SafeWord 2008 Customer Release Notes

Transcription

1 SafeWord 2008 Customer Release Notes Product Version: Release Notes Issue Date: October 14, 2010 Last Updated: October 14, Product Description SafeWord 2008 by SafeNet is a two-factor authentication solution for the Microsoft Windows platforms. SafeWord makes it easy to deploy two-factor authentication to protect your most important assets and applications. It includes easy to use tokens (including hardware, software and SMS-based tokens) and seamlessly integrates with your existing Microsoft Windows management tools. 2. Version Summary 2.1. Release Description SafeWord 2008 version is the next maintenance release for SafeWord 2008, adding automatic MobilePASS software token enrollment, and zero-touch BlackBerry Enterprise Server (BES) autoauthentication. This release supports large-scale deployments of MobilePASS by enabling easy user selfactivation for users on BlackBerry devices. To enable the automatic activation, the MobilePASS client (on BlackBerry) communicates directly with the MobilePASS portal (over secured HTTPS), enrolling the token and connecting it with the user record. This eliminates the need for the user to manually connect to the portal and activate the token. The goal is to enhance user experience and minimize manual steps in the process. The new BlackBerry client still supports the manual activation for backward compatibility. To enable automatic enrollment for BlackBerry MobilePASS users, administrators must add the necessary auto enrollment parameters into the.jad file or to their BES policy. If using the.jad file option, the administrator must update the.jad file and host it for user download. This enables passing required and site specific parameters (like the portal URL) to the client to enable the client to automatically communicate with the portal. For more details on how to enable the automatic activation, please refer to the SafeNet MobilePASS Software Administration Guide section, Configuring automatic enrollment for BlackBerry users (available from To further streamline the activation process and enable zero-touch activation we have enabled BES auto authentication option (for deployment over BES using Active Directory). When enabled, the MobilePASS portal uses your BES to authenticate users automatically, without requiring credentials to be input. To configure your BES policy to auto-authenticate users, refer to the SafeNet MobilePASS Software Administration Guide (available from ). We continue to expand MobilePASS device support. We currently support BlackBerry, iphone, ipod touch, ipad, Android, J2ME and Windows Desktop (available beginning in ). This list will be updated as Page 1 of 19

2 we add support for additional devices and operating systems. For an up-to-date list of supported devices, and to download the latest clients, please visit: This release of SafeWord 2008 comes with two free MobilePASS software tokens to allow you to immediately test drive the new functionality. After applying the patch, just import the file <install-dir>\program Files\SafeWord\SoftwareEvalTokens.dat, or, if you have just done a clean installation, the tokens are already in the database and ready to use. This release also includes several enhancements and defect fixes New Features and Enhancements BlackBerry MobilePASS users can now self-activate their MobilePASS token over-the-air, either supplying a user name and password, or, in the BES environment, the BES can be used to identify the user at enrollment time (allowing zero touch activation). Added Android MobilePASS support. Updated iphone MobilePASS support to enhance security on ios 4. Added support for Citrix Web Interface 5.3 Added support for down-level Windows user name format during MobilePASS self-enrollment. Added the option of permitting end-user self re-enrollment without administrator intervention Admin Console now allows easier movement of ACL entries in large ACLs. Added stability and security enhancements 2.3. Scope This version is released for general availability. Please see Advisory Notes and Known Issues and Workarounds for any limitations and restrictions. 3. Released Components 3.1. Component Versions SafeWord 2008 uses third-party software tools, including open source tools. The following table lists these tools and their version numbers. Java Runtime Environment Component 1.6.0_20 BeanShell MySQL OpenSSL 0.9.8o JExcelAPI Expat Version Page 2 of 19

