VShell(R) Server 2.6.4 Official -- January 25, 2007 Copyright (C) 1995-2007 VanDyke Software, Inc. All rights reserved. This file contains a VShell product history. It includes lists of new features, changes, and bug fixes sorted by release. For a product description, installation notes, registration, and contact information, please refer to readme.txt (downloaded with this package). Changes in VShell 2.6.4 Official -- January 25, 2007 ---------------------------------------------------- New features: - Windows: Introduced new registry-only option, "SFTP Enable Pre 2.6 Virtual Root Compatibility", which is a backwards compatibility flag for SFTP virtual root behavior when using clients that only support SFTP version 3 or lower. Changes: - Windows: "Sftp Use Single Virtual Root” now defaults to true. This allows clients that only support SFTP version 3 or lower to view all available SFTP roots. - Windows: Certificate map files now require fully qualified username to be specified, unless the registry option "Use Short Username for Certificate Map" is set to 1. Bug fixes: - WinSCP could not create directories during a copy operation to VShell. - Windows: VShell resolved unqualified usernames differently for password and public-key authentication on Window XP machines. - Windows: With complex Windows networks, there could have been a long delay during public-key authentication while VShell was resolving user names. - UNIX: VShell incorrectly established credentials when authenticating via AFS Kerberos v4. Changes in VShell 2.6.3 Official -- August 18, 2006 --------------------------------------------------- Changes: - Try VSHELL_SFTP_HOME as both a virtual and a real path when setting up the default directory. - Windows: Triggers now use fully qualified username for %U command replacement unless the registry option "Use Short Username For Triggers" is set to 1. - The VShell Config Panel's "Select User or Group" dialog now displays the "Entire Directory" top-level item. - VShell now sends "publickey" as the first method in the list of allowed authentication methods. This restores behavior from VShell 2.3 and previous. - VShell does not try to retrieve the "My Documents" location as the user's SFTP home directory if "SFTP Loads User Environment" is set to 0. Bug fixes: - Could not see domain local groups using the VShell Config Panel's "Select User or Group" dialog. - vsh: SSH1 port forwards ended abruptly. - vsftp: Crashed when the "version" command was given while not connected. Changes in VShell 2.6.2 Official -- May 25, 2006 ------------------------------------------------ Changes: - SFTP v3 clients now automatically switch into single rooted mode after configuring the home directory. This restores VShell 2.5 behavior. Bug fixes: - An access denied error was given when trying to use SFTP roots pointing to UNC paths. If these UNC paths were the only roots, users would be disconnected because no roots were available. - Windows: VShell created the host key in "C:\Program Files\VShell" even when installed elsewhere. - Windows: Occasionally the VShell service would not start after system reboot but would start manually. This was caused by a deadlock with the service control manager when accessing security policies. - UNIX: VShell incorrectly displayed symbolically linked files as regular files. Changes in VShell 2.6.1 Official -- April 25, 2006 -------------------------------------------------- Bug fixes: - SFTP clients connecting to VShell for Windows could not write to a file if they did not have permission to change the permissions (access control list) of the file. This typically resulted in attempts to modify/overwrite a file failing with "Access denied" errors. - Public-key authentication was slow on networks with a complicated domain trust. - VShell now recomputes the home directory when clients turn roots back on. This bug could have caused clients to disconnect if the home directory was "/" and "Sftp Use Single Virtual Root" was true in VShell. - Clients: Client initiated password changes displayed a misleading error when multiple authentications were required. Changes in VShell 2.6 Official -- March 30, 2006 ------------------------------------------------ Changes: - Made the default of the VShell configuration parameter "SFTP Use Single Virtual Root" to be true. Changes in VShell 2.6 Beta 4 -- March 21, 2006 ---------------------------------------------- New features: - vkeygen: The new "-l" option displays the MD5 (when in non-FIPS) and SHA1 fingerprint for a given key. Bug fixes: - Windows: VShell would report that host-key permissions were more permissive than recommended even if they were more restrictive. Changes in VShell 2.6 Beta 3 -- March 9, 2006 --------------------------------------------- Bug fixes: - Windows: Installing VShell under a different service name caused the service to not uninstall properly. - Windows: Installing VShell on a machine that