VMWARE released vSphere 6.7, getting a lot of new functions and improvements, this also gives us a new vCenter Server Appliance.

In many smaller setups, we run what is called and embedded appliance, where all vSphere vCenter Server funtionalites coexist on one single VM, this is VMWARE’s guide how to upgrade and embedded appliance

https://vspherecentral.vmware.com/t/vcenter-server/vcenter-lifecycle-install-upgrade-and-migrate-3/upgrading-vcenter-server-6-5-to-vcenter-server-6-7/

VMWARE’s blog post, about 6.7:

https://blogs.vmware.com/vsphere/2018/04/introducing-vmware-vsphere-6-7.html

For thoose who had not had the time to get to know Azure Storage Explorer (ASE) yet, this may help people get on their way.

When you create Storage Accounts in Azure and thereafter  want to have in ex. a BLOB (Binary Large OBjects) and have created a container for this, you are ready to go

You can download Storage Explorer here: https://azure.microsoft.com/en-us/features/storage-explorer/

Install it, it’s just plain “next next next” and when you see this, it’s installed:

Go ahead and launch it:

For this demo we will use a connection string, but there are several other methods to connect to it, so let’s head over to the Azure Portal:

So we head over to our Storage Account –> Settings –> Access keys, here we copy-paste the Connection String from “key1” (Sorry for masking so much )

press Next:

Press “Connect”:

And now we’re in!

From here, you can see all allocated storage, on that Storage Account you created, you can upload files and folders, manage access policies, set public access level and much much more.

It’s a must-have tool, when you work with storage accounts in Azure

Sophos has pushed a new update for SUM as GA today, it’s a minor fix, correcting theese problems:

Up2Date 4.308002 package description:

Remark:
System will be rebooted

News:
Maintenance Release

Bugfixes:
Fix [NSU-192]: [accd] Missing validation for URL Filtering Categories on empty Sub-Categories
Fix [NSU-270]: [gateway manager] Import of file extensions for a filter action fails on SUM

RPM packages contained:
ep-commandcenter-4.28-1977.gd22b763.i686.rpm
ep-webadmin-4.28-1977.gd22b763.i686.rpm
u2d-tib-9-15578.i686.rpm
ep-release-4.308-2.noarch.rpm

Maybe you have heard of the great monitoring tool, called PHP Server Monitor, it’s a great FREE tool to monitor your services from the outside, requirements are simple:

• PHP 5.3.7+
• PHP packages: cURL, MySQL
• MySQL Database

And it can be downloaded here: https://github.com/phpservermon/phpservermon/releases/latest

Well where does the free Azure part come in?

Azure uses serviceplans, and one of the is free:

App Service Plans | Microsoft Azure

This free plan, can be used with a WebApp, so let get thing done in Azure:

Login to the Azure Portal and choose to create a new WebApp:

The App name you chosse, will be the URL for your free website, so choose wisely, it will tell you, if the name you try to pick, is occupied:

Then click “App service plan/location” and choose “Create New”

Fill in the name and click “Pricing Tier”

Choose the free plan “F1” and click Apply.

Click “OK”

Click “Create” and wait for Azure to deploy the new site.
(Remember only Windows can run on the free plan, not Linux, but PHP is still supported!)

Check if things are working:

Open browser and ty pe the URL you just made:

Then go and add free SSL to your site with redirect and TLS 1.2:

No need to press save or OK, its done automatically.

Now we need to setup FTP access:

Fill in the fields and press save, head to the “overview” pane, left side:

Here you have the infos.

Connect to to the FTP site with your favorite FTP client and upload to the wwwroot (/site/wwwroot) directory, the files you downloaded from PHP Server Monitor (extracted).

Next, as PHP Server Monitor use MySQL, we will enable the In the portal:

Press “ON” and “MySQL general log ON” and SAVE and you have MySQL features

Now comes the tricky part, Azure do no provide direct access for MySQL, and furthermore, they use a non standard MYSQL port, so we need to fetch theese informations from Azure, this can be done by modifying the config.php of PSM to the following:

<?php
$servername = "";
$username = "";
$password = "";
$dbname = "";

// Parsing connnection string
foreach ($_SERVER as $key => $value) {
if (strpos($key, "MYSQLCONNSTR_") !== 0) {
continue;
}

$servername = preg_replace("/^.*Data Source=(.+?);.*$/", "\\1", $value);
$dbname = preg_replace("/^.*Database=(.+?);.*$/", "\\1", $value);
$username = preg_replace("/^.*User Id=(.+?);.*$/", "\\1", $value);
$password = preg_replace("/^.*Password=(.+?)$/", "\\1", $value);
}

define('PSM_DB_PREFIX', 'monitor_');
define('PSM_DB_USER', $username);
define('PSM_DB_PASS', $password);
define('PSM_DB_NAME', $dbname);
define('PSM_DB_HOST', $servername);
define('PSM_DB_PORT', '');
define('PSM_BASE_URL', '');

define('PSM_DEBUG', false);

// IP addresses that may run the CRON
$PSM_CRON_ALLOW = array("xxx.xxx.xxx.xxx","yyy.yyy.yyy.yyy");

The custom MySQL port number, will be delivered in the $servername in the format “hostname:port” so when port changes your system will auto-adapt, therefore is PSM_DB_PORT blank thus needed to be stated for PSM, else it will not work

Go ahead and test it out, visit:

https://yourname.azurewebsites.net/install.php

You should see this:

Press “Let’s go”

After you have typed the credentials you want to use with PSM, you should see this.

Continue the setup, login to the portal and you get this page:

So now PSM is working……..not quite!

We need to setup a cron job! Else nothing will run and check your monitored systems!

There is Azure Webjobs, who actually can do this, you can also set it up, it works, but efter some hours, it’s stopping, claiming that your website have to have “Always-on” enabled for Webjobs to run, hey, let’s go and enable Always-On:

Dammit, that’s not supported in the Free Service Plan, why aren’t whole Azure free

So what to do now, we need something to visit this URL every 5 minutes:

https://yourname.azurewebsites.net/cron/status.cron.php

I have searched the net, you can run it locally, but when your net goes down, nothin would activate the poller, so i found this one, which is ALSO free

https://cron-job.org/

Go create an account and set it up:

But as we not want everyone to activate our cron, remember the settings in config.php?

// IP addresses that may run the CRON
$PSM_CRON_ALLOW = array(“xxx.xxx.xxx.xxx”,”yyy.yyy.yyy.yyy”);

Go to https://cron-job.org/en/faq/

Here we find this:

So add this IP to your CRON statement in config.php.

Remember, PSM will throw this error message at you, if the IP received is wrong :

But this is to get rid of bots, “hackers” a.s.o.

