COPSSH - A yet another SSH Server & Client for Windows

Version 2.1.0 - February 2009



CHANGES FROM VERSION 2.0.1



1. UPDATED - OpenSSH 5.2p



Security:



* This release changes the default cipher order to prefer the AES CTR

   modes and the revised "arcfour256" mode to CBC mode ciphers that are

   susceptible to CPNI-957037 "Plaintext Recovery Attack Against SSH".



* This release also adds countermeasures to mitigate CPNI-957037-style

   attacks against the SSH protocol's use of CBC-mode ciphers. Upon

   detection of an invalid packet length or Message Authentication

   Code, ssh/sshd will continue reading up to the maximum supported

   packet length rather than immediately terminating the connection.

   This eliminates most of the known differences in behaviour that

   leaked information about the plaintext of injected data which formed

   the basis of this attack. We believe that these attacks are rendered

   infeasible by these changes.



 

New features:



* Added a -y option to ssh(1) to force logging to syslog rather than

   stderr, which is useful when running daemonised (ssh -f)



* The sshd_config(5) ForceCommand directive now accepts commandline

   arguments for the internal-sftp server.



* The ssh(1) ~C escape commandline now support runtime creation of

   dynamic (-D) port forwards.



* Support the SOCKS4A protocol in ssh(1) dynamic (-D) forwards.

   (bz#1482)



* Support remote port forwarding with a listen port of '0'. This

   informs the server that it should dynamically allocate a listen

   port and report it back to the client. (bz#1003)



* sshd(8) now supports setting PermitEmptyPasswords and

   AllowAgentForwarding in Match blocks



Bug and documentation fixes



* Repair a ssh(1) crash introduced in openssh-5.1 when the client is

   sent a zero-length banner (bz#1496)



* Due to interoperability problems with certain

   broken SSH implementations, the eow@openssh.com and

   no-more-sessions@openssh.com protocol extensions are now only sent

   to peers that identify themselves as OpenSSH.



* Make ssh(1) send the correct channel number for

   SSH2_MSG_CHANNEL_SUCCESS and SSH2_MSG_CHANNEL_FAILURE messages to

   avoid triggering 'Non-public channel' error messages on sshd(8) in

   openssh-5.1.



* Avoid printing 'Non-public channel' warnings in sshd(8), since the

   ssh(1) has sent incorrect channel numbers since ~2004 (this reverts

   a behaviour introduced in openssh-5.1).



* Avoid double-free in ssh(1) ~C escape -L handler (bz#1539)



* Correct fail-on-error behaviour in sftp(1) batchmode for remote

   stat operations. (bz#1541)



* Disable nonfunctional ssh(1) ~C escape handler in multiplex slave

   connections. (bz#1543)



* Avoid hang in ssh(1) when attempting to connect to a server that

   has MaxSessions=0 set.



* Multiple fixes to sshd(8) configuration test (-T) mode



* Several core and portable OpenSSH bugs fixed: 1380, 1412, 1418,

   1419, 1421, 1490, 1491, 1492, 1514, 1515, 1518, 1520, 1538, 1540



* Many manual page improvements.





    See http://www.openssh.org/txt/release-5.2 for details

   



2. UPDATED - Installer



    Better clean-up during uninstallation

 

MD5 Signature:

988111bee542bef59b71b6724c8b8817 *Copssh_2.1.0_Installer.zip

SHA256 Signature:

b896b109d52f4284c15650f06048d72610cedd492dfb61622636684e5067b0b8 *Copssh_2.1.0_Installer.zip

COPSSH - A yet another SSH Server & Client for Windows

Version 2.0.1 - January 2009



CHANGES FROM VERSION 2.0.0

 

1. UPDATED - OpenSSL 0.9.8