3 Component IAIK Version Apache Tomcat Apache Velocity 1.4 Apache Commons Collections 3.2 Apache Commons Daemon Advisory Notes Supported platforms SafeWord 2008 supports the latest 32-bit and 64-bit Microsoft Windows platforms, including Windows XP, Vista, Windows 7, Server 2003 and Server 2008 and 2008 R2 (except Server 2008 Core and Business). The latest SafeWord version for Solaris is SafeWord PremierAccess version We continue to expand MobilePASS device support. We currently support BlackBerry, iphone/ipod/ipad touch, Android, J2ME and Windows Desktop (available beginning in ). This list will be updated as we add support for additional devices and OS. For a list of the most up to date supported devices and to download the latest clients, please visit: Software updates SafeWord 2008 can retrieve software updates from the Aladdin web server as they become available. You may check for such updates by opening the SafeWord ADUC Snap-in or by launching the SafeWord AutoUpdater directly from the Start Menu (select Programs > Aladdin > SafeWord > Update Aladdin products). This version of SafeWord uses a new SafeNet code signing certificate. When updating from earlier versions to SafeWord , a security warning may be displayed signaling this change. This warning is benign, and the installation can be safely continued. SafeWord Knowledge Base The Knowledge Base is a self-help option that contains hundreds of articles of hints, tips, and best practices. It can be found at Software token support and deployment Software tokens for iphone, ipod touch, ipad devices support ios OS 3.0 and higher. BlackBerry software tokens support BlackBerry OS 4.3 and higher. Android device support is available on Android 1.6/2.x. The iphone, ipod touch, ipad MobilePASS application can be downloaded from the Apple App Store via itunes at BlackBerry software tokens can be deployed via the BlackBerry Desktop Manager or via OTA (over the air) download directly to the device. To get the latest BlackBerry MobilePASS application, visit To push the MobilePASS application via the BlackBerry Enterprise Server, please contact SafeNet technical support for more information. Android users can download MobilePASS via the Android Market. From the device, go to the Android Market and search for MobilePASS to download and install. Page 3 of 19

4 5. Resolved Issues 5.1. In this Release Issue# Synopsis 9149 Importing more than 100 Alpine tokens with some already in the database, doesn't import the whole set of tokens When uninstalling AAA, it removes a registry key that could be used by another component. This caused operational issues with the remaining installed components Exchange 2010: When Idle timeout is expired, the "An unexpected error..." message is displayed with no chance to re-authenticate from the same browser session Update to JRE update Unable to download attachments after SafeWord OWA agent was installed in Exchange 2010/ Unwanted second OWA credential prompt Event log parsing gets corrupted by SafeWord XML data being logged incorrectly iphone MobilePASS client not generating a new passcode after a timeout After a successful auto enrollment with SafeWord DB: Audit Log Entry Event Description incorrectly states that the token was assigned to an Active Directory user MP portal doesn't accept ' or " characters when authenticating AD passwords during enrollment MobilePASS portal incorrectly generates ERROR level logging with failed user enrollments 9679,10068,10174,101 66,10116, Various security enhancements AAA server does not recognize Third Party Token -- Radius Token which prevents brokering from working MobilePASS Enrollment portal configuration settings incorrectly overwritten during a product update Assigning a MobilePASS thru the wizard without entering an activation code does not present an error message. Page 4 of 19

5 6. Known Issues and Workarounds Issue# Synopsis Summary: OWA Agent Session timeouts are currently not supported on Exchange 2010 Workaround: Disable timeouts when using SafeWord OWA agent with Exchange 2010 Summary: Auto-updating an existing installation ( b66) to displays a 'Security Warning" for 'setup_aua' installer. Workaround: Warning is benign (due to new SafeNet code signing certificate) and can be safely ignored. Summary: Cannot re-enroll MP token through auto enrollment when a soft PIN is assigned Workaround: Administrator must manually delete PIN for user, then reset it after successful enrollment. 7. Publications The latest product documentation is stored on the Web, and available either from the View Documentation button at install time, or on the SafeWord 2008 product documentation download page at You must have Internet access in order to view the following documents: SafeWord 2008 Administration Guide SafeNet MobilePASS Software Administration Guide Agent Administration Guide Upgrade Instructions Authenticators Administration Guide Page 5 of 19

