|
|
|
EXTRA! 9 Service Pack 1 (SP1): Fixes and Features (Release Notes)
Technical Note 2257
Last Reviewed 14-Nov-2007
Applies To
EXTRA! X-treme version 9.0 SP1
Summary
Technical Note 2257
Last Reviewed 14-Nov-2007
Applies To
EXTRA! X-treme version 9.0 SP1
Summary
EXTRA! 9 Service Pack 1 (SP1) is available to maintained users who already have EXTRA! 9 installed. This technical note provides a list of fixes included in EXTRA! 9.0 SP1 and Reflection FTP 14.0 SP3 (which is included with EXTRA! 9 SP1).
This note is organized into the following sections:
Obtaining the Service Pack
What's Fixed in EXTRA! 9 SP1?
What's Fixed in Reflection FTP 14.0 SP3?
Known Issues
Additional Resources
What's Fixed in EXTRA! 9 SP1?
What's Fixed in Reflection FTP 14.0 SP3?
Known Issues
Additional Resources
Obtaining the Service Pack
Maintained customers are eligible to download the latest product releases from the Attachmate Download Library web site: https://download.attachmate.com/Upgrades/. For more information about logging into and using the Download Library, see Technical Note 0200.
What's Fixed in EXTRA! 9 SP1?
The following enhancements are included in EXTRA X-treme 9 SP1.
- Improved Security for TN3270 and TN5250 Connections
A new security option has been added for TN3270 and TN5250 connections. The Attachmate Security module uses cryptography validated to the Federal Information Processing Standard (FIPS) 140-2 and industry standard SSL and TLS protocols for ensuring data integrity and privacy.
To enable the Use Attachmate Security option
- From the Configure Connection dialog box, select the Use Attachmate Security option.
- Select the desired encryption level.
Operating the Attachmate security module in FIPS mode limits the encryption algorithms to those meeting the stringent FIPS 140-2 specification, so it is necessary that the server to which EXTRA! connects support the same level of encryption.
Should you encounter problems connecting with TN3270 or TN5250 transports when Use Attachmate Security is selected, either change the client transport configuration to FIPS 140-2 or clear Use Attachmate Security and choose SSL v3.0.
For more information about configuring secure connections in EXTRA!, see Technical Note 2245.
- IPv6 Support
Internet Protocol version 6 (IPv6) support is now available through the Attachmate Security module.
To enable IPv6 support:
- Select the Use Attachmate Security option in the Configure Connection dialog box.
Note: A connection over an IPv6 network can be made with or without SSL/TLS.
- To connect to a host on an IPv6 network without security, set the Level of Encryption to None.
If IPv6 addresses are detected in the IP Address field, the connection security will automatically be set to Use Attachmate Security.
- Changes to Client Certificate Management
Several improvements have been made to the way EXTRA! manages digital certificates for client authentication.
- Certificates are now uniquely identified by serial number and issuing certificate authority, in addition to subject name, so that there can be no ambiguity when users have multiple certificates in their personal store.
- Selection of a certificate to be used for client authentication for TN3270 and TN5250 SSL/TLS connections and Express Logon is handled automatically by default. However, the user has the option of selecting a specific certificate from the Windows store, if necessary.
- EXTRA! now uses a dialog box provided by the Windows operating system, with which the user chooses a digital certificate. This dialog box provides more detail about available certificates, so that the user can make a more informed choice.
Smart Cards
- Those who use smart cards for digital certificate storage should configure certificate manager to migrate personal certificates to be used with EXTRA! from the card to the user's store in Windows when the card is inserted, and to remove them when the card is removed.
Note: The user's private key should remain PIN-protected on the smart card. EXTRA! retrieves the certificate from Windows, and then the user is prompted for a PIN to unlock the private key on the card.
- EXTRA! no longer interacts directly with smart card cryptographic service providers. If this functionality is required, the previous EXTRA! certificate selection dialog box is still available and can be used by adding a registry value named ClientCertificateDlg to HKLM\Software\Attachmate\Extra!\WorkstationUser\Preferences and setting it to "1".
- Hotspot Enhancements
- Attachmate and IBM have different algorithms for identifying valid hotspots on the screen. IBM 3270 emulators enable hotspots with a specific set of delimiters previously unavailable in EXTRA!.
Enable IBM-style hotspot matching by adding "1" to the registry key HKCU\Software\Attachmate\Extra!\IBMHotspots.
- Hotspots resembling gray Windows button controls are now available.
Enable 3D style hotspots by adding "1" to the registry key HKCU\Software\Attachmate\Extra!\3DHotspots.
- Copy on Select for TN3270 Sessions
TN3270 sessions can be configured to copy text to clipboard as soon as it is selected on the screen. To enable this feature: Choose the Options | Settings - Edit dialog box, and then choose Deselect after Copy or Preserve after Copy.
The default is disabled.
- Additions to the EXTRA! COM Interface
ExtraGotFocus and ExtraLostFocus events have been added to the COM interface for EXTRA!. These COM events are fired if the EXTRA! Session Display loses focus or gains focus.