Check the logs at cron-job for it:

All is good

Now go into PSM and setup the servers / services you want to monitor and choose your notification services (email, sms and pushover)

test it out, if it works now, you are all done and have a nice and free monitor solution….running in AZURE

Veeam has released Update3a for Backup and Replication 9.5, see more here:

Challenge

Cause

Please confirm that you are running version 9.5.0.580, 9.5.0.711, 9.5.0.802, 9.5.0.823, 9.5.0.1038, 9.5.0.1335 or 9.5.0.1536 prior to installing this update. You can check this under Help | About in Veeam Backup & Replication console. After upgrading, your build number will be 9.5.0.1922.
To upgrade from 9.0 or earlier version, download version 9.5 ISO image, and consult the User Guide’s upgrade section.

Solution

As the result of an on-going R&D effort, and in response to customer feedback, Veeam Backup & Replication 9.5 Update 3a features a large number of enhancements, the most significant of which are listed below.

Platform support

• VMware vSphere 6.7. Includes the new HTML5 version of vSphere Web Client plug-in for Veeam Backup & Replication, and asynchronous NBD/NBDSSL support for improved read performance of network transport mode with ESXi 6.7.
• VMware vSphere 6.5 U2. This update introduces preliminary support by addressing all outstanding U2-specific compatibility issues that can be managed from the Veeam side. However, there is a major regression in ESXi 6.5 U2 code that makes the vSphere API fail randomly during high host CPU load periods, consequently impacting a variety of Veeam Backup & Replication functionality. VMware is currently troubleshooting this bug, and fixing one will most likely require the new ESXi 6.5 U2 build issued.
• VMware vCloud Director 9.1. Update 3a provides full compatibility for all existing vCloud Director integration functionality.
• VMware Cloud on AWS version 1.3 support and preliminary out-of-the-box compatibility with future VMC updates through removal of the API version match requirement. Additionally, support for processing virtual machines with dynamic disks has been added.
• Microsoft Windows 10 April 2018 Update. Includes support as guest virtual machines and for installation of Veeam Backup & Replication and all of its components.
• Microsoft Windows Server 1803. Update 3a provides Windows Server 1803 support as guest virtual machines, for installation of Veeam Backup & Replication remote components, and as a domain controller for Veeam Explorer for Microsoft Active Directory.
• Microsoft Windows Server Hyper-V 1803. Update 3a provides Hyper-V 1803 support as a hypervisor host, including support for processing VMs with virtual hardware version 8.3.
• Microsoft System Center Virtual Machine Manager 1801. Update 3a adds SCVMM 1801 support as a source for Microsoft Hyper-V VMs backup jobs.

VMware vSphere

• Performance of Direct Storage Access (DirectSAN) and Virtual Appliance (Hot Add) transport modes has been improved for backup infrastructure configurations through optimizing system memory interaction.

Microsoft Azure

• Added support for Direct Restore to Microsoft Azure for environments with ExpressRoute or site-to-site VPN connectivity to Azure, in which case proxy and helper appliances may have private IP addresses only. To enable, create AzurePreferPrivateIpAddressesForProxyandLinuxAppliance (DWORD, 1) registry value under HKLM\SOFTWARE\Veeam\Veeam Backup and Replication key on the backup server.

Linux File Level Recovery

• Added support for Linux SUID and SGID preservation to “Copy To” operation.
• Added support for Btrfs volumes located on an LVM volume.

Primary Storage Integrations

• Installing Universal Storage API plug-ins on each backup console (in addition to the backup server) is no longer required.
• Storage snapshot-only vCloud Director backup jobs are now supported for all storage integrations which support storage snapshot-only jobs. Previously, it was supported for NetApp only.
• Cisco HyperFlex integration will no longer delete the base sentinel snapshot during each job run to improve processing performance and reduce storage load.

Tape

• Improved performance of enumeration in File to Tape jobs with very large number of files.

Veeam Cloud & Service Provider partners
Veeam Backup & Replication 9.5 Update 3a also includes enhancements and bug fixes for service providers offering Veeam Cloud Connect services, and managing backup servers with Veeam Availability Console. For the full change log, please see this topic on the private Veeam Cloud & Service Provider (VCSP) forum. Not a member of the VCSP forum? Click here to join.

Update 3a also resolves the following common support issues:

• User interface performance has been improved for large environments, including faster VM search and lower CPU consumption while browsing through job sessions history.
• Restores through Direct NFS transport should no longer produce corrupted VMDKs on storage devices with advanced NFS server implementations.
• VeeamZIP operations should no longer consume a license.
• Backup copy job should no longer trigger health checks outside of the scheduled start time when GFS retention is in use, and will behave more reliably in a few corner cases.
• Incremental backup runs should no longer keep setting ctkEnabled VM setting to “true”, resulting in unwanted events logged by vCenter Server.
• SATA X:7 disks should no longer be skipped with backup jobs by default.
• Windows file level recovery (FLR) should now process large numbers of NTFS reparse points faster and more reliably.
• Linux FLR should now correctly process directories with . and \ symbols in their names. In addition, encountering a named pipe object should no longer cause FLR to hang.
• Direct Restore to Microsoft Azure should now process Linux machines with EFI boot more reliably.
• Veeam Agent for Microsoft Windows’ jobs should no longer fail when the backup server uses custom certificate.
• Veeam Explorer for Storage Snapshots now supports VMs located on LUNs larger than 16TB.
• An HPE 3PAR integration should now handle large number of concurrent jobs more reliably, thanks to multiple improvements implemented based on support cases.
• An HPE StoreOnce Catalyst SDK host process will now be restarted automatically when a Catalyst API call hangs, preventing Veeam jobs from hanging as a result.
• IBM SVC integration should no longer fail at collecting iSCSI adapters.

https://www.veeam.com/kb2646

UPDATE: 20/7-2018: So far 9.510-4 breaks mailmanager and TLS when you use “Callout”, so you should wait for a fix

Sophos released a bigger maintenance update for the UTM yesterday, it’s a soft-release, so it has not been rolled out yet, you can download it from FTP:

ftp://ftp.astaro.com/UTM/v9/up2date/u2d-sys-9.509003-510004.tgz.gpg

Up2Date 9.510004 package description:

Remarks:
System will be rebooted
Configuration will be upgraded
Connected APs will perform firmware upgrade
Connected REDs will perform firmware upgrade

