Release Announcements

Adolsign 2.1 is now available with a new lookup directive for conditional fields. This capability allows you to replace values in Active Directory by values in lookup tables defined in the configuration file. A flexible way to support multi-language initials, titles and many more. Example:

field_title( --lookup Norwegian_titles )field_title

in the configuration file:

[Norwegian_titles]
Manager=Sjef
Consultant=Konsulent

 Produces Sjef or Konsulent if title values in AD are manager and consultant respectively (case insensitive). Otherwise, the value itself is used.

cwRsync - Rsync client and server for Windows

Version 4.1.0 - April 2011



CHANGES FROM VERSION 4.0.6



 1. UPDATED - Rsync 3.0.8

   

    See http://rsync.samba.org/ftp/rsync/src/rsync-3.0.8-NEWS for more detailed info.

 2. UPDATED - OpenSSH 5.8

 

    Security advisory - http://www.openssh.com/txt/legacy-cert.adv

     See http://www.openssh.org/txt/release-5.8 for more detailed info.

   

 3. UPDATED - OpenSSL 0.9.8r

 

    Security advisory - http://www.openssl.org/news/secadv_20110208.txt

    See http://www.openssl.org/news/changelog.html for more info.



SIGNATURES



MD5 Signature:

0cbf28987f7fc34b7b4a687f1880faba *cwRsync_4.1.0_Installer.zip

4ad4c7451e392d285e8129e56179ebb5 *cwRsyncServer_4.1.0_Installer.zip



SHA256 Signature:

63332ceba8b5145442b76e6c5cda5835b63b3d583b950adf29446887b433e9bf *cwRsync_4.1.0_Installer.zip

4d9ff47701c48c9378f391dbabfd98aaf47ac7440e43420ee72c11c2f6e6b5a7 *cwRsyncServer_4.1.0_Installer.zip



Download: http://itefix.no/i2/download

  



 

WINRPE - A yet another Nagios NRPE Agent for Windows
Version 3.0.3 - April 2011

CHANGES FROM VERSION 3.0.2

 1. BUG FIX - Service doesn't start due to account/group information

    Version 3.0.2 was supposed to solve that problem. However, a glitch
    caused this not to happen. The installer creates and runs the batch
    file "bin/winrpe_make_pwdgrp.cmd" for proper population of etc/passwd
    and etc/group files. That batch file can be reused for repopulation
    of related files in the case service account change.

 2. UPDATE - Default service account is deleted during uninstallation

    User defined service account will not deleted in the case the account
    is in use for other purposes.
   
 3. UPDATE - check_pdm for processor/disk and memory checks.
 
    Winrpe has the same check_pdm as Nagwin uses for its local checks.
    It should now work properly for NRPE checks.
   
 4. UPDATE - Reduction in the installer size

    Perl-based plugins use now a common perl dll.

CHANGES FROM VERSION 1.0.1



Perl: There are many Nagios addons and plugins dependent on Perl availability. Nagwin contains now a  standard distribution of Perl 5.10 enhanced with the following modules:

• Libwin32 bundle including

Win32::ChangeNotify, Win32::Clipboard, Win32::Console, Win32::Event, Win32::EventLog,  Win32::File, Win32::FileSecurity, Win32::IPC, Win32::Internet, Win32::Job, Win32::Mutex,  Win32::NetAdmin, Win32::NetResource, Win32::ODBC, Win32::OLE, Win32::PerfLib, Win32::Pipe,  Win32::Process, Win32::Registry, Win32::Semaphore, Win32::Service, Win32::Shortcut,  Win32::Sound, Win32::TieRegistry, Win32::WinError, Win32API::File, Win32API::Net, Win32API::Registry

• XML::Simple

• ExtUtils::Depends

• ExtUtils::PkgConfig
  
     

Net-SNMP:  A network monitoring solution without SNMP ? Not a very good idea. There are almost countless Nagios plugins using SNMP. Net-SNMP 5.5 is now included in Nagwin and all snmp applications including the trap daemon are available. SNMP agent and perl module Net::SNMP are not included due to compilation problems on Cygwin. I hope that they will be a part of the Nagwin in near future.



