Thema: SSH/SSL/VPN Tools...

[SiLæncer]

PuTTYTabManager is a handy application that allows you to run multiple PuTTY applications using a single GUI. The application support all the PuTTY protocols, such as SSH, Telnet, Rlogin and Raw.

The tab-based interface makes the application very easy to use, enabling you to manage multiple PuTTY sessions at the same time. Instead of opening multiple PuTTY windows, simply open PuTTYTabManager and initiate every session in a new tab.

Freeware

Whats new: >>

New features:

PuTTY command line (-a )
Auto login (SSH protocol.)
Portable mode

https://sites.google.com/site/macdsite/utilidades/puttytabmanager

[SiLæncer]

Whats new:>>

* New features

  - Warnings are logged on potentially insecure authentication.

* Bugfixes

  - Fixed handling of trailing whitespaces in the Content-Length
    header of the NTLM authentication.

https://www.stunnel.org/index.html

[SiLæncer]

Whats new:>>

* New features

  - Log file is reopened every 24 hours.  With "log = overwrite"
    this feature can be used to prevent filling up disk space.
  - Temporary DH parameters are refreshed every 24 hours, unless
    static DH parameters were provided in the certificate file.
  - Unique initial DH parameters are distributed with each release.
  - Improved compatibility with the current OpenSSL 1.1.0-dev tree:
    removed RLE compression support, etc.

https://www.stunnel.org/index.html

[SiLæncer]

Whats new:>>

ZModem patch is back

http://www.9bis.net/kitty/?page=Welcome&zone=en

[SiLæncer]

Whats new:>>

* New features
  - Added "include" configuration file option to include all
    configuration file parts located in a specified directory.
  - Updated stunnel.spec (thx to Bill Quayle).

* Bugfixes

  - Fixed --sysconfdir and --localstatedir handling (thx to
    Dagobert Michelsen).

https://www.stunnel.org/index.html

[SiLæncer]

Changelog

Alexander Pyhalov (1):
      Default gateway can't be determined on illumos/Solaris platforms

Arne Schwabe (1):
      Warn that tls-auth with free form files is going to be removed from OpenVPN 2.4

David Sommerseth (6):
      autotools: Fix wrong ./configure help screen default values
      down-root plugin: Replaced system() calls with execve()
      down-root: Improve error messages
      plugin, down-root: Fix compiler warnings
      sockets: Remove the limitation of --tcp-nodelay to be server-only
      plugins, down-root: Code style clean-up

David Woodhouse (2):
      pkcs11: Load p11-kit-proxy.so module by default
      Make 'provider' option to --show-pkcs11-ids optional where p11-kit is present

Felix Janda (1):
      Use OPENVPN_ETH_P_* so that <netinet/if_ether.h> is unecessary

Gert Doering (18):
      New approach to handle peer-id related changes to link-mtu (2.3 version)
      Fix incorrect use of get_ipv6_addr() for iroute options.
      Print helpful error message on --mktun/--rmtun if not available.
      explain effect of --topology subnet on --ifconfig
      Add note about file permissions and --crl-verify to manpage.
      repair --dev null breakage caused by db950be85d37
      assume res_init() is always there.
      Correct note about DNS randomization in openvpn.8
      Disallow usage of --server-poll-timeout in --secret key mode.
      slightly enhance documentation about --cipher
      Enforce "serial-tests" behaviour for tests/Makefile
      Revert "Enforce "serial-tests" behaviour for tests/Makefile"
      On signal reception, return EAI_SYSTEM from openvpn_getaddrinfo().
      Use configure.ac hack to apply serial_test AM option only if supported.
      Use EAI_AGAIN instead of EAI_SYSTEM for openvpn_getaddrinfo().
      Move res_init() call to inner openvpn_getaddrinfo() loop
      Fix FreeBSD ifconfig for topology subnet tunnels.
      Preparing for release v2.3.7 (ChangeLog, version.m4)

Guy Yur (1):
      Fix --redirect-private in --dev tap mode.

Jan Just Keijser (1):
      include ifconfig_ environment variables in --up-restart env set

Jonathan K. Bullard (1):
      Fix null pointer dereference in options.c

Lev Stipakov (1):
      Fix mssfix default value in connection_list context

Matthias Andree (1):
      Manual page update for Re-enabled TLS version negotiation.

Mike Gilbert (1):
      Include systemd units in the source tarball (make dist)

Robert Fischer (1):
      Updated manpage for --rport and --lport

Samuli Seppänen (2):
      Properly escape dashes on the man-page
      Improve documentation in --script-security section of the man-page

Steffan Karger (14):
      Really fix '--cipher none' regression
      Update doxygen (a bit)
      Set tls-version-max to 1.1 if cryptoapicert is used
      Account for peer-id in frame size calculation
      Disable SSL compression
      Fix frame size calculation for non-CBC modes.
      Allow for CN/username of 64 characters (fixes off-by-one)
      Remove unneeded parameter 'first_time' from possibly_become_daemon()
      Re-enable TLS version negotiation by default
      Remove size limit for files inlined in config
      Improve --tls-cipher and --show-tls man page description
      Re-read auth-user-pass file on (re)connect if required
      Clarify --capath option in manpage
      Call daemon() before initializing crypto library

[close]

http://openvpn.net/

[SiLæncer]

Sicherheitsupdates für die Krypto-Bibliothek stopfen eine Reihe von Löchern. Darunter befindet sich auch die Logjam-Lücke, die Angriffe auf den Diffie-Hellman-Schlüsselaustausch erlaubt.

Die Entwickler der beliebten Krypto-Bibliothek OpenSSL haben mit einem neuen Release insgesamt sieben verschiedene Sicherheitslücken in ihrer Software gestopft. Eine davon ermöglichte einen Logjam-Angriff auf OpenSSL und damit eine Zurückstufung des Diffie-Hellman-Schlüsselaustausches auf ein unsicheres Niveau durch einen Man-in-the-Middle. Die neuen OpenSSL-Versionen verhindern dies, indem sie Diffie-Hellman mit 768 Bit voraussetzen. In einer späteren Version der Software soll dies dann noch einmal auf 1024 Bit erhöht werden, um wirklich auf Nummer Sicher zu gehen.

Die übrigen sechs Lücken sind unkritischer und werden von den Entwicklern als moderates oder niedriges Risiko eingeschätzt. Dabei handelte es sich überwiegend über Speicherverarbeitungsprobleme, die zu einem Absturz der Software führen können – eventuell wäre in einigen Fällen dann auch das Ausführen von Schadcode möglich. Außerdem wurden mehrere Probleme behoben, durch die ein Angreifer den OpenSSL-Prozess blockieren kann, so dass dieser nicht mehr ansprechbar ist.

Die neuen OpenSSL-Versionen können von der Webseite des Projektes heruntergeladen werden. Je nach eingesetztem Entwicklungszweig sollten Admins ihre Systeme auf OpenSSL 1.0.2b, 1.0.1n, 1.0.0s oder 0.9.8zg aktualisieren.

Quelle : www.heise.de

[SiLæncer]

Whats new:>>

* New features

  - OpenSSL DLLs updated to version 1.0.2c.

* Bugfixes

  - Cron thread priority on Win32 platform changed to
    THREAD_PRIORITY_LOWEST to improve portability.
  - Makefile bugfixes for stunnel 5.18 regressions.

https://www.stunnel.org/index.html

[SiLæncer]

Whats new:>>

bug fix: crashes when using ssh tunnels with the ZModem patch KiTTY version
bug fix: remove unwanted characters in CTRL+TAB feature

http://www.9bis.net/kitty/?page=Welcome&zone=en

[SiLæncer]

Whats new: >>

This new version features a greatly improved CLI (command-line interface) and several stability-related fixes to cope better with parallel password-harvesting attacks.

http://www.extenua.com/silvershield

[SiLæncer]

Changelog

* New features
  - Service name included in insecure authentication warnings.
  - Include debugging symbols in the Win32 installer.
* Bugfixes
  - Signal pipe reinitalization added to prevent turning the main
    accepting thread into a busy wait loop when an external
    condition causes breaks the the signal pipe.
  - Generated temporary DH parameters are used for configuration
    reload instead of the static defaults.

[close]

https://www.stunnel.org/index.html

[SiLæncer]

SmarTTY is an SSH client for Windows that supports multiple tabs, transferring files and entire directories via SCP and on-the-fly tar, automatic public key authentication setup, seamless X11 forwarding any many more features.

Freeware

http://smartty.sysprogs.com/

[SiLæncer]

Changelog

New features

    Xcode SDK is automatically used on MacOS X if no other locally installed OpenSSL directory is found.
    Warnings about insecure authentication were modified to include the name of the affected service section.
    A warning was added to stunnel.init if no pid file was specified in the configuration file (thx to Peter Pentchev).
    Debugging symbols are included in the Win32 installer.

Bugfixes

    Signal pipe reinitialization added to prevent turning the main accepting thread into a busy wait loop when an external condition breaks the signal pipe. This bug was found to surface on Win32, but other platforms may also be affected.
    Fixed removing the disabled taskbar icon.
    Generated temporary DH parameters are used for configuration reload instead of the static defaults.
    LSB compatibility fixes added to the stunnel.init script (thx to Peter Pentchev).
    Fixed the manual page headers (thx to Gleydson Soares).

[close]

https://www.stunnel.org/index.html

[SiLæncer]

Whats new: >>

This will be a bug-fix release: it will not contain the various new cryptographic features in the development snapshots, but it will contain large and small bug fixes over 0.64, including in particular a fix for the recent Vista-specific bug in which the configuration dialog becomes invisible.

http://www.chiark.greenend.org.uk/~sgtatham/putty/

[SiLæncer]

Am Donnerstag will das OpenSSL-Team eine Sicherheitslücke beseitigen.

Mit einer kurzen Notiz verkündet Mark J. Cox, dass man Donnerstag, den 9. Juli, ein Sicherheits-Update für OpenSSL veröffentlichen wolle. Dies sei der höchsten Sicherheitsstufe zuzurechnen (high). Das bedeutet, dass gängige Konfigurationen betroffen sind und die Lücke sich wahrscheinlich ausnutzen lässt, um Denial-of-Service-Angriffe durchzuführen, Daten zu klauen oder sogar betroffene System zu kapern.

Die Lücke betrifft die OpenSSL-Versionen 1.0.2 und 1.0.1; die ebenfalls noch unterstützten und verbreiteten Vorgänger OpenSSL 0.9.8 und 1.0.0 sind offenbar nicht anfällig. Weitere Angaben zur Natur der Schwachstelle macht das OpenSSL-Team nicht. Allerdings gehören solche Vorab-Warnungen nicht zur normalen Vorgehensweise; in der Vergangenheit bedeuteten sie in der Regel tatsächlich, dass etwas Größeres bevorsteht. Insbesondere Server-Admins sollten sich den Termin also vormerken.

Quelle : www.heise.de