47cf14bb6a3d *Copssh_4.0.4_Installer.zip

SHA256 Signature:
690c5ac0c2f72bbc9754f8bf914b376d2098a3ee3a5578c728b4b859927d5bf6 *Copssh_4.0.4_Installer.zip

Download: http://itefix.no/i2/download

OpenSSH 5.7 introduces support for Elliptic Curve Cryptography modes for key exchange (ECDH) and host/user keys (ECDSA) as specified by RFC5656. ECDH and ECDSA offer better performance than plain DH and DSA at the same equivalent symmetric key length, as well as much shorter keys.

scp has a new -3 option: Copies between two remote hosts are transferred through the local host.  Without this option the data is copied directly between the two remote hosts.

ECDSA host keys are created during installation.

See OpenSSH 5.7 release notes  for more information.

MD5 Signature:
cedfe8a03691f31967a7e39fd4eb728f *Copssh_4.0.3_Installer.zip

SHA256 Signature:
7626556be4e9cca0507d702316a1c0768f6a483f357f4af461c1e5f806fc0a7e *Copssh_4.0.3_Installer.zip

Download: http://itefix.no/i2/download

Nagwin 1.0.1 supports Nagios CGIs capable of producing images (Statusmap, Trends and Histogram).

External Commands are also supported. That one required to implement a workaround: Named pipes are used extensively by Nagios for external command processing, while Cygwin has a limited and somewhat unstable support for named pipes. Nagwin 1.0.1 contains a patched Nagios using a one-plain-file-per-command approach for  processing. Patches are available at the download location.

In addition, Start menu has become more functional: Nagios services can be queried, started, stopped or resarted. You can also perform Nagios configuration checks.

  
CPU plugins relying on Windows performance counters don't report any values due to DLL conflicts. Nagwin contains a new check_pdm2 plugin producing correct values.

Installer signatures:

MD5:
a546b6994211f31f7664a383ddacad44 *Nagwin_1.0.1_Installer.zip

SHA256::
b6d0465af2aa8bd55f61945f4bf51bacb065588a98a702fd83d3f03b335d41b5 *Nagwin_1.0.1_Installer.zip

Version 4.0.2 comes with OpenSSL 0.9.8q security update and more stable handling of user lists in User Activation Wizard.

CHANGES FROM VERSION 4.0.1

1. SECURITY UPDATE- OpenSSL 0.9.8q

See http://www.openssl.org/news/secadv_20101202.txt for more information

2. Update - Control Panel User Activation Wizard 2.0.2

Better handling of user lists for activation

MD5 Signature:
889ecec6ca0f58865bda2563a952d771 *Copssh_4.0.2_Installer.zip

SHA256 Signature:
c258191ee12ce07cd21dbc985e653c3a28b7dccb42e3e54266c5aac18c232e66 *Copssh_4.0.2_Installer.zip
 

Version 4.0.1 fixes some serious bugs thwarting Coppssh's functionality to a large extent:

1. Bug fix - User Activation Wizard doesn't display user list on Windows 7

2. Bug fix - SFTP can not be activated as a service

3. Bug fix - Nano editor doesn't work

NB! You need to remove configuration file copsshcp.config in bin directory

Visit download section, grab your copy and many thanks for bug reports !!

Signatures:

MD5:
4041a93b040933fe820defc152c89a99 *Copssh_4.0.1_Installer.zip

SHA256:
a7077ff43084a60d5cb4074783fe4a59a1132bc67faad5e0de451ad68d27e433 *Copssh_4.0.1_Installer.zip
 

check_winprocess version 1.4 processes threshold value 0 properly.