New plugins:

• check_oracle
• check_snmp_printers
• check_snmp_cisco

Bug fixes:

• command check_nrpe is now defined as standard in commands.cfg
• cgi2fcgi_wrapper - don't produce debug files in tmp directory

MD5 Signature:

7df48066948bac872eb41530b95433f0 *Nagwin_1.1.0_Installer.zip

SHA256 Signature: e6afbe93756e6196b10444d879c453ffbfb7f9113b01af1128166091b68fdf42 *Nagwin_1.1.0_Installer.zip

Download: http://itefix.no/i2/download

It's been observed that firewall software on the clients may block

initial connections, causing Copssh access client to bail out. Access

client template contains now a retry mechanism for not giving up before

trying 5 times with 3-seconds intervals.



WinSCP version 4.3.2 is now a part of the template.

 

MD5 Signature:

d976816e3f41698b5360e8a4c62e005d *PortForMe-2.1.1100.0-installer.zip



SHA256 Signature:

43d314522acb720ff45ce08ca966ed440a41685c0b928934a1e8e2c6ab99e5f1 *PortForMe-2.1.1100.0-installer.zip



Download: http://itefix.no/i2/download

Version 2.1.100.0 - March 2011

CHANGES FROM VERSION 2.0

1. NEW - A management framework for PKA (Public Key Authentication)

PortForMe is now updated with a management framework for PKA:

* A wizard for creation of key pairs: Select OpenSSH or Putty private
key formats, select key types rsa, dsa or ecdsa (only openssh) with
supported key lengths, save private keys with an optional passphrase
and add the public key to the list of authorized keys.

* Remove a public key from the list of authorized keys.

* Update comment and/or options fields of a public key

2. UPDATED - Client Access Wizard (CAW)

You can now select authentication type during the generation
of an access client. Possible alternatives are password and PKA.

Client with password authentication is same as the previous version
with some GUI changes. This type of client is not recommended for use
from public computers as it stores the password in the memory and sends
it over the network, even if the password is encrypted in both
situations.

Client with PKA uses a private key and SSH agent for full automation.
No password information is sent over the network. It is highly
recommended that the private key is protected by a strong passphrase
and is available on a removable media like a USB-memory stick.

3. UPDATED - User Activation Wizard

It's been observed that auto-populating the user list from domains
with many users is very time consuming and leads to hangs and problems.
User Activation Wizard in the Control Panel uses now a text entry
field for domain users or if the local host is a domain controller.
Auto-populated user list is still the preferred way to select local
users on hosts which are not domain controllers.

3. BUGFIX - ID string is not displayed

Client Access Wizard allows user to enter an ID string which can be
used to identify/track client access packages. Version 2.1 displays
ID string via user login dialog box.

4. BUGFIX - Delete button in Services tab doesn't work

MD5 Signature:
f02076a845e8725e46651cb997474d29 *PortForMe-2.1.1000.0-installer.zip

SHA256 Signature:
5451a635b5dc2f1e2b5666fbdceac03c6fcb210ee1cd1fb005946e86bcc6e726 *PortForMe-2.1.1000.0-installer.zip

Download: http://itefix.no/i2/download

Public key authentication (PKA) allows a user to connect to the Copssh server without sending a password over the Internet. PKA uses a key pair: a private key and a public key. The private key represents user's  identity and should be kept in a secure place and protected with a passphrase. The corresponding public key is automatically added to the list of public keys accepted by the user on the Copssh server.

Copssh Control Panel is now updated with a management framework for PKA administration:

• Wizard for creation of key pairs: Select key types rsa, dsa and ecdsa with supported keylengths, save private keys with an optional passphrase and add the public key to the list of authorized keys.

• Remove a public key from the list of authorized keys.