News:
Maintenance Release

Bugfixes:
Fix [NUTM-8273]: [Basesystem] Inconsistent reporting data in hot standby environment
Fix [NUTM-9089]: [Basesystem] ulogd restarting randomly
Fix [NUTM-9423]: [Basesystem] Missing DMI info or missing WiFi card should turn status LED red for desktop refresh models
Fix [NUTM-9516]: [Basesystem] CVE-2017-3145: BIND vulnerability
Fix [NUTM-9764]: [Basesystem] multiple NTP vulnerabilities
Fix [NUTM-9862]: [Basesystem] CVE-2018-8897: Don’t use IST entry for #BP stack
Fix [NUTM-9944]: [Basesystem] ‘ethtool -p’ is not working for shared port
Fix [NUTM-9945]: [Basesystem] SG/XG 125/135 upper 4 ports LEDs at front and rear side not behaving as expected
Fix [NUTM-9286]: [Email] CVE-2011-3389: SSL/TLS BEAST Vulnerability And Weak Algorithms
Fix [NUTM-9460]: [Email] Quarantine unscannable and encrypted content not working as expected
Fix [NUTM-9539]: [Email] SMTP callout with TLS does not work
Fix [NUTM-9627]: [Email] Parent proxy for WAF (ctipd) not applied without active e-mail subscription
Fix [NUTM-9771]: [Email] Redesign TFT detection to decrease false positives/negatives
Fix [NUTM-9836]: [Email] HSTS usage breaks Quarantine Report release link
Fix [NUTM-9789]: [Logging] Not able to archive logs using SMB share
Fix [NUTM-8969]: [Network] Inconsistent DHCP leases in WebAdmin
Fix [NUTM-9049]: [Network] Cannot change IPv4 interface as IPv6 gateway is required
Fix [NUTM-9194]: [Network] Static route switching to different VLAN
Fix [NUTM-9646]: [Network] eth0 is falsely marked “dead” when running “hs” on slave
Fix [NUTM-9739]: [Network] Network monitor restarting on slave nodes
Fix [NUTM-9795]: [RED] RED50 issue with large packets in Transparent/Split mode
Fix [NUTM-9607]: [Reporting] Upper case umlauts in PDF Executive Reports are not displayed correctly
Fix [NUTM-9624]: [Reporting] WAF – Top attackers won’t be displayed after upgrade to v9.5
Fix [NUTM-9719]: [SUM] Web Protection service shown as down in SUM
Fix [NUTM-9547]: [UI Framework] UserPortal does not correctly detect browser specified preferred language for Chinese Simplified
Fix [NUTM-9527]: [WAF] Fix mod_url_hardening stack corruption
Fix [NUTM-8038]: [WebAdmin] WebAdmin not available
Fix [NUTM-9232]: [WebAdmin] Sometimes ‘backend connection failed’ while login
Fix [NUTM-9529]: [WebAdmin] Role with ‘Web Protection Manager’ rights can’t access Aplication Control
Fix [NUTM-9689]: [WebAdmin] Report Auditor role is unable to open the dashboard
Fix [NUTM-5293]: [Web] Google is missed in the Search Engines reports
Fix [NUTM-6240]: [Web] FTP download through HTTP Proxy in standard mode not possible
Fix [NUTM-9039]: [Web] Connections may fail when using upstream proxies due to “Proxy-Connection” header being sent
Fix [NUTM-9399]: [Web] Classification for Windows Updates differs between AFC and conntrack
Fix [NUTM-9413]: [Web] Unable to upload certificate to “Local Verification CAs”
Fix [NUTM-9491]: [Web] HTTP Proxy coredumps with SIGABRT
Fix [NUTM-9549]: [Web] Proceeding after content warning results in display issues on redirected pages
Fix [NUTM-9599]: [Web] HTTP Proxy requests stuck without appropriate timeout
Fix [NUTM-9630]: [Web] Fallback log flooded with samlogon cache timeout messages
Fix [NUTM-9664]: [Web] Country blocking exception not working when HTTP Proxy is using SSO
Fix [NUTM-9720]: [Web] Can’t proceed content warning for MIME types if URL contains spaces
Fix [NUTM-9745]: [Web] HTTP Proxy coredumps with SIGSEGV
Fix [NUTM-7628]: [Wireless] Wireless clients frequently failing to connect with STA WPA failure reason code 2
Fix [NUTM-8946]: [Wireless] APs displayed as inactive in WebAdmin while clients can connect
Fix [NUTM-9591]: [Wireless] Both local WiFi using 2.4GHz band and same channel in default configuration
Fix [NUTM-9592]: [Wireless] Unable to broadcast same SSID on both LocalWifi0 and LocalWifi1
Fix [NUTM-9594]: [Wireless] Incorrect channel information showing on overview for LocalWifi
Fix [NUTM-9608]: [Wireless] Incorrect generic error message in WebAdmin while configuring band for wireless network
Fix [NUTM-9638]: [Wireless] Both local WiFi AP named ‘Local’
Fix [NUTM-9731]: [Wireless] Not able to configure channel 12 and 13 on newer desktop models
Fix [NUTM-9735]: [Wireless] Set default channel width to 40MHz for 5GHz band
Fix [NUTM-9737]: [Wireless] SGw appliances missing frequency definitions for Nigeria

RPM packages contained:
libsaviglue-9.50-31.g5e3c21d.rb5.i686.rpm
cm-nextgen-agent-9.50-16.gc08104a.rb5.i686.rpm
firmwares-bamboo-9400-0.293035296.g3733ac8.rb2.i586.rpm
hostapd-2.2-1.0.287145451.ga02be97.rb6.i686.rpm
modurlhardening-9.50-222.g4fa60fe.rb6.i686.rpm
perf-tools-3.12.74-0.292688430.ga5ef2ae.rb5.i686.rpm
red-firmware2-5125-0.282730588.g354eda3d8.rb7.noarch.rpm
red15-firmware-5125-0.282730547.g89c84b337.rb10.noarch.rpm
samba-4.6.8-4.gae6a03c.rb2.i686.rpm
ulogd-2.1.0-133.g0d89a85.rb5.i686.rpm
ep-reporting-9.50-54.g9e81107.rb4.i686.rpm
ep-reporting-c-9.50-151.g7de2457.rb3.i686.rpm
ep-reporting-resources-9.50-54.g9e81107.rb4.i686.rpm
ep-awed-9.50-58.g7de6526.rb5.i686.rpm
ep-branding-ASG-afg-9.50-78.gabee2c3.noarch.rpm
ep-branding-ASG-ang-9.50-78.gabee2c3.noarch.rpm
ep-branding-ASG-asg-9.50-78.gabee2c3.noarch.rpm
ep-branding-ASG-atg-9.50-78.gabee2c3.noarch.rpm
ep-branding-ASG-aug-9.50-78.gabee2c3.noarch.rpm
ep-confd-9.50-1822.g447351b3.i686.rpm
ep-ha-daemon-9.50-5.g7d07dcc.rb5.i686.rpm
ep-init-9.50-38.g352a07a.rb8.noarch.rpm
ep-libs-9.50-33.g690bd32.rb9.i686.rpm
ep-logging-9.50-18.g10653ef.rb3.i686.rpm
ep-mdw-9.50-1060.gc9c553bb.rb9.i686.rpm
ep-postgresql92-9.50-109.g359d1c5.rb8.i686.rpm
ep-postgresql92-64-9.50-109.g359d1c5.rb7.x86_64.rpm
ep-screenmgr-9.50-3.g07035cc.rb46.i686.rpm
ep-utm-watchdog-9.50-88.ge2d9ca8.rb2.i686.rpm
ep-webadmin-9.50-1412.g7a6726620.rb10.i686.rpm
ep-webadmin-contentmanager-9.50-84.g749571d.rb20.i686.rpm
ep-chroot-httpd-9.50-37.g1cad00c.rb4.noarch.rpm
ep-chroot-smtp-9.50-149.g1ad0a54.rb2.i686.rpm
chroot-bind-9.10.7-0.292458892.g9711d3a.rb2.i686.rpm
chroot-ntp-4.2.8p11-0.gc174a78.rb3.i686.rpm
ep-httpproxy-9.50-547.g1f8aab75.rb3.i686.rpm
kernel-smp-3.12.74-0.292688430.ga5ef2ae.rb5.i686.rpm
kernel-smp64-3.12.74-0.292688430.ga5ef2ae.rb5.x86_64.rpm
ep-release-9.510-4.noarch.rpm