- ActiveX Applications
The EXTRA! COM interfaces have been modified for backward compatibility with version 8.0. Existing ActiveX client applications do not need to be rebuilt if they were developed using EXTRA! 8 or 8 SP1. Client applications compiled with other versions of EXTRA! must be recompiled using the new EXTRA! type library available with EXTRA! 9 SP1.
- Splash Screen Control
A setting called ShowSplashScreen has been added to the registry at HKCU\Software\Attachmate\Extra!\WorkStationUser\Preferences.
- Setting its value to NO prevents the splash screen from being displayed except on Evaluation copies.
- Setting its value to YES overrides the -NOLOGO command line option, causing the splash screen to appear even when EXTRA! is started via OLE.
- Installing under Windows Vista or Windows XP
For the default installation of EXTRA! X-treme 9, the User Data Location (sessions, macros, and schemes directories) should be installed in the My Documents or All Users directories. They should not be installed in the Application Directory (\Program Files).
Under Vista, if you specify Application Directory for the User Data Location, the UAC shield icon appears on top of the EXTRA! shortcut icon (the big orange E), indicating that you need elevated or special permissions to run EXTRA! from this location.
- EXTRA! 6530 Client Option Enhancements
The EXTRA! 6530 Client Option now provides SSL encryption and Telnet load balancing for TN6530 client connections across separate identically configured hosts.
Note: These enhancements are available in EXTRA! 6530 Client Option 9.0 SP1, which is available as a separate download from the Attachmate Download Library web site (extra6530-9.0.1-sp-w32.exe). EXTRA! 6530 Client Option 9.0 SP1 should be installed only after installing EXTRA! X-treme 9.0, EXTRA! 6530 Client Option 9.0, and EXTRA! X-treme 9.0 SP1 (in this order).
What's Fixed in Reflection FTP 14.0 SP3?
New features in Reflection FTP 14.0 SP3:
- "Use IPV6" setting.
A new setting, Use IPV6, has been added to the Connection tab in the Site Properties dialog box. Options are Always, Never, When Available. The default is When Available. Previously IPV6 support was configurable using the command window, and this technique is also still available.
- "Connect through NAT server" setting.
A new setting, Connect through NAT server, has been added to support SSL/TLS connections through a NAT proxy server. To configure this setting click the Security button, then click the SSL/TLS tab.
- New settings for forwarding FTP data through the SSH tunnel.
Three new settings are available for configuring Reflection to forward FTP data through the SSH tunnel. Use these settings when the FTP server is on a different host from the Secure Shell server. To configure these settings, go to the Connect to FTP Site dialog box, click Security, then click the Secure Shell tab. The new settings are:
- FTP host is different than the Secure Shell host
This setting is available when Use Reflection Secure Shell and Tunnel FTP using port forwarding are selected. When this setting is selected, Reflection forwards all FTP communications securely through the Secure Shell tunnel to the Secure Shell server, then forwards data in the clear from the Secure Shell server to the FTP server.
- SSH server address
This setting is available when FTP host is different than the Secure Shell host is enabled. Use it to specify the host running your Secure Shell server.
- SSH user name
This setting is available when FTP host is different than the Secure Shell host is enabled. If the user login name is different on the Secure Shell and FTP servers, use this to specify the user name on the Secure Shell server.
Configuring these settings is equivalent to using the following ssh command line:
ssh -L FTP/<local port>:<FTP address>:21 <SSH user name>@<SSH server address>- The FTP Open method now supports Secure Shell passwords.
The FTP Open method now supports sending passwords for Secure Shell sessions. The following sample configures a Secure Shell connection, connects to the specified host, and sends the specified user name and password.
Sub SFTP_Password_Auth()Dim FTP As New ReflectionFTP3With FTP .UseSSH = True .UseSFTP = True .Open "myhost", "myusername", "mypassword"End With- New setting for specifying which version to use for SSL/TLS connections.
You can now specify which SSL/TLS version to use. The choices are TLS Version 1.0 (this is the newer protocol and is the default) and SSL version 3.0. To change this setting, select a site in the Connect to FTP dialog box, then go to > Security > SSL/TLS > SSL/TLS version.
Issues resolved in Reflection FTP 14.0 SP3:
- Unable to deselect Encrypt data stream setting with SSL/TLS.
The FTP Client now correctly remembers the state of the Encrypt data stream setting for SSL/TLS sessions.
- Intermittant connection problems in SSL/TLS connections.
This patch fixes a problem that caused intermittent connection problems because the client was not correctly sending the AUTH TLS message.
- Modifying "Cache directory listing" fails to enable the Apply button.
In the Directories tab of the FTP Client Site Properties dialog box, modifying the Cache directory listing setting now correctly enables the Apply button on this tab.
- "Failed to load resource file ... openssh.dll" when launching using Visual Basic.
