This week's release brings you some new features that were still in development.
New Rights & Roles concept for WebAdmin
Until now the support for different user roles in WebAdmin was very rudimentary. We had Administrators, Auditors, and recently added Reviewers. We've replaced this with a more general approach that will scale better with new roles.
There is now a set of pre-defined "Rights", which each allow access to a part of the WebAdmin functionality. In 7.920, the available rights are:
- Log File Auditor - Allows reading all logfiles
- Report Auditor - Allows reading all reports
(together these give the rights Auditors have) - Read-Only Access - Read-only access to whole configuration
(gives the rights Reviewers have) - Network Security Manager - Write access to Network Security configuration
- Network Security Auditor - Read access to Net Security configuration
- Mail Security Manager - Write access to Mail Security configuration
- Mail Manager - Allows to access the Mail Manager
- Mail Security Auditor - Read access to Mail Security configuration
- Web Security Manager - Write access to Web Security configuration
- Web Security Auditor - Read access to Web Security configuration
- Remote Access Manager - Write access to VPN configuration
- Remote Access Auditor - Read access to VPN configuration
Under Managment >> WebAdmin Settings >> Access Control you can combine arbitrary sets of rights to "Roles" and assign the roles to users. The old Auditor and Reviewer roles are pre-defined as mentioned above.
Note that the Administrator role is not expressed in terms of rights, since it has a superset of the available rights. The form to make users administrators can be found at Managment >> WebAdmin Settings >> General now.
WAF Reporting
The Web Application Firewall now has reporting. The data can be found at Reporting >> Web Application Firewall.
URL Hardening for WAF
The firewall profiles at Web Application Security >> Web Application Firewall >> Firewall Profiles have a new option: URL Hardening. This is a feature similar to Cookie Signing. All local URLs in webpages delivered to the client are altered to contain a signature generated from the URL and a secret key. You can define a list of Entry URLs that clients will be allowed to access without such a signature. Entry URLs need to be given as absolute URLs (i.e. http://domain.example.com/home/ and need to match the full URL.
This feature allows you to control that people can't access unknown non-referenced URLs. But of course it might cause problems for other people that link to the protected site (they need to include the signature in the link or the page needs to be listed in the entry URLs).
Web Server discovery for WAF
Let the ASG find your web servers: At Web Application Security >> Web Application Firewall >> Real Web Servers there is now a new button Discover Web Servers. If you click it, a network scanner will be started in the background that will search your network for web servers (defined as hosts that listen on TCP port 80 or 443). For all web servers found a Real Web Server object will be created. The network scanner will add a comment containing the MAC address of the server, the vendor of the network card (determined from the MAC address) and a guess about the operating system used on the server. This might be helpful to identify the servers.
Hosts for which a network host object already exists will be skipped.
This feature is probably not final since there are still some practical problems with it. Like the fact that in many networks the list of web servers found is huge but most of them are definitely not interesting to anyone. Also the scanning can take several minutes while currently there is no progress visible in WebAdmin.
RED support
Support for the new RED product (See Astaro RED) was added to V8. Functionality should be equivalent to V7.
IPv6 support for transparent HTTP proxy
The HTTP proxy transparent mode now works with IPv6, too. Note that while there is no visible change in the GUI, this is a pretty invasive change in the backend and if there are any problems they might affect IPv4, too.
Restricted customization capabilities for Home-Users
The restriction of customization options for Home-Use license users added in V7.505 (See Astaro Up2Date Announcements: Up2Date 7.505 Released) was added in V8, too. Since there are no Home-Use licenses for V8 currently, this shouldn't affect anyone, yet.
Fixed Issues
- [12283] [UBB][7.851] Bandwith monitor Byte counter is confused
- [12498] [UBB][7.865] Improve Email profile configuration
- [13101] No IPv6 Transparent mode support in HTTP Proxy
- [13644] [UBB][7.910]HTTP-Proxy misses GeoIP integration
- [13652] [UBB][7.910]Snort ID 16460 false alerts
- [13664] [UBB][7.910]Missing WAF attacks counter in dashboard
- [13667] [UBB][7.910] WAF requests counter in dashboard does not work
- [13710] [UBB][7.911]IPS exits after config change
- [13716] [UBB][7.911]snort false positive for astaro.org forums
- [13718] [UBB][7.911]Win2008 joining domain issues
- [13719] [UBB][7.911]snort false positive on Rule 16460
- [13736] [UBB][7.911]log message "rule not registered properly"
- [13800] [UBB][7.911]permissions error in run_factory_reset.sh
- [13805] [UBB][7.911]mdw-error: Extra policy on NAT rule
- [13809] [UBB][7.912] ioctl32: Unknown cmd on /root/proc
- [13814] [UBB][7.912]SIP Helper stopped working after update
- [13846] [UBB][7.912]Reporting/blocked usage broken
- [13926] [UBB][7.912]FATAL ERROR: /etc/snort/rules/astaro.rules
Download Information
ASG ISO for Software/Virtual appliance installation:
ftp://ftp.astaro.de/pub/ASG/v8/beta/asg-7.920-10.1.iso
ISO size................: 352M (368584704 bytes)
ISO md5sum..............: 2f731689f37e368403477636642c0145
ISO sha1sum.............: eac230b8cfce0657902575cd98cd52435fc1e2e2
SSI ISO for Hardware appliance installation:
ftp://ftp.astaro.de/pub/ASG/v8/beta/ssi-7.920-10.1.iso
ISO size................: 361M (378836992 bytes)
ISO md5sum..............: 78be3caa80af630afc0ea80f9f86aa89
ISO sha1sum.............: c88f05b0981208348518403e45b61c3c046a0ff0
Up2Date package:
ftp://ftp.astaro.de/pub/ASG/v8/beta/u2d-sys-7.912-920.tgz.gpg
U2D size................: 120M (126108332 bytes)
U2D md5sum..............: 2f1665e9fc5ad1508c60f750874455de
U2D sha1sum.............: f3115473fa1344726361f0f6dfe8fb6184c44925
Updated Up2date package, which contains fixes for the IPS problems
Please note that the Up2date package will also be distributed over the
Up2Date server, so your ASG should usually download the package by itself.