• Update comment and/or options fields of a public key

NB! This is just an attempt to make PKA setup easier. If you are a seasoned PKA veteran, you can update the underlying system files directly according to your requirements.

It's been observed that auto-populating the user list from domains with many users is very time consuming and leads to hangs and problems. User Activation Wizard in the Control Panel uses now a text entry field for domain users or if the local host is a domain controller. Auto-populated user list is still the preferred way to select local users on hosts which are not domain controllers.

Copssh 4.1.0 contains also the security patch for OpenSSL 0.9.8r.

OpenSSL team has published a security advisory addressing OCSP stapling vulnerability. Incorrectly formatted ClientHello handshake messages could cause OpenSSL to parse past the end of the message.

Recommended action: Users of OpenSSL should update to the OpenSSL 1.0.0d (or 0.9.8r) release, which contains a patch to correct this issue. If upgrading is not immediately possible, the source code patch provided in this advisory should be applied.

Copssh 4.0.4 security patch 100 will update your current OpenSSL binaries to version 0.9.8r. A service start is required. You can use command line switch '/S' for silent installation.

MD5 Signature:

c453f9b7de300c407a232a5f58983630 *Copssh_4.0.4_Security_Patch_100_Installer.zip



SHA256 Signature:

ffe1b8cd6a5d87d4da7579bf3d2094bb499b77d6596f7e112cbf933ac3faa3e5 *Copssh_4.0.4_Security_Patch_100_Installer.zip



Download: http://itefix.no/i2/download

Adolsign supports now multiple signatures with multiple attributes by using the configuration file adolsign.config. In addition, you can filter signatures based on group membership or values in AD. Have a look at examples at the end this blog.

Adolsign can now copy not only simple files but directories by the directive --addfile.

Command line switches for default signatures don't take an argument anymore. They apply only for the signature specified in command line.

By specifying the new option --utf8, you will be able to instruct Adolsign  to use UTF-8 (Unicode) decoding/encoding during template processing.

Adolsign.config examples:

adolsign.config
Description

[Signature corporate]
Group=Domain Users
Vcard=1
NewDefault=1
ReplyDefault=1
AddFile=corporate.png
AddFile=corporate.css

•  Process template files only if the user is member of Domain Users group. You can specify multiple groups. Adolsign will proceed if the user is member of at least one group.
•  Produce a Vcard
• This signature is default for new and reply messages
• Copy files corporate.png and corporate.css from the directory where Adolsign is started from.

[Signature \\SRV\netlogon\CompanyX]
field_company=CompanyX
Vcard=0
NewDefault=0
ReplyDefault=0
AddFile=CX-images
AddFile=CX.css

• Process only if AD-value for company name contains CompanyX. Comparisons are based on regular expressions and  case-sensitive. You can specify AD-fields multiple times, even the same attribute!
•  Don't produce a Vcard
• This signature is not a default one for new and reply messages
• Copy directory CX-images and CX .css from \\SRV\netlogon as well

** SECURITY UPDATE ** - OpenSSH 5.8p



Fix vulnerability in legacy certificate signing introduced in OpenSSH-5.6 and found by Mateusz Kocielski.



Legacy certificates signed by OpenSSH 5.6 or 5.7 included data from the stack in place of a random nonce field. The contents of the stack do not appear to contain private data at this point, but this cannot be stated with certainty for all platform, library and compiler combinations. In particular, there exists a risk that some bytes from the privileged CA key may be accidentally included.



A full advisory for this issue is available at: http://www.openssh.com/txt/legacy-cert.adv

2. UPDATE - Control Panel 2.0.3



More stable support for domain user activation (Use domainname\user to logon).

Bugfix. Empty activated user list after completing wizard



MD5 Signature:

da3ca0dd294db57767ca47cf14bb6a3d *Copssh_4.0.4_Installer.zip



SHA256 Signature:

690c5ac0c2f72bbc9754f8bf914b376d2098a3ee3a5578c728b4b859927d5bf6 *Copssh_4.0.4_Installer.zip



Download: http://itefix.no/i2/download