6 SafeWord Release Notes April 2010 EO # P/N: A This Release Note contains the following information: Overview and Feature Summary Version Numbers of Third Party Tools Other Item(s) of Interest Overview and Feature Summary This release of SafeWord contains updates to the following features: SafeWord 2008 MobilePASS software token support is built into the SafeWord 2008 administration interface, with no need to download other administrative tools. Added new version of BlackBerry software token for BlackBerry OS 4.2 and higher. This version is generic, allowing all users to initially install the same device bundle on their BlackBerry. Activation can be done either by the administrator, or the user can self-enroll via the MobilePASS Portal. The generic version of BlackBerry is available for download at Added a software token for iphone/ipod Touch 3.0 and higher devices. This is available on the Apple App Store at Activation can be done either by the administrator or via user self-enrollment. MobilePASS Messaging now supports sending SMS messages with POST/XML parameters Enhancements to MobilePASS Messaging administrative interface for easier setup, administration, and troubleshooting MobilePASS Messaging token assignment now does not require the administrator to choose and enter a serial number OWA and Citrix Web Interface are now supported on Windows 2008 R2. Added support for Exchange 2010 Domain Login Agent now supported on Windows 7 MobilePASS Windows Desktop software token now supported on Windows 7 Added Stability and security enhancements Page 6 of 19

7 Version numbers of Third-party Tools SafeWord 2008 uses third-party software tools, including open source tools. The following table lists these tools and their version numbers. Component Version Java Runtime Environment 1.6.0_16 BeanShell MySQL OpenSSL 0.9.8m JExcelAPI Expat IAIK Apache Tomcat Apache Velocity 1.4 Apache Commons 3.2 Other Item(s) of Interest SafeWord Knowledge Base Updated daily, the Knowledge Base is a self-help option that contains thousands of pertinent articles, hints, tips, and best practices. It can be found at: Page 7 of 19

8 SafeWord Release Notes October 2009 EO # P/N: A This Release Note contains the following information: Overview and Feature Summary Version Numbers of Third Party Tools Other Item(s) of Interest Overview and Feature Summary This release of SafeWord contains updates to the following features: Enhanced SMS and SMTP (Messaging) functionality for Active Directory users: Integrated AD Lookup for Phone/ The new SafeWord 2008 Messaging feature allows users to receive SafeWord passcodes on their mobile devices via or SMS. At authentication time, SafeWord will look up the Active Directory user s phone or contact information, and send them an optionally time-limited SafeWord passcode. This can relieve your users from having to carry a hardware token in addition to a company- issued device. Enhanced Outlook Web Access (OWA) web login flow for SMS/SMTP Enhanced SMS provider configuration: SMS delivery can now be made with any SMS message provider that supports the HTTP GET protocol Improved passcode security with password expiration: passcode delivered via SMS or can be set to expire after 5 minutes (or other configurable time limit) improving security and reducing the risks associated with stolen passcodes Simplified installation and Management directly from Microsoft Active Directory Users and Computers Product includes two messaging tokens for easy and quick evaluation of the new capabilities SafeWord 2008 now supports the final released versions of Windows Server 2008 R2 and Windows 7 SafeWord 2008 now supports the new etoken PASS 6.2 OTP token Stability and security enhancements were made to the SafeWord User Center, OWA Agent, and SafeWord Installer. Page 8 of 19

9 Version numbers of Third-party Tools SafeWord 2008 uses third-party software tools, including open source tools. The following table lists these tools and their version numbers. Component Java Runtime Environment Version 1.6.0_16 BeanShell MySQL OpenSSL 0.9.8k JExcelAPI Expat IAIK Apache Tomcat Apache Velocity 1.4 Apache Commons Collections 3.2 Other Item(s) of Interest SafeWord Knowledge Base Updated daily, the Knowledge Base is a self-help option that contains thousands of pertinent articles, hints, tips, and best practices. It can be found at: Page 9 of 19

10 SafeWord Release Notes May 2009 EO # P/N: A This Release Note contains the following information: Overview and Feature Summary Version Numbers of Third Party Tools Other Item(s) of Interest Overview and Feature Summary This release of SafeWord contains updates to the following features: User Center: User self-enrollment is now available as part of the SW 2008 installer. After updating or installing the SafeWord Server on a machine, you can now launch the shortcut located at Start > Programs > Aladdin > SafeWord > User Center, and follow the simple instructions to enable the User Center server. Users can now securely enroll and test their tokens, assign PINs to tokens, resynchronize tokens, and more. General: Support for Windows 7 release candidate and Internet Explorer 8. Admin Server: Systems configured with prepended PINs can now correctly resync their tokens. RADIUS Server: Performance enhancements under high loads added. Domain Login Agent: Correctly configures Windows Firewall on Windows XP, Windows Vista, and Windows 2008 during installation. Page 10 of 19