As there have been som bugs in 9.510-4, Sophos released a minor bugfix update for theese:

Up2Date 9.510005 package description:

Remark:
System will be rebooted

News:
Hotfix Release

RPM packages contained:
ep-webadmin-9.50-1416.gb92b94217.i686.rpm
chroot-smtp-9.50-24.gb41bc0f8.rb3.i686.rpm
ep-release-9.510-5.noarch.rpm

It fixes this:

• NUTM-10124 [Email] TLS Errors – renegotiation not allowed
• NUTM-10118 [Reporting] Authenticated Remote Code Execution in WebAdmin
• Mailmanager bug

But as 9.510-4 is removed, please, if you have 9.509, go directly to 9.510-5:

http://ftp.astaro.de/UTM/v9/up2date/u2d-sys-9.509003-510005.tgz.gpg

For thoose who already are on 9.510-4:

http://ftp.astaro.de/UTM/v9/up2date/u2d-sys-9.510004-510005.tgz.gpg

Complete release notes:

UTM Up2Date 9.510 Released

Due to the latest updates from Microsoft, Azure AD Connect Health for Sync, somhow got “broken” giving headaches for the admins with this:

Microsoft.Online.Reporting.MonitoringAgent.Startup high cpu.

https://support.microsoft.com/da-dk/help/4346822/high-cpu-issue-in-azure-active-directory-connect-health-for-sync

Luckily the fix is simple – go install the LATEST AAD Connect tool, and you are good to go

https://www.microsoft.com/en-us/download/details.aspx?id=47594

Sophos Partner Portal just released the news about UTM 9.6 coming soon, sadly IKEv2 has been deferred from the 9.6, and maybe it will never arrive, because of the focus is mainly on XG Firewall now, but there are more great news in UTM 9.6:

Taken from: Sophos Partner Portal:

The team has been hard at work on the latest release for SG UTM. UTM 9.6 brings a number of your top requested features and a refreshed product roadmap for version 9.7, 9.8, and 9.9.

Here’s the full list of what’s new in UTM 9.6:

• Sandstorm: Reporting enhancements and manual file submission
• WAF: “Let’s Encrypt” certificate support and page customization enhancements
• RED: Unified firmware with 4G LTE support
• Email: Upgraded S/MIME email encryption
• ATP: New and improved Advanced Threat Protection engine

We expect to make the UTM 9.6 release available soon, so watch this space for further announcements. As with all major releases, it will be rolled out to customer systems through our Up2Date service in a staged release process over time.

Roadmap for UTM 9.7, 9.8, and 9.9
For those of you following our roadmap plans closely, you’ll notice that planning our UTM releases out to at least 9.9 is a major new commitment to you, our valued SG UTM partners, as well as to your customers. We want you to know that we are as committed to the SG UTM platform as you are. You may also notice that IKEv2 support did not make the cut for UTM 9.6. After our experience integrating this technology into our XG Firewall platform, we felt that it would unnecessarily delay the release of UTM 9.6, so we’ve deferred it for now and will evaluate it for inclusion in an upcoming release.

As always, your feedback on our roadmap is encouraged and appreciated, so please get in touch with us with your feedback and roadmap priorities via ideas.sophos.com.

Other current top considerations for future releases, based on your input, include email and data protection enhancements for GDPR, an enhanced RestAPI to retrieve status information, machine learning in the on-box antivirus engine and automated IP blacklisting for possible brute force attacks

When you are performing an upgrade from vCenter Server Appliance 6.5 to 6.7, you may see this, after you have filled out, all the details about the source server:

As you double check, you found out, that all infos you have typed, are correct! – But then, what could be wrong?!

Let’s check the suggested installer log:

2018-09-24T06:51:36.940Z – info: Stream :: close
2018-09-24T06:51:36.940Z – info: Password not expired
2018-09-24T06:51:36.943Z – error: sourcePrecheck: error in getting source Info: ServerFaultCode: Failed to authenticate with the guest operating system using the supplied credentials.
2018-09-24T06:51:36.944Z – info: VCHA is not enabled on the source host
2018-09-24T06:51:47.920Z – info: Log file was saved at: E:\installer-20180924-084442575.log

Okay so the password is not expired and it’s either wrong, so what else?

Let’s look at the appliance management page:

https://vcenter.domain.local:5480 –> Administration

Oooups! – And as it have already expired, we cannot change it from the web, so let’s head over for SSH:

Let’s try migrating again:

And we are ready to continue

What’s new in UTM 9.6?

• Let’s Encrypt Integration

  • Generate and renew Let’s Encyrpt certificates from within UTM
  • Generated certificates can be used in all UTM components

• WAF Page Customization

  • Custom themes for all error pages that are delivered by WAF
  • Allows to provide corporate identity on all pages

• Manual Sandstorm Submission

  • Allows an admin to upload a file for detonation within Sophos Sandstorm
  • Files that have not been received via email or web download can also be analyzed with Sophos Sandstorm

• Persistent Sandstorm Reports

  • Reporting for Sandstorm Activity over time and with historic information
  • Reporting also covering hash lookup based results from Sophos Sandstorm

• More Enhancements

  • Unified RED Firmware with better 3g/4g Support
  • Submission Port Support in SMTP Proxy
  • Configurable Listen Address in SMTP Proxy
  • New Advanced Thread Protection Library with better performance and protection

Issues Resolved

• NUTM-10130 [Access & Identity] Unable to connect RDP type bookmark with NLA
• NUTM-7418 [Access & Identity] SAA – Rename Client Auth CA
• NUTM-9843 [Access & Identity] HTML5 VPN portal connections periodically stop working until service is restarted
• NUTM-10080 [Basesystem] Update to latest Avira SAVAPI version
• NUTM-9681 [Email] cssd coredumps and root partition is filling up
• NUTM-9716 [Email] S/MIME encryption – automatic certificate extraction causing high load / no webadmin access
• NUTM-9733 [Email] Change default encryption algorithm to ‘smime’
• NUTM-9853 [Email] Fix policy traversal (for gpg, smime, unscanable)
• NUTM-9882 [Email] Umlauts in mail addresses get corrupted if SPX encryption is used
• NUTM-2791 [Network] Fix detection of sub applications in Application Control
• NUTM-4767 [Network] SSH for single host skipping AFC check
• NUTM-9462 [Network] Update to BIND 9.11 ESV
• NUTM-9026 [RED] TP-LINK MA260 dongle on RED doesn’t work anymore after update to v9.5
• NUTM-10066 [WAF] Existing certificate chain overrides after new certificate chain has been added
• NUTM-9809 [WAF] Potential memory allocation failure for “Rewrite HTML” + location with special characters

