COPSSH - A yet another SSH Server & Client for Windows

Version 2.1.0 - February 2009



CHANGES FROM VERSION 2.0.1



1. UPDATED - OpenSSH 5.2p



Security:



* This release changes the default cipher order to prefer the AES CTR

   modes and the revised "arcfour256" mode to CBC mode ciphers that are

   susceptible to CPNI-957037 "Plaintext Recovery Attack Against SSH".



* This release also adds countermeasures to mitigate CPNI-957037-style

   attacks against the SSH protocol's use of CBC-mode ciphers. Upon

   detection of an invalid packet length or Message Authentication

   Code, ssh/sshd will continue reading up to the maximum supported

   packet length rather than immediately terminating the connection.

   This eliminates most of the known differences in behaviour that

   leaked information about the plaintext of injected data which formed

   the basis of this attack. We believe that these attacks are rendered

   infeasible by these changes.



 

New features:



* Added a -y option to ssh(1) to force logging to syslog rather than

   stderr, which is useful when running daemonised (ssh -f)



* The sshd_config(5) ForceCommand directive now accepts commandline

   arguments for the internal-sftp server.



* The ssh(1) ~C escape commandline now support runtime creation of

   dynamic (-D) port forwards.



* Support the SOCKS4A protocol in ssh(1) dynamic (-D) forwards.

   (bz#1482)



* Support remote port forwarding with a listen port of '0'. This

   informs the server that it should dynamically allocate a listen

   port and report it back to the client. (bz#1003)



* sshd(8) now supports setting PermitEmptyPasswords and

   AllowAgentForwarding in Match blocks



Bug and documentation fixes



* Repair a ssh(1) crash introduced in openssh-5.1 when the client is

   sent a zero-length banner (bz#1496)



* Due to interoperability problems with certain

   broken SSH implementations, the eow@openssh.com and

   no-more-sessions@openssh.com protocol extensions are now only sent

   to peers that identify themselves as OpenSSH.



* Make ssh(1) send the correct channel number for

   SSH2_MSG_CHANNEL_SUCCESS and SSH2_MSG_CHANNEL_FAILURE messages to

   avoid triggering 'Non-public channel' error messages on sshd(8) in

   openssh-5.1.



* Avoid printing 'Non-public channel' warnings in sshd(8), since the

   ssh(1) has sent incorrect channel numbers since ~2004 (this reverts

   a behaviour introduced in openssh-5.1).



* Avoid double-free in ssh(1) ~C escape -L handler (bz#1539)



* Correct fail-on-error behaviour in sftp(1) batchmode for remote

   stat operations. (bz#1541)



* Disable nonfunctional ssh(1) ~C escape handler in multiplex slave

   connections. (bz#1543)



* Avoid hang in ssh(1) when attempting to connect to a server that

   has MaxSessions=0 set.



* Multiple fixes to sshd(8) configuration test (-T) mode



* Several core and portable OpenSSH bugs fixed: 1380, 1412, 1418,

   1419, 1421, 1490, 1491, 1492, 1514, 1515, 1518, 1520, 1538, 1540



* Many manual page improvements.





    See http://www.openssh.org/txt/release-5.2 for details

   



2. UPDATED - Installer



    Better clean-up during uninstallation

 

MD5 Signature:

988111bee542bef59b71b6724c8b8817 *Copssh_2.1.0_Installer.zip

SHA256 Signature:

b896b109d52f4284c15650f06048d72610cedd492dfb61622636684e5067b0b8 *Copssh_2.1.0_Installer.zip

 Winrpe 2.x is a totally redesigned version and uses the original Nagios NRPE addon plus Cygwin instead of the NRPE_NT.

CHANGES FROM VERSION 1.2.1

** NB! Winrpe 2.x IS NOT COMPATIBLE WITH EARLIER VERSIONS **

 1. NEW - Original Nagios NRPE
 
 Original Nagios NRPE plus Cygwin are used instead of NRPE_NT.

 2. NEW - ICW technology
 
 ICW technology allows you to have multiple cygwin-based solutions
 by using a single base, as recommended by Cygwin. Winrpe is now
 implemented as a repackaging of ICW Base and ICW Nrpe packages.
 You can extend your installation by additional ICW packages like rsync,
 openssh and so on.
 
 3. NEW - Ability to specify your own service account
 
 Winrpe installer has been extended to support user-defined service
 accounts. Existing accounts and domain accounts are also supported.
 

