One Identity Safeguard for Privileged Sessions 6.0.10 - Release Notes

RDP connection setup is unreliable with long user names

Initiating Remote Desktop connections with user names longer than 128 characters were unreliable: the client either connected without issues or showed an error dialog right after trying to start the connection.

Sessions initiated from Safeguard for Privileged Passwords use long user names and were affected.

The issue with the Remote Desktop Protocol implementation has been fixed and the connection setup is reliable now with long user names as well.

Downloading a certificate or key in DER format could provide an unparsable file for some certificates and keys

When a certificate or key was downloaded from the Web interface in DER format and the resulting binary blob ended with bytes that could be interpreted as ASCII whitespace or NULL (0x00, 0x09, 0x0a, 0x0b, 0x0d, 0x20), then those bytes were truncated, resulting in an invalid file. This has been fixed.

The missing host key for "scb-other" has been added to the configuration to prevent the administrator from having to manually verify host keys when navigating between HA nodes

When the administrator attempted to log in to the HA pair from an SPS node, the host key verification was up to the administrator. This was caused by the missing key value for the "scb-other" hostname. However, it worked correctly when the IP addresses, or the "scb1", or the "scb2" hostnames were used specifically.

This fix makes the login easier and more convenient by allowing to use the "scb-other" hostname, regardless of the current node allocation. The "scb-other" hostname can be used to SSH from any of the nodes because the related host key is already known by the origin SSH client.

The fix prevents some unwanted exceptions to be present in the logs, previously, rarely caused by unavailable internal services during SNMP-related email sending

Rarely, it can happen that the SNMP traps are sent before the whole system completely boots up. In these cases, if the system is configured to send SNMP traps in email, it could happen that the business logic attempted to connect to an internal service responsible for email sending before it was started and waiting for emails to deliver.

The change prepares the sending part for these cases and ensures that email sending, even in these corner cases, is more reliable.

SWAP monitoring could send false alarms through email and/or SNMP for appliances where no SWAP was configured for the appliance, mostly effecting virtual machine-based SPS appliances

Due to an upstream bug, it happened rarely that the SNMP monitoring sent out false alarms each time the appliance was restarted or the monitoring-related configuration was changed. This only happened when the SWAP available on the system was 0 bytes (SWAP was disabled) and where that value was compared to the available amount. The upstream issue related to the comparison of these values and that caused the alert to be sent out also if these values were equal, and not only when the available SWAP was below the configured threshold.

Possible RDP connection failure when a TLS certificate with an RSA key greater than 2048 bits is configured

When "Use the same certificate for each connection" was configured for an RDP connection policy with TLS enabled, and the uploaded RSA private key was greater than 2048 bits, an error could occur in the licensing protocol, and cause the client to terminate the connection.

This has been fixed, licensing no longer depends on the TLS certificate.

Pipeline exceptions issue

In case of an error, the pipeline restarted indefinitely. This has been fixed and now the pipeline will move to a failed state after 2 hours of trying. This way, the error will be visible, and can be addressed.

Also, reloading the pipeline is now working properly.

Preventing OOM killer from force-stopping Elasticsearch in a low memory scenario

It was necessary to prevent OOM killer from force-stopping Elasticsearch in a low memory scenario, because if Elasticsearch was force-stopped, it could cause translog corruption.

Event processing error

Some special mouse buttons were not handled correctly by the analytics pipeline, which has now been fixed.