Known Issues

• NUTM-10227 [RED] Offline provisioning does not work
• NUTM-10188 [WebAdmin] OTP – QR code not visible for the first user login

Community forum:

https://community.sophos.com/products/unified-threat-management/unified-threat-management-beta/sophos-utm-9-6-beta/

Download beta:

http://ftp.astaro.com/UTM/v9/beta/u2d-sys-9.510005-570020.tgz.gpg

Sophos has released BETA2 for UTM 9.6:

UTM 9.6 Beta2 (9.580) Released

Fireware upgrade from BETA1:

http://ftp.astaro.de/UTM/v9/beta/u2d-sys-9.570020-580007.tgz.gpg

UTM 9.6 Beta Community:

https://community.sophos.com/products/unified-threat-management/unified-threat-management-beta/sophos-utm-9-6-beta/

If you want to try out XG 17.5 in beta(2), head for this:

https://community.sophos.com/products/xg-firewall/sophos-xg-beta-programs/sfos-v17-5-early-access/f/sophos-xg-17-5-early-access/108516/welcome-to-xg-firewall-v17-5-early-access

Release notes:

Sophos has released 9.6

No IKEv2 support this time, but a lot of other new and great features, especially Let’s encrypt integration

It’s being rolled out in phases as usual, so to get it right away, use the download links at the bottom.

Release notes from “https://community.sophos.com/products/unified-threat-management/b/utm-blog/posts/utm-up2date-9-600-released“:

Here’s what’s included in UTM 9.6

Let’s Encrypt integration

• Generate and renew Let’s Encrypt certificates from within the UTM
• Generated certificates can be used in all UTM components

Web Application Firewall (WAF) page customization

• Custom themes for all error pages that are delivered via the WAF
• Enables the use of a custom corporate identity on all pages

Manual Sandstorm submission

• Allows an admin to upload a file for detonation within Sophos Sandstorm
• Files that have not been received via email or web download can also be analyzed with Sophos Sandstorm

Persistent Sandstorm reports

• Enhanced reporting for Sandstorm activity over time and with historic information
• Reporting also covers hash lookup based results from Sophos Sandstorm

Other enhancements

• Unified RED firmware with improved 3G/4G support
• Submission port support in SMTP proxy
• Configurable listen address in SMTP proxy
• New advanced thread protection library with better performance and protection

The full release notes can be found on the Sophos Community.

Up2Date Information

Behavior Changes

After updating to UTM 9.6, the old content warn HTML template in HTTP Proxy will no longer function correctly. Please download the updated templates, customize them to your needs and re-upload to the UTM. For further details, please see KBA133167.

News

• Features Release
• .
• ATP: New Advanced Threat Protection Library with better performance and protection
• Certificates: Let’s Encrypt Integration
• RED: Unified RED Firmware with better 3G/4G Support
• Sandstorm: Manual File Submission
• Sandstorm: Persistent Reports
• SMTP Proxy: Submission Port Support
• SMTP Proxy: Configurable Listen Address
• WAF: Error Page Customization

Remarks

• System will be rebooted
• Configuration will be upgraded
• Connected REDs will perform firmware upgrade
• Connected Wifi APs will perform firmware upgrade

Bugfixes

• NUTM-10128 [Access & Identity] MDW waits hours for lock on shared cache with AUA
• NUTM-10130 [Access & Identity] Unable to connect RDP type bookmark with NLA
• NUTM-7418 [Access & Identity] SAA – Rename Client Auth CA
• NUTM-9368 [Access & Identity] SSL VPN: optional user auth not working
• NUTM-9525 [Access & Identity] Disk filling up with argos error messages in endpoint.log
• NUTM-9843 [Access & Identity] HTML5 VPN portal connections periodically stop working until service is restarted
• NUTM-10080 [Basesystem] Update to latest Avira SAVAPI version
• NUTM-10366 [Basesystem] Missing IP address in IPset of user network for STAS
• NUTM-9783 [Basesystem] IPsec routing issue if gateway interface has additional addresses
• NUTM-9810 [Basesystem] IPset Object takes 30 seconds to update after SSL VPN connection was established
• NUTM-9860 [Basesystem] Selfmon trying to start DHCP even when not in use
• NUTM-10226 [Email] Can’t release POP3 messages due to URL in User Portal
• NUTM-9681 [Email] cssd coredumps and root partition is filling up
• NUTM-9716 [Email] S/MIME encryption – automatic certificate extraction causing high load / no webadmin access
• NUTM-9733 [Email] Change default encryption algorithm to ‘smime’
• NUTM-9853 [Email] Fix policy traversal (for gpg, smime, unscanable)
• NUTM-9882 [Email] Umlauts in mail addresses get corrupted if SPX encryption is used
• NUTM-10181 [Network] Remove DNSdynamic from available dynamic DNS providers
• NUTM-10307 [Network] ATP exception still working after deletion
• NUTM-10337 [Network] High CPU load by AFCd when hotspot is enabled
• NUTM-10414 [Network] Segfault in oculusd
• NUTM-2791 [Network] Fix detection of sub applications in Application Control
• NUTM-4767 [Network] SSH for single host skipping AFC check
• NUTM-9462 [Network] Update to BIND 9.11 ESV
• NUTM-10197 [RED] All REDs disconnect intermittently
• NUTM-10227 [RED] Offline provisioning does not work
• NUTM-10303 [RED] Unified FW: split networks does not work
• NUTM-10384 [RED] Update hostapd for Unified-FW
• NUTM-9026 [RED] TP-LINK MA260 dongle on RED doesn’t work anymore after update to v9.5
• NUTM-9795 [RED] RED50 issue with large packets in Transparent/Split mode
• NUTM-10060 [Reporting] ATP alerts / events not deleted after three days
• NUTM-10201 [Reporting] Unable to download S/MIME internal user certificate
• NUTM-10352 [Sandstorm] Sandstorm Activity Report table and graph do not show same data
• NUTM-10367 [Sandstorm] Sandstorm Activity Graph does not include email cached results
• NUTM-2644 [UI Framework] Webadmin prefetching list box not displaying any users, if one user contains a single tick
• NUTM-10066 [WAF] Existing certificate chain overrides after new certificate chain has been added
• NUTM-10185 [WAF] Using printenv SSI directive in custom theme causes segfault
• NUTM-10315 [WAF] Let’s Encrypt can’t be enabled after upgrade from 9.5 (/etc/ssl/certs not accessible)
• NUTM-10316 [WAF] Let’s Encrypt certificates allow wildcards in domain name list
• NUTM-10332 [WAF] Let’s Encrypt not working over IPv6
• NUTM-9809 [WAF] Potential memory allocation failure for “Rewrite HTML” + location with special characters
• NUTM-10188 [WebAdmin] [OTP] QR code not visible for the first user login
• NUTM-10214 [WebAdmin] Breach Vulnerability in WebAdmin (CVE-2013-3587)
• NUTM-6945 [WebAdmin] Popup too small for secret when deleting SHA512 OTP token
• NUTM-7381 [WebAdmin] Login to UserPortal only works at second try when using RADIUS authentication
• NUTM-9424 [WebAdmin] Webadmin session interrupted with pop-up “Backend connection failed”
• NUTM-10200 [Web] Segfault in libc-2.11.3.so
• NUTM-10284 [Web] HTTP Proxy crash with coredumps
• NUTM-9676 [Web] HTTP Proxy out-of-memory segfault / HTTP Proxy stops working with “Avira engine not available”
• NUTM-9854 [Web] Warning page bypass using crafted URLs
• NUTM-9873 [Web] File blocked due to MIME type detection even if there is an exception
• NUTM-9956 [Web] HTTP Proxy coredumps in geoip scanner
• NUTM-10365 [Wireless] RED15w: SSID isn’t broadcasted when “Enterprise Authentication” is in use