previously had VShell installed always generated a new host key with the default name. The installer now checks to see if a host key already exists before setting the default path and turning on the Auto Generate Host Key. - Windows: If the "Retry timeout" option was set to "0", keyboard-interactive authentications would fail. The "Retry timeout" option now has a minimum value of "1". - Command-Line Clients: Entering the wrong passphrase for an SSH1 RSA public key no longer displays an "invalid structure" error. Users are now prompted to enter a passphrase until they use the correct one or cancel. - Command-Line Clients: Command-line clients now display unsupported host-key algorithms as they are received from the server. Previously unsupported algorithms were displayed as blank strings. - UNIX Command-Line Clients: FreeBSD and Macintosh OS X clients crashed when connecting to a VShell server that used an X.509 host key. Clients no longer crash, but X.509 functionally does not work on FreeBSD or Macintosh OS X at this time. Please contact support@vandyke.com if you need this functionality. Changes in VShell 2.6 Beta 2 -- February 28, 2006 ------------------------------------------------- New features: - Ability to use X.509 certificates as the host key in VShell. - Windows: Ability to control the installers from a text file that contains answers to various installer questions. - Command-line clients: Clients can now accept x509v3-sign-rsa (X.509 RSA) and x509v3-sign-dss (X.509 DSA) host keys. Changes: - Windows: VShell now checks connection filter explicit allows before adding an IP address that has exceeded the failure limit to the deny host file. If an IP address is explicitly allowed in a connection filter, connections will always be allowed. - Windows: The VShellConfig "sftp remove " and "sftp remove" commands no longer add a "deny Everyone" to the root. Now these commands clear all allow or deny entries from the root. The previous explicit deny would have required administrators to remove that entry before anyone could access roots. Bug fixes: - Removed memory leak during host-key exchange. - Windows: VShell could crash when multiple connections occurred at approximately the same time. - Windows: VShell would crash during authentication when RADIUS was configured with the wrong shared secret. - Windows: If RADIUS authentication was configured to require Windows and RADIUS passwords (in that order), it was possible to use the wrong Windows password on a second authentication attempt and successfully authenticate. You would have to enter the correct Windows password, the wrong RADIUS password, the wrong Windows password, and finally the correct RADIUS password for this to happen. - Windows: Public-key authentication would periodically fail when trying to login to a machine account with the following LSA log error: "Unable to locate a domain controller for domain DOMAIN (DsGetDcName() failed): 1355". VShell now handles that error message properly and checks the local machine accounts. - Windows: Fixed possible deadlocks during RADIUS authentication when the VShell server is under heavy load. - Windows: VShell periodically crashed when a client connected to the server and connection filters were enabled. - Windows: The VShell Control Panel General page now will only validate the "Disconnect idle sessions after ..." option if the check box is unchecked. - Windows: The Deny host file is now only loaded on start up and when the file is change by a process other than VShell. Previously, it was possible for an IP address to continue authentication attempts before the file was reloaded. - Windows: The VShell Control Panel Authentication page now will enable the apply button when changing the "Allow <#> password attempts" check box. - Windows: The VShell Control Panel Authentication page will not validate the values of the "Limit failed attempts" or "Timeout authentication after" options if the options are unchecked. - Windows: Adding an SFTP root using VShellConfig failed to make the root available for allowed users. - Windows: VShell crashed when you canceled out of a RADIUS authentication attempt and then tried to reconnect. - UNIX: VShell no longer leave an extra vshelld process when connecting to a VShell server configured with an empty ConnectionFilterTable. - Mac OS X: The OS X installer Welcome to the VShell Installer page had a typo that displayed the word "copyright" twice. - vsh: vsh crashed when exiting from a connection when a remote port forward had been setup. Changes in VShell 2.6 Beta 1 -- February 7, 2006 ------------------------------------------------ New features: - Windows: VShell now uses a FIPS 140-2 validated cryptographic library. VShell can be installed in "FIPS Mode", which uses the validated cryptographic library and only allows FIPS-approved algorithms. - Windows: Added VShellConfig, a command-line utility that allows listing and editing of SFTP