MD5 Signature:

0742c9c11254da4e2f32f8185a2e5116 *winrpe_2.0.0_Installer.zip

SHA256 Signature:

ff5522823cf57e4126bf3a23b7337a15f51f59ac57967e01b21a3eb336ec89e8 *winrpe_2.0.0_Installer.zip 

After more than one and a half years of practice, the time has come to accumulate experiences into a new version of the Nagios NRPE plugin check-pdm.

For processor usage, check_pdm measures three samples with one second intervals. You can now use options --psamples and --pinterval to adjust that behaviour. As an example, the combination of --psamples 5 --pintervals 3 will produce a processor usage value based on five samples with three seconds between. You can also use the option --verbose to monitor individual samples.

For memory usage, values for page file are used instead of physical memory equivalents, giving us a more accurate status.

For disk usage, the output is enhanced with the total size of the disk.

check_ad version 1.4 supports Windows 2008 platforms. As you may know, check_ad requires Microsoft tools dcdiag and netdiag. A Windows 2008 DC has dcdiag as a standard component, while netdiag should be installed (Windows 2003 version works just fine).

In addition, the support for the member test trust is removed, as it requires domain admin privileges with increased security risk.

Due to the netdiag bug described at the Microsoft KB870692, you may be interested in turning off the member test kerberos. This is now possible by using the option --nokerberos.

MD5 Signature:
f8b6f7b9405d9c3fb56ce094e54004c9 *check_ad-1.4.zip
SHA256 Signature:
323b3188e7da549295690f8ba0238883187b3a42167b114173237dd3bfb58233 *check_ad-1.4.zip

cwRsync - Rsync client and server for Windows
Version 3.0.1 - January 2009

CHANGES FROM VERSION 3.0.0

GENERAL

 1. UPDATED - OpenSSL 0.9.8j

   OpenSSL Security Advisory [07-Jan-2009] :
   https://openssl-library.org/news/secadv/20090107.txt

 2. SAME - Update 100 package
 
 Rsync 3.0.5 with transliteration and time-limit patches
  
SERVER

 3. UPDATED - Installer
 
    Bug-fix - silent installation support. Following silent scenarios are available now:
 
   switch '/S' - install with default credentials created by the installer
   switch '/S /u=user /p=password' - install with user-specified credentials

    Minor improvements including better support for version checks
 
CLIENT

 4. UPDATED - chmod.exe
 

COPSSH - A yet another SSH Server & Client for Windows

Version 2.0.1 - January 2009



CHANGES FROM VERSION 2.0.0

 

1. UPDATED - OpenSSL 0.9.8j



    OpenSSL Security Advisory [07-Jan-2009] : http://www.openssl.org/news/secadv_20090107.txt



2. UPDATED - Installer



    Bug-fix - silent installation support. Following silent scenarios are available now:



  switch '/S' - install with default credentials created by the installer

  switch '/S /u=user /p=password' - install with user-specified credentials



Minor improvements including better support for version checks

 

3. UPDATED - Copsshadm 1.1.0.1



    Don't hide existing accounts from XP/Vista logon screen



4. UPDATED - Many core tools

MD5 Signature:

18f70f8545914fb08f9d14907b5c37e4 *Copssh_2.0.1_Installer.zip



SHA256 Signature:

2ff9be57a4b171979a9379e282cfb946264fd5f3cea9581a53713a23223e0f39 *Copssh_2.0.1_Installer.zip



 

cwRsync - Rsync client and server for Windows
Version 3.0.0 - December 2008

** NB! cwRsync Server 3.x IS NOT COMPATIBLE WITH EARLIER VERSIONS **

CHANGES FROM VERSION 2.1.5

GENERAL

 1. UPDATED - Rsync 3.0.5

   See http://rsync.samba.org/ftp/rsync/src/rsync-3.0.5-NEWS
   for more information. This is a yet another bug-fix release.
   UNC-paths in the configuration file is now supported:
  
     Allow a path with a leading "//" to be preserved (CYGWIN only)

 2. UPDATED - Update package 100

   Rsync 3.0.5 with transliteration and time-limit patches
   
  
SERVER

 1. NEW - ICW technology
 
   ICW technology allows you to have multiple cygwin-based solutions
   by using a single base, as recommended by Cygwin. cwRsync server is now
   implemented as a repackaging of ICW Base and ICW RsyncServer packages.
   You can extend your installation by additional ICW packages like openssh,
   rbldnsd and so on. Every attempt has been made to assure that those
   fundamental changes will be transparent to end users. cwRsyncServer will
   function as before.
 