Download

While the release is in soft-release phase, you can find the up2date package on our FTP server at:

• http://ftp.astaro.de/UTM/v9/up2date/u2d-sys-9.510005-600005.tgz.gpg
• http://ftp.astaro.de/UTM/v9/up2date/u2d-sys-9.510005-600005.tgz.gpg.md5

When receiving mails in theese phishing/ceo fraud times, it can be great to use this little neat free feature og your Exchange server:

New-TransportRule -Name ‘Add EXT to all external mails incoming’ -Comments ‘Added 29/11-2018 by Martin F.’ -Priority ‘0’ -Enabled $true -FromScope ‘NotInOrganization’ -PrependSubject ‘[EXT] ‘ -ExceptIfSubjectContainsWords ‘[EXT]’

This will add the word “[EXT]” to EVERY email you get from outside the organisation, so it may be an eye opener for thoose mails coming from your boss, telling you to transfers a lot of money asap

Tested on: Exchange 2010 –> 2016 OK!

Hooray, XG 17.5 has been GA released, this is a promising update, with lateral Movement Protection, a REALLY nice feature, that no other provider can do!

Also the new Sophos VPN client: Sophos Connect is here with this new version, finally you can run IPSEC VPN and SSLVPN in the SAME client

Running with this in the home lab, and it works totally as expected!

Release notes:

What’s New in XG Firewall v17.5

Here’s a quick overview of the key new features in v17.5. For a more detailed description please refer to: Sophos-XG-firewall-v17.5-whats-new.pdf

Lateral Movement Protection

Synchronized User ID

Synchronized User ID utilizes Security Heartbeat to greatly streamline authentication for user-based policy enforcement and reporting in any Active Domain network by eliminating the need for any kind of server or client agent.

Education Features

Email Features

IPS Protection

Management Enhancements

VPN and SD-WAN Failover and Failback

Client Authentication

Sophos Connect

Additionally

Coming in a following Maintenance Release we have:

• Wireless APX Access Point Support provides support for the new Wave 2 access points providing faster connectivity and added scalability.
• Airgap Support for deployments where XG Firewall can’t get updates automatically via an internet connection (due to an “airgap” or physical isolation) – Patterns and Licenses can now be updated manually.
• Sophos Central Management of XG Firewall With v17.5, XG Firewall is also joining Sophos Central.  The Early Access Program for Sophos Central Management of XG Firewall is expected to start soon.

  You will be able to manage XG Firewall from within Sophos Central along with all your other Sophos Central products.  And there’s a few great new features coming along with Sophos Central Management of XG Firewall:

  • Secure access and management with single-sign-on through Sophos Central from anywhere
  • Backup management and storage for your regularly scheduled firewall backups
  • Firmware update management to make multiple firewall updates easy
  • Light-touch deployment to enable easy remote setup of a new Firewall

Notes

• Enforcement of search engine Safe Search and additional image filters is now configurable per-web policy and is no longer a global option. The settings have been moved from Web >> General Settings into the additional options that are available when editing a web policy. In addition, configuration for YouTube restrictions have been broken out into a separate option.
  Product behaviour will be preserved on upgrade by automatically migrating the existing global settings to all existing web policies.The exceptions to this are the following built-in, uneditable policies: Allow All, Deny All and ClPA-Compliance. KBA 123589
• IPS now with Cisco Talos IPS library and more granular IPS categories KBA 133197
• XG Firewall v17.5 has incorporated new Avira virus scan engine v4.x. When v17.5 will boot for the first time, it will download full (not incremental) Avira patterns approx. ~90 MB and reload virus scan engine. This may take a few seconds or minutes based on the bandwidth. In this duration, web and email traffic will be blocked. Blocked emails will stay in email spool and it shows reason as malware scan failed. However, these emails will be delivered once the engine is up after reload. KBA 133165

Issues Resolved

• NC-39029 [Authentication] Show proper error message in UI if you enter an used port in Chromebook SSO configuration
• NC-39212 [Authentication] CSD: make sure the userSessions map is not overwritten
• NC-39532 [Authentication] Migration from 17.1 fails if host definition for “*.gstatic.com” exists
• NC-39677 [Authentication] Success message shown in ui even though deleting a user fails
• NC-37683 [Base System] cURL (libcurl) NTLM Authentication Code Buffer Overrun Vulnerability (CVE-2018-14618)
• NC-39192 [CM-Join-to-cloud] Appropriate status should update on SF and Sophos Central once FW is remove from Central and register again
• NC-36497 [Email] POP3 mails reach the proxy empty
• NC-38052 [Email] Subject not displayed properly in mail log with sender generated password method
• NC-38282 [Email] mail_sender opcode stuck in CSC
• NC-38470 [Email] Some reason filters on mail log page are not working as expected
• NC-38571 [Email] Port validation not working when adding new port in SMTP via CLI
• NC-39233 [Email] Email delivery failed for some recipients when email containing 512 recipients
• NC-39280 [Email] Error message ‘Relay not permitted’ when sending an inbound mail to email address base profile
• NC-39379 [Email] Bad (malformed syntax) mails should be displayed separately from network failed emails on UI
• NC-39454 [Email] Mail doesn’t get formatted properly when file filter protection applied
• NC-39513 [Email] Network type IP host should not allowed to add in exception policy
• NC-39668 [Email] RDNS check should be applied to inbound emails only
• NC-39737 [Email] Mail from header changed when wrong “Return-Path” used in smart host deployment
• NC-39953 [Email] Email attachments get corrupted with BDAT
• NC-38505 [IPS] IPS policy backup is not created while applying signature upgrade
• NC-39687 [IPS] IPS log filling up with entries and causing problems for legitimate traffic
• NC-39083 [IPsec] IPsec: charon starts parsing fragmented messages before they are reassembled
• NC-38832 [Network Services] Issue with wildcard FQDN based rule
• NC-37817 [UI Framework] SAC tab not loaded because of OutOfMemory error
• NC-39310 [UI Framework] Control Center: Icons for VPN and Connections have been switched
• NC-38184 [Web] Check settings functionality is not working from device level of firewall manager(SFM)
• NC-38844 [Web] Web Policy Override not working in HA(A-A) mode if traffic served from Aux appliance
• NC-39039 [Web] When “Drop connection” feature is enabled, blocked/warned events are not logged correctly