roots and access control lists (ACLs). - Windows: Added a Deny Host file to reduce the impact of a dictionary attacks. VShell for Windows now tracks failed authentications by IP address and can add these addresses to the Deny Host file after the specified threshold has been reached. Once an IP address has been added to the Deny Hosts file, VShell will not allow future connections from that address. - Windows: Created .adm file that allows MMC to configure FIPS mode. VShell is configured on a per-machine basis while the clients can be configured on a machine or user basis. All VanDyke Software applications will honor the machine configuration before any user configurations. - vkeygen has a new command-line option "-t type" that allows a choice between generating RSA or DSS keys. The default is to generate DSS keys. - vsh: Added "-noshell", which causes vsh not to request a shell; this is useful if the remote system doesn't allow shell access but does allow port forwarding. Changes: - The GSSAPI SPN used during authentication is now logged. - Removed support for SFTP v5. - Windows: "Suppress Not Supported Errors" registry option changed to be on by default. This will now suppress some harmless "Failed to stat file" error messages that occur when clients attempt to "stat" a non-existent file before a file transfer occurs. - Windows: Changed the installer to select the non-FIPS mode installation by default unless previous installs were in FIPS mode. When installing you can change if VShell is installed in FIPS mode or not. - Command-Line Clients: Updated the Help and man pages for the command-line clients to indicate that PKCS#12 keys can be used with the "-i" flag for X.509 authentication. - Command-Line Clients: With verbose mode on, the command-line clients now log the host and port where they are attempting to connect. - Windows Command-Line Clients: When starting the client, verbose messages now indicate when FIPS mode is on and display the SSH2 version information. - Windows Command-Line Clients: When installed with VShell, the command-line client profile information is stored in HKEY_CURRENT_USER\Software\VanDyke\Client Pack\SSH2. Previously, client information was stored in HKEY_LOCAL_MACHINE\Software\VanDyke\VShell\Utils and caused trouble when running as a non-Administrator user. - UNIX Command-Line Clients: Now warn the user if their private-key file permissions are readable/writable to anyone other than the user. Bug fixes: - VShell will now send packets of less than 100 bytes. Previously, the minimum packet size could have caused connections to become stalled and not send the last few bytes. - VShell crashed when using an OpenSSH/OpenSSL private key file with DES (not 3DES) encryption. Now an error will be displayed when attempting to use a DES encrypted private key file. - VShell logged an incorrect error message when it could not create the log folder. Now the error text reads, "VShell could not create the log folder ". - VShell would crash when given an empty string or "localhost" for the incoming bind address and port for remote forward requests. Now these addresses are changed to the ANY address or the loopback address rather than crashing. The address and port used are now logged. - VShell could incorrectly fail to convert a username to a SID when setting access permissions over SFTP. In rare circumstances, it could cause a crash. - VShell now returns a failure when SFTP write or create operations fail. - Occasional "x bytes of data were dropped on local channel x..." errors were caused when doing port forwards. - VShell did not return an error when the SFTP file disposition or flags were incorrect. - Windows: Upgrading from previous versions of VShell occasionally failed because the currently running VShell service wasn't stopping before installing files. - Windows: VShell Control Panel crashes after trying to test an irresolvable hostname in either Port Forward or Connection filter entries. - Windows: SFTP connections were unable to find a valid home directory and would be disconnected, even when given access to the unrestricted root and having the appropriate rights. Now all fixed drives are properly checked for rights and used when appropriate. Each failed attempt is logged and the user will be disconnected if they don't have the rights to connect. - Windows: Even if "Load the user's environment" was off, SFTP connections would still load the environment and place the user in their "My Documents" folder if they had access to the unrestricted root. "Load the user's environment" is now honored correctly. - Windows: Users could not have a root with a UNC path as their home directory for SFTP connections. This would cause them to be disconnected if only UNC paths were available as roots. - UNIX: SFTP connections would fail to connect from SFTP v5 clients. VShell no longer requires support for access masks if not appropriate for the negotiated SFTP version.