 2. NEW - Ability to specify your own service account
 
   cwRsyncServer installer has been extended to support user-defined service
   accounts. Existing accounts and domain accounts are also supported.
   As before, it is also possible to accept suggested values by the
   installer.
 
 3. REMOVED - OpenSSH server
 
   For OpenSSH Server functionality, you can now install copssh 2.x or newer
   before cwRsyncServer.

SHA256 Signatures:

b5667dbce2ac97ec6025f10f0f542fa20df520c18f0b3db23b4f5c0c05acbfa1 *cwRsyncServer_3.0.0_Installer.zip
699e7898dc1aba89748829dc2deda400311518cf13fe499cee5c33bc8155cbb6 *cwRsync_3.0.0_Installer.zip
abb792ebc4cbbdea7591f4e683ec14485793471688c6978a9178dbc4598cc57c *cwRsync_3.0.0_update_100.zip

COPSSH - A yet another SSH Server & Client for Windows
Version 2.0.0 Update 200 - December 2008

** NB! COPSSH 2.0.0 IS NOT COMPATIBLE WITH EARLIER VERSIONS **

CHANGES FROM VERSION 1.4.6

 00. BUG FIX - Installer Update 200

 Missing DLL cygwrap-0.dll required by the newer versions of sshd is back.

 01. BUG FIX - Installer Update 100

 Update 100 includes OpenSSH version 5.1 executables. The original
 2.0.0 package had 4.7 executables as result of a packaging error.

 1. NEW - ICW technology
 
 ICW technology allows you to have multiple cygwin-based solutions
 by using a single base, as recommended by Cygwin. Copssh is now
 implemented as a repackaging of ICW Base and ICW OpenSSH packages.
 You can extend your installation by additional ICW packages like rsync,
 rbldnsd and so on. Every attempt has been made to assure that those
 fundamental changes will be transparent to end users. Copssh will
 function as before.
 
 2. NEW - Ability to specify your own service account
 
 COPSSH installer has been extended to support user-defined service
 accounts. Existing accounts and domain accounts are also supported.
 As before, it is also possible to accept suggested values by the
 installer.
 
 3. UPDATED - Copsshadm
 
 Copsshadm is updated to support user-defined service accounts.

SHA256 Signature:

 96d3738ae98ef6d85e2c88e98f1156fdd23ae93c97b5887de8b6892352a65f37 *Copssh_2.0.0_Installer.zip

Nagios NRPE plugin check_file version 1.3 uses a very flexible format for specification of file age filters. Perl module Time::ParseDate is used for that purpose and following formats are supported:

 Absolute date formats:

        Dow, dd Mon yy
        Dow, dd Mon yyyy
        Dow, dd Mon
        dd Mon yy
        dd Mon yyyy
        Month day{st,nd,rd,th}, year
        Month day{st,nd,rd,th}
        Mon dd yyyy
        yyyy/mm/dd
        yyyy/mm
        mm/dd/yy
        mm/dd/yyyy
        mm/yy
        yy/mm      (only if year > 12, or > 31 if UK)
        yy/mm/dd   (only if year > 12 and day < 32, or year > 31 if UK)
        dd/mm/yy   (only if UK, or an invalid mm/dd/yy or yy/mm/dd)
        dd/mm/yyyy (only if UK, or an invalid mm/dd/yyyy)
        dd/mm      (only if UK, or an invalid mm/dd)
 

 Relative date formats:

        count "days"
        count "weeks"
        count "months"
        count "years"
        Dow "after next"
        Dow                     (requires PREFER_PAST or PREFER_FUTURE)
        "next" Dow
        "tomorrow"
        "today"
        "yesterday"
        "last" dow
        "last week"
        "now"
        "now" "+" count units
        "now" "-" count units
        "+" count units
        "-" count units
        count units "ago"

Absolute time formats:

        hh:mm:ss[.ddd]
        hh:mm
        hh:mm[AP]M
        hh[AP]M
        hhmmss[[AP]M]
        "noon"
        "midnight"

Relative time formats:

        count "minuts"
        count "seconds"
        count "hours"
        "+" count units
        "+" count
        "-" count units
        "-" count
        count units "ago"

Timezone formats:

        [+-]dddd
        GMT[+-]d+
        [+-]dddd (TZN)
        TZN

Special formats:

        [ d]d/Mon/yyyy:hh:mm:ss [[+-]dddd]
        yy/mm/dd.hh:mm