Issues Resolved in EAP1

• NC-32763 [Authentication] Importing users with .csv file having usernames with Thai characters creates junk character
• NC-34340 [Authentication] Users not getting authenticated via Radius SSO
• NC-37091 [Authentication] Show error when Chromebook SSO is not configured correctly
• NC-37300 [Authentication] Create FQDN Hosts and Groups for Chromebook
• NC-38381 [Authentication] “Record does not exist” error when trying to open created LDAP server
• NC-36185 [Azure] Upgrade Linux VM Agent
• NC-38176 [Base System] garner memory corruption affecting RED
• NC-38471 [Base System] EULA not shown on GUI on Azure
• NC-38473 [Base System] Reading of /proc/timer_list file leads to NMI watchdog soft lockups
• NC-31499 [Email] Unable to send .eml attachments to specific domain
• NC-32682 [Email] SPX generates password for same email recipient in different case
• NC-32690 [Email] SPX encryption corrupting attachments by adding line breaks
• NC-32754 [Email] XG not able to insert spool query
• NC-33360 [Email] Add missing header fields in notification emails
• NC-33391 [Email] Quarantine digest and released emails not sent
• NC-33977 [Email] Unable to release unscannable quarantined emails
• NC-34450 [Email] Fail to send email notifications
• NC-35494 [Email] UI hangs when user selects specific date on SMTP quarantine page
• NC-36612 [Email] Cross version import/export not working for exception policy
• NC-37849 [Email] Console command ‘subsystem-info’ shows awarrensmtp and smtpd service with same name
• NC-37945 [Email] Scanner crash on low end devices due to high number of forwarders
• NC-38005 [Email] Improper IP reputation reject status message in mail log
• NC-38013 [Email] Typo in Authentication Relay drop message
• NC-38015 [Email] Emails moved to error queue when header part is big
• NC-38021 [Email] Return-Path/Reply-To header ignored while sending failure notifications
• NC-38252 [Email] Add support of email based routing and RBL scanning
• NC-38257 [Email] No reason logged in mail logs for mails dropped due to file filter
• NC-38297 [Email] Improper label in exception policy at device level from SFM
• NC-38312 [Email] SFM pushes exception policy to firewalls even in legacy mode
• NC-38391 [Email] Core dump in mail scanner
• NC-38392 [Email] Notifications are logged with ‘0 bytes’ in MailLogs
• NC-38501 [Email] SPX fails to encrypt on hardware appliances when SPX reply portal is enabled template
• NC-39024 [Email] Do not allow multi use for port 587
• NC-32530 [Firewall] Post-Authentication SQL injection in Firewall User Interface
• NC-34612 [Firewall] Appliance frequently rebooting when having IPv6 permitted networks for remote access SSLVPN
• NC-34675 [Firewall] Live connections page not showing connection list
• NC-35656 [Firewall] Internet access being lost, SFOS consuming all memory.
• NC-35660 [Firewall] MAC address missing in export of MAC list having only one list member
• NC-37274 [Firewall] SMTP MTA mode does not support TCP port 587
• NC-37760 [Firewall] Misleading message when adding rule using automatic grouping and group has already 200 rules
• NC-37992 [Firewall] Transferred data not shown in firewall rules when reaching tera bytes
• NC-36318 [IPS, SFM-SCFM] Application filter policy rule not containing any application being pushed from SFM is not applied on SF
• NC-36565 [IPS] Category replacement not working on export/import
• NC-38347 [IPS] Category based IPS policy import not mapping to Talos categories
• NC-30016 [IPsec] Merged IKE gets deleted when one connection is disabled in UI
• NC-32269 [IPsec] GRE traffic forwarded through WAN interface after HA failover event
• NC-34131 [IPsec] L2TP still connects after user was disabled
• NC-38310 [IPsec] IPsec site-to-site tunnel not established with Cisco ASA and gateway type “Initiate the connection”
• NC-39059 [Localization] Using “state” causes mistranslations
• NC-36455 [Networking] WWAN is not connected automatically at boot time if the primary WAN link is disconnected/down
• NC-36720 [Networking] Traffic might flow via backup gateway even hard gateway failback configured
• NC-34149 [nSXLd] Keywords are not deleted when custom web category is deleted
• NC-37809 [nSXLd] Proxy authentication is not cleared after config reload
• NC-38125 [SSLVPN] Unable to edit SSLVPN (remote access) page
• NC-35500 [UI Framework] Apache service start fails if webadmin certificate passphrase having single quote character
• NC-35682 [WAF] Unable to edit and load business app rule for WAF
• NC-37178 [Web] Name should not be pre-filled while creating new overrides
• NC-37179 [Web] Improve UI for adding website domains to an Application Override