This patch fixes a problem that led to a missing openssh.dll error message when launching the FTP Client from a Visual Basic project.
- Improved local directory display performance.
This patch reduces the time it takes to display directory listings in the local pane.
- Improved remote directory display performance.
This patch reduces the time it takes to display directory listings in the server pane.
- File date is not preserved when configured for SFTP transfers.
The Preserve server file date option (available on the Transfer tab of the site properties dialog box) now works as expected for SFTP transfers.
- Kerberized FTP connection failure.
This service pack resolves a problem that caused some FTP servers to reject the connection when Reflection FTP was configured to use Kerberos.
- Faster server file display.
Reflection FTP Client server file display has been optimized to decrease the amount of time it takes to display and refresh the server display pane.
- Difficulty disconnecting and closing the client when connected using SSL/TLS.
You can now disconnect from the server (the preferred way to terminate network connections) or close the client when connected to a site that is configured to use SSL/TLS. When you close a connected session, the client now disconnects the SSL/TLS-secured FTP connection before shutting down.
Secure Shell 14.0 SP3
The following Secure Shell updates also apply to the Reflection FTP Client:
New features in Reflection Secure Shell 14.0 SP3:
- New "NoShell" configuration keyword.
When NoShell is set to "Yes", the client creates a tunnel without opening a terminal session. This option can be used in combination with ConnectionReuse to create a tunnel that can be reused by other ssh connections. You can configure this option in the Secure Shell configuration file, or using the -o command-line option.
- Specify the signature hash used during public key authentication.
You can now specify which hash algorithm the client uses in the process of proving possession of the private key during public key user authentication. To configure this, open the Reflection Secure Shell Settings dialog box. On the Encryption tab, under Signature types, select the hash you want to use for RSA and DSA keys.
Issues resolved in Reflection Secure Shell 14.0 SP3:
- Improved file transfer performance.
This patch includes changes that support faster SFTP and SCP file transfers.
- Improved directory display performance.
This patch reduces the time it takes to display directory listing in SFTP sessions.
- Certificate validation fails due to an unknown extended key usage OID.
Prior to this patch, server certificate validation failed if the certificate contained unknown extended key usage OIDs. These extensions are now checked during intermediate certificate validation only if they are marked as "Critical" or if you are running Reflection in DOD mode.
- Command line error messages sent to stdout.
Error messages for the ssh command-line utility are now sent to stderr.
- Additional information in sftp and sftp2 command line usage.
The sftp and sftp2 command line usage help now displays the following additional syntax for uploading files to the server: sftp [options] sourcefile [user@]host[#port]:[destination file]. This information is displayed when you use the -h command-line option.
- Blank dialog box appears during keyboard interactive authentication.
Reflection no longer displays a blank "Reflection Secure Shell Client" dialog box when you are configured to use keyboard-interactive authentication. This dialog box was introduced by changes made to the SP2 patch.
- Data display stops during Secure Shell sessions.
This patch fixes a problem that caused a halt in data display when large chunks of data are being received. Prior to the fix it was sometimes necessary to use the Enter key to view the entire display.
- Duplicate entries appear for the same user key.
This patch fixes a problem that caused Reflection to show multiple entries for the same user key when both a user-specific config file and a global ssh_config file were present on the same computer.
- Reflection Secure Shell sessions hang when transferring large amounts of data.
This service pack fixes a problem that would sometimes cause very large (gigabyte) data transfers to hang when Reflection was configured to use the Secure Shell protocol. This problem was seen with transfers using the Reflection user interface and also using Reflection command line utilities.
- Scp error message: "Cannot download non-regular file…"
This error message was displayed incorrectly when the Reflection scp command line utility was used with the -r switch. This problem has been resolved.
- Sftp transfer hangs when GET commands use wildcards.
Sftp file transfers that use wildcard GET commands now work as expected.
- Sftp and scp cannot simultaneously access the file.
In Reflection applications running with Service Pack 1 applied, the sftp and scp clients could not simultaneously access the same local file for uploading. This problem has been resolved.
- Error message: "Expected SSH2_EXP_DATA(103) packet, got 201".
This service pack corrects a problem in the Secure Shell protocol that could cause this error message to be displayed for slow or bad network connections.
Known Issues
Review the following known issues with Microsoft Vista and Attachmate products.
WinHelp Is Not Included with Vista
Windows Help program (WinHlp32.exe) is no longer included with Windows. Microsoft has made the Windows Help program downloadable for users who need to run their 32-bit help files on Vista (this includes Attachmate product help files). For more information, see Microsoft's article on the topic, http://support.microsoft.com/kb/917607. You can download the program at http://www.microsoft.com/downloads/details.aspx?familyid=6EBCFAD9-D3F5-4365-8070-334CD175D4BB&displaylang=en.
Additional Resources
For more information about EXTRA!, see the following resources:
Documentation: http://support.attachmate.com/manuals/extra.html
Product Support Lifecycle: http://support.attachmate.com/programs/lifecycle/version-status.html?extra