11 Version numbers of Third-party Tools SafeWord 2008 uses third-party software tools, including open source tools. The following table lists these tools and their version numbers. Software Tool Version Number Java Runtime Environment 1.6.0_05 BeanShell MySQL OpenSSL 0.9.8k JExcelAPI Expat IAIK Apache Tomcat Other Item(s) of Interest Review the Known Issues Make certain to review the Known Issues document to become aware of any issues that exist in this software. This document may be found at: SafeWord Knowledge Base Updated daily with thousands of pertinent articles, the Knowledge Base is a self-help option that contains thousands of hints, tips, and best practices. It can be found at: Page 11 of 19

12 SafeWord 2008 version January 2009 EO: PN: A This Release Note contains the following information: Overview and Feature Summary Version Numbers of Third Party Tools Other Item(s) of Interest Overview and Feature Summary This is the first release of Aladdin SafeWord It is recommended that all installations of SafeWord 2008 be updated with this patch. General Rebranded to Aladdin Knowledge Systems. If you have upgraded from a previous release, the Start Menu shortcuts have been relocated to the Aladdin folder. Added support for Aladdin OTP tokens. Fail-over to an alternate SafeWord authentication server now works for all agents. SafeWord 2008 can now be installed on foreign language operating systems that are running Terminal Services in Application mode. Admin Server Added a configuration option that allows new users to be created in the SafeWord database during User Center enrollments. Active Directory Users and Computers plug-in Increased the acceptable token serial number length. Domain Login Agent The Domain Login Agent is now supported when installed on a stand-alone Terminal Services machine. Page 12 of 19

13 Version numbers of Third-party Tools SafeWord 2008 uses third-party software tools, including open source tools. The following table lists these tools and their version numbers. Software Tool Version Number Java Runtime Environment 1.6.0_05 BeanShell MySQL OpenSSL 0.9.8h JExcelAPI Expat IAIK Other Item(s) of Interest Product documentation The latest product documentation is stored on the Web, and available either from the View Documentation button at install time, or on the SafeWord 2008 product documentation download page at You must have Internet access in order to view the following documents: Upgrade Instructions Administration Guide Agent Administration Guide Authenticators Administration Guide Supported platforms SafeWord 2008 supports the latest 32-bit or 64-bit Microsoft Windows platforms, including Windows XP, Vista, Server 2003 and Server 2008 (except Server 2008 Core). The latest SafeWord version for Solaris is SafeWord PremierAccess version Software updates SafeWord 2008 can retrieve software updates from the Aladdin web server as they become available. You may check for such updates by selecting Start > Programs > Aladdin > SafeWord > Update Aladdin products. Review the Known Issues document The Known Issues document contains important information about software issues of which you should be aware. Please make certain to review this document, found at Page 13 of 19

14 SafeWord 2008 version June 2008 EO: PN: A This Release Note contains the following information: Overview and Feature Summary Version Numbers of Third Party Tools Other Item(s) of Interest Overview and Feature Summary This is the first release of Aladdin SafeWord It is recommended that all installations of SafeWord 2008 be updated with this patch. General SafeWord 2008 now supports IPv6 in all components except for the RADIUS and RADIUS Accounting servers. Upgraded to Java 6 for enhanced performance and to correctly perform time zone calculations on Windows Vista/ OpenSSL has been upgraded to version 0.9.8h, due to fixes for several security vulnerabilities. IAS/NPS Agent Now complies with the RADIUS RFC with regards to CHAP challenges. Agent log directory now has correct permissions on all language versions of Windows Server Domain Login Agent Improvements in memory management, resource management and performance. No longer uses the Windows password if the password field is left blank on Vista and Server Added support for computers with multiple IP Addresses. AAA Server Support for protocols 101 and 200 have been deprecated. Added a way to broker authentications to a third-party RADIUS server. AAA now correctly handles multiple Alpine authentication requests during start up. Active Directory Users and Computers Safeword snap-in Increased maximum size of DN that SafeWord assign tokens to. RADIUS Server Corrected logging configuration settings. Page 14 of 19