Issues Resolved in EAP0

• NC-29648 [Base System] If Default CA is not configured, Generate CSR option should be disabled
• NC-29906 [Base System] Unable to edit NTP server when 10 servers are configured
• NC-30497 [Base System] [VMware] SFOS Guest OS detail shows wrong/missing
• NC-30635 [Base System] Missing focus after closing dialog when editing default certificate
• NC-31010 [Base System] Configuration import running into timeout on SG/XG 100 series appliances
• NC-31100 [Base System] Upgrade notification pop-up does not work in some cases
• NC-35536 [Base System] OpenSSL – Denial of service during forward secrecy setup (CVE-2018-0732)
• NC-34154 [Clientless Access] Unable to connect RDP type bookmark with NLA
• NC-34803 [Email] Possible denial-of-service due to secure client-initiated renegotiation
• NC-35175 [Email] Sophos XG is not adding received-by header as per RFC 5321
• NC-35256 [Email] Invalid XML is generated for Email -> General Settings -> Blocked Senders
• NC-35915 [Email] “POP-IMAP Scanning” policy generated XML does not contain information of filter criteria “Source IP/Network Address”
• NC-26440 [Firewall] Firewall rule dropping traffic when there is no user identity attached to the rule
• NC-30989 [Firewall] CVE-2018-8897: Don’t use IST entry for #BP stack
• NC-31282 [Firewall] Firewall rule group entity name not sent to SFM upon insert/update/delete
• NC-22889 [Hardware] XG85: poweroff command reboots the device instead of shutting it down
• NC-21909 [IPsec] Do not show empty-value-warning on page entry
• NC-30319 [IPsec] Backup fails import when containing IPv6 remotes
• NC-30462 [IPsec] Site-to-Site connection not initiated after DHCPv6 interface update
• NC-30618 [IPsec] New virtual IP on every Phase 1 rekey even though client requests same IP
• NC-30794 [IPsec] NAT checkbox is always enabled in IE11
• NC-30796 [IPsec] Local gateway selection shows invalid interface in IE11
• NC-33410 [IPsec] VPN Connection Status shows ‘Any’ on both sides even when configured only on one side
• NC-22604 [Logging] GUI alignment issue when sender name or subject is longer
• NC-25714 [Logging] Firewall rule ID in log viewer not linking to actual rule anymore
• NC-29974 [Network Services] Disconnect PPPoE interface doesn’t update corresponding interface based DNS static entry
• NC-30753 [Network Services] DGD service in stopped state and segmentation fault
• NC-33876 [Network Services] IPset command shows wrong information for wildcard and FQDN Host
• NC-30483 [Networking] Port and IP address may show “undefined” in WAN Link Manager “Failover Rules”
• NC-30493 [Networking] Link status not updated in WAN Link Manager when RA client has no IP address
• NC-30544 [Networking] Full and selective configuration import fails when bridge innterface configured in WAN zone
• NC-31399 [Networking] Full backup import fails when bridge member interface is LAG
• NC-33628 [Networking] LAG mode related configuration missing on configuration export
• NC-34573 [Networking] Configuration changes of CFM not propagated to XG
• NC-20785 [Reporting] PDF export of reports taking much time or failing completely
• NC-26459 [Reporting, UI Framework] Reports for “Traffic Insight” not shown on dashboard
• NC-29573 [Reporting] Sending of scheduled reports does not consider changes of daylight saving time
• NC-31243 [Reporting] Table headers in reports span two lines and cannot be seen
• NC-32490 [Reporting] Unable to click “PDF”, “CSV”, “Bookmark” or “Schedule” under “Report > Applicazioni & Web” when WebAdmin language is Italian
• NC-28206 [SecurityHeartbeat] Heartbeat deamon does not handle all allowed MAC address formats correctly
• NC-32459 [SecurityHeartbeat] Endpoint name in StoneWall message
• NC-32580 [SecurityHeartbeat] Extend StoneWall protocols/messages
• NC-34169 [SSLVPN] Fail to access SSLVPN (site-to-site) page after any tunnel modification
• NC-30984 [Synchronized App Control] [SAC] improve usability
• NC-30987 [Synchronized App Control] [SAC] no action “acknowledge” for acknowledged apps
• NC-30988 [Synchronized App Control] [SAC] filter with deleted apps should be last in the dropdown field
• NC-28064 [WAF] Form hardening sets block-reason only in case of GET requests
• NC-25805 [Web] Handle non-compliant HTTP status code 999
• NC-27519 [Web] Proxy continues to download files in batch mode even if client closes connection
• NC-28851 [Web] Default Web policies contain duplicate rules
• NC-29305 [Web] “Expect” header not handled correctly
• NC-31837 [Web] Add “alert.hitmanpro.com” to proxy bypass list
• NC-33650 [Web] Enabling web content cache for Sophos Updates blocks further updates

Download

To manually install the upgrade, you can find the firmware for your appliance at MySophos portal. Please see the following KBA – Sophos Firewall: How to upgrade the firmware: KBA 123285.

DANISH CONTENT THIS TIME

Fra 1/1-2019 gælder der nye regler ift. email kryptering i Danmark, disse er udstedt af datatilsynet. Det kan være svært at holde hoved og hale i alle de teknikker der er.

Der nævnes bla. TLS i deres skriv, TLS er ikke 100% sikker mail kryptering, men Datatilsynet oplyser at det, under normale omstændigheder, vil være passende, såfremt man anvender “Forced TLS”, “AES kryptering” og så skal TLS versionen være MIN. 1.2 eller højere…

Husk de fleste mailfiltre anvender “opportunistic TLS”, med mindre de er konfigureret anderledes! – Opportunistic TLS betyder at den PRØVER TLS, men kan den ikke lave end to end med TLS, sender den mailen i REN TEKST! – Så sørg for at få dette clearet med din udbyder / leverandør af mail/spamfilterløsningen.

Der er naturligvis mange andre måder at sikre mails på, disse er også nemt i artiklen herunder:

Læs Datatilsynets tekst om sikkerheden ved transmission af personoplysninger via e-mail fra 1/1-2019 her.

Running build 1809 of Windows Server 2019, the server still have activation issues, IF you did not specify the product key, during installation.

If you use the GUI, it will fail, no matter what, stating that it cannot reach the company licensing activation server (KMS), but hey, I did not ever specify a KMS key, I have a MAK

The solution is to use the old SLMGR.VBS script, this works..luckily

Just open a command prompt and type:

“cscript c:\windows\system32\slmgr.vbs /ipk <product-key>”

Running Exchange 2019 on Windows Server 2019 Core, is the “new” preferred way to run Excahnge, because of the better performance with core, fewer updates and the smaller attack surface!

So let’s get a Windows Server 2019 Core up and running, choose to installed it without Desktop Experience!

After installation, you will be asked to change password, then after that, you will get the command prompt, go and launch SCONFIG:

Setup the following:

• Computer name
• Enable remote Desktop
• Set static IP, gateway and DNS
• Join the domain
• Activate Windows
• Download and install updates
• Reboot for the last time

After reboot, we need to do a few things before running the install:

1. Enable File Sharing
To get the Exchange ISO transferred to the core server

“netsh advfirewall firewall set rule group=”File and Printer Sharing” new enable=Yes”

Then access the Exchange server share from remote server with the Exchange ISO:

Start –> Run –> \\EXCH01\c$

• Create folder !INSTALL
• Copy Exchange 2019 ISO to that folder
• Rename ISO from the long name to ex. EXCH2019.iso

2. Mounting the Exchange Server 2019 ISO
Now to mount the Exchange Server 2019 ISO, run the following commands:

Start powershell with “powershell” at the prompt, wait for [PS C:\Users…] prompt, then:

Mount-DiskImage -ImagePath “C:\!INSTALL\EXCH2019.iso”

3. Installing UCMA runtime 4.0
To install UCMA runtime 4.0 as required by the setup of Exchange you can navigate to the UCMARedist folder in the ISO and run the setup.exe file, then run the graphical installer.

4. Installing Visual C++ 2013 Redistributable Package
This package is not on the ISO, so go and download it and run afterwards (Download from remote server and copy to core server as the ISO, is easiest”

https://www.microsoft.com/download/details.aspx?id=40784

5. Install the Server media Foundation Feature

Run this:

“Install-WindowsFeature Server-Media-Foundation”

6. Install Exchange Server 2019
Now go to the drive of the mounted ISO it could be D: or E:, then run the following to run in unattended mode

Setup.EXE /Mode:Install /InstallWindowsComponents /IAcceptExchangeServerLicenseTerms /Roles:MB

This will install Exchange 2019 with all prerequisites automatically!

Then you should see the installation move on it’s way:

After completion, reboot the server, and try to connect to OWA and ECP like usual.

If you ex. run Exchange 2019 i Windows Server Core, it would be great to launch Exchange Powershell module automatically, everytime you launch Powershell on the core server. This can easily be done with this command:

“Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn;”

This works for Exchange 2013, 2016 and 2019