Technical Notes

    日本語 Features Introduced in Reflection for Secure IT UNIX Client and Server 7.1 and Release Notes
Technical Note 2414
Last Reviewed 02-Apr-2009
Applies To
Reflection for Secure IT UNIX Client version 7.1
Reflection for Secure IT UNIX Server version 7.1
Summary

This technical note outlines the new features available in the Reflection for Secure IT UNIX Client and Server 7.1 release, as well as product release notes.

Note: Reflection for Secure IT version 8.0 is available beginning in November 2012. For a list of new features in 8.0, see Technical Note 2641.

This note includes the following information:

Reflection for Secure IT UNIX Client and Server 7.1 New Features

The following list of features is available in both the UNIX Client and UNIX Server 7.1 release:

• Centralized Public Key Infrastructure (PKI) support enables you to centrally administer PKI functions, such as root certificate trust anchors, certificate stores, certificate revocation checking, certificate mapping, and audit logging for multiple servers.

• Customizable installation locations in Solaris and Linux support your organizational conventions for where applications are installed.
• Migration support leverages server, client, host, and user configuration files from prior versions of Reflection for Secure IT.
• Granular control over IP address family manages whether connections are supported with an IPv6 address family, an IPv4 address family, or both.
• Enhanced X.509 certificate utility (ssh-certview) obtains useful information from X.509 certificates, PKCS#7, and PKCS#12 files.
• AIX 6.1 on POWER support enables you to run Reflection for Secure IT on newer versions of AIX.
• Red Hat Enterprise Linux 5 on Itanium support enables you to run Reflection for Secure IT on newer versions of RHEL on the Itanium architecture.
• Arcfour128 and arcfour256 support leverages newer and stronger encryption algorithms.

Client New Feature

• Support for PKCS#11 smart cards in Solaris 10 SPARC uses smart cards for public key authentication.

Server New Features

• Granular file transfer permissions enable you to decide at a global, host, group, and user level, whether users will be able to upload, download, browse, delete, or rename files and directories.
• Enhanced file transfer logging improves troubleshooting and server monitoring with granular logging for events including login/logout, directory listings, uploads, downloads, and modifications.
• Configurable pre-authenticated session limits reduce exposure to brute force dictionary attacks by limiting the number of concurrent sessions that can be in an unauthenticated state.
• User shell inheritance control leverages centrally-administered directory services to deliver a shell environment to interactive user sessions.
• Sun Solaris Least Privilege Model support allows more fine-grained control of privileges in Sun Solaris without giving out the root user account.

Reflection for Secure IT UNIX Client and Server 7.1 Additional Features

In addition to the new features introduced in this release, 7.1 also includes many features that 6.x users are familiar with:

• File transfer resume restarts interrupted scp and sftp file transfers.
• SFTP and SCP2 Smart Copy saves time and bandwidth by eliminating the redundant transfer of identical files.
• FTP auto-forwarding enables you to securely use FTP-based scripts over a secure SSH tunnel without having to manually manage forwarding ports.
• RADIUS authentication authenticates users through a RADIUS server.
• Certificate-based client and server authentication (PKI support) integrates Reflection for Secure IT servers into your Public Key Infrastructure (PKI).
• Ssh-certtool utility enables you to create a PKCS#10 certificate request or to create a PKCS#12 package containing a private key and one or more certificates.
• MD5 signature rejection improves encryption strength by eliminating the use of MD5 hashed signatures.
• HMAC-sha256/sha512 MAC Algorithms use a strong, non-MD5 MAC algorithm.
• zLinux support with Red Hat Enterprise Linux 4 on System z 64-bit supports zLinux running 64-bit RHEL 4.
• zLinux support with SUSE Linux Enterprise Server 9 on System z 32-bit supports zLinux running 32-bit SLES 9.

Client Additional Features

• Command-line option for scp batch mode enables you to run unattended scp scripts.
• Automatic ASCII mode configuration associates specific file extension types to ASCII transfer mode, eliminating the need to explicitly specify ASCII mode in the transfer.
• Background forwarding ports with "one-shot" mode support uses scripts over a secure SSH tunnel.
• Sessionless secure channel support establishes listening ports for forwarding without the overhead of an associated shell environment.
• HostCertNameCheck keyword supports specifying whether the hostname should match the common name (CN) or Subject Alternative Name (SAN) field in the host certificate.
• Allow-from and deny-from forced commands can be specified in the authorization file.
• Authentication Agent supports the ability to add certificates.

Server Additional Features

• Default file permissions for SFTP transfers avoid the manual step of setting file permissions following a transfer.
• LogCertificateSubject keyword supports specifying whether the Serial Number and Subject of certificates used for authentication are logged to the system log.
• Message of the Day control defines whether or not the server displays the Message of the Day.
• Automatic home directory generation enables you to leverage LDAP user directories to support first-time logins to the server.

Release Notes

The following known issues have been found in the Reflection for Secure IT UNIX Client and Server 7.1.

Default XAuthPath Must Be Edited in Config Files Before Using X11

Symptom

When attempting to run an X application or session over an ssh connection, the connection fails with a "Can't open display" error message.

Solution

1. Locate the xauth program, which is usually found in the user's path.
2. Update your global configuration files (/etc/ssh2/ssh2_config and /etc/ssh2/sshd2_config, if present) with the absolute path to the xauth program, for example:

Reflection PKI Services Manager Does Not Automatically Shut Down or Start Up

After installing and starting Reflection PKI Services Manager, if the host system is restarted or rebooted, the PKI Manager does not automatically shut down or automatically restart when the system comes back up. See Technical Note 2424 for information about configuring your system's environment to start and stop the PKI Manager.

Obtaining Your Product Upgrade

Maintained customers are eligible to download the latest product releases from the Attachmate Download Library web site: https://download.attachmate.com/Upgrades/.

You will be prompted to login and accept the Software License Agreement before you can select and download a file. For more information on using the Download Library web site, see Technical Note 0200.

For information about purchasing Reflection for Secure IT, please e-mail us: SalesRecept@attachmate.com.

Replacing Your Current SSH Product

For information about replacing your current SSH product with Reflection for Secure IT UNIX Client or Server version 7.1, see Technical Note 2282.

Supported Platforms

For information about Reflection for Secure IT supported platforms, see Technical Note 1944.

Installing Reflection for Secure IT UNIX Client and Server 7.1

For information about installing Reflection, see the Installation topic in the User Guide, which is available from the documentation page, http://support.attachmate.com/manuals/rsit_unix.html.

Related Technical Notes

0200	Using the Attachmate Download Library (FAQ)
1944	Reflection for Secure IT Client and Server Supported Platforms
2282	Replace an Existing Secure Shell Program with Reflection for Secure IT UNIX Client or Server 7.0 or Higher
2340	Upgrading Reflection for Secure IT from an Evaluation Copy to a Licensed Copy
2424	Reflection PKI Services Manager 1.0 Does Not Automatically Shut Down or Start Up
2425	Reflection PKI Services Manager Overview
2519	Features Introduced in Reflection for Secure IT UNIX Client and Server 7.2 and Release Notes
2565	Reflection for Secure IT UNIX Client and Server 7.2 Service Pack 1 Update 1 - Features and Release Notes
2641	Reflection for Secure IT 8.0 Client and Server for UNIX New Features and Release Notes