15 Version numbers of Third-party Tools SafeWord 2008 uses third-party software tools, including open source tools. The following table lists these tools and their version numbers. Software Tool Version Number Java Runtime Environment 1.6.0_05 BeanShell MySQL OpenSSL 0.9.8h JExcelAPI Expat IAIK Other Item(s) of Interest Review the Known Issues document Review the Known Issues document to become aware of any issues we already know exist in this software. You can find the latest version of this document at: Page 15 of 19

16 SafeWord 2008 version February 2008 EO: PN: A This Release Note contains the following information: Overview and Feature Summary Version Numbers of Third Party Tools Other Item(s) of Interest Overview and Feature Summary This is a maintenance release of SafeWord Some of the updates in this patch include: With the release of Microsoft Exchange SP1 the SafeWord OWA Agent now supports Exchange OWA on Windows Server In addition, several security enhancements were made to the SafeWord OWA Agent. Also improved support for the Firefox Web browser. Improved the performance and stability of the SafeWord DomainLogin Agent. It is recommended that all installations of SafeWord Domain Login Agent be updated to this patch version. The SafeWord Active Directory Users and Computers snap-in now supports different administrative levels of access (enabled with the Enterprise Solution Pack). Addressed several stability issues with the snap-in. Added support for running the snap-in on 64-bit Vista and XP systems. Improved the SafeWord IAS Agent so that restarting the system is no longer required for configuration changes to take effect on Windows Server 2008 systems. Several changes were made to ensure compatibility between the SafeWord Servers and the SafeWord Agents. Please make sure that systems with SafeWord Servers installed are updated with this patch before updating the SafeWord Agents. Page 16 of 19

17 Version numbers of Third-party Tools SafeWord 2008 uses third-party software tools, including open source tools. The following table lists these tools and their version numbers. Software Tool Version Number Java Runtime Environment 1.5.0_07 BeanShell MySQL OpenSSL 0.9.8h JExcelAPI Regex Expat Tomcat IAIK Other Item(s) of Interest Review the Known Issues document The Known Issues document contains important information about software issues of which you should be aware. Please make certain to review this document, found at: Page 17 of 19

18 SafeWord 2008 version 2.0 This section gives an overview of SafeWord 2008, and list of main features and supported platforms. SafeWord 2008 positively identifies users and controls access to VPNs, Citrix, Web, Windows domains, and other network applications. SafeWord tokens, the most reliable in the industry, provide one-time passwords that eliminate the vulnerabilities of fixed passwords. SafeWord 2008 combines ease of use and management unavailable in competing products, yet provides powerful options that can protect, control, and report on almost all aspects of network access. It includes the following new features: Support for 64-bit Windows systems Support for Windows Vista OWA agent support for Exchange Server 2007 Support for the current release candidate versions of Windows Server 2008 (x86 and x64) Tighter Active Directory integration in the SafeWord IAS agent With the addition of the Enterprise Solution Pack (ESP), SafeWord 2008 also supports: SecureWire Access Gateway, a full featured SSL VPN and web access gateway A new, streamlined Windows Domain Login Agent that can now also protect Windows Terminal Services Improved RDP v.6 support MobilePass authenticators - two factor authentication directly from your Blackberry, Windows Mobile, Palm or J2MEbased phone. Version numbers of Third-party Tools SafeWord 2008 uses third-party software tools, including open source tools. The following table lists these tools and their version numbers. Software Tool Version Number Java Runtime Environment 1.5.0_07 BeanShell MySQL JExcelAPI Regex Expat Tomcat IAIK Page 18 of 19

19 Other Item(s) of Interest Review the Known Issues document The Known Issues document contains important information about software issues of which you should be aware. Please make certain to review this document, found at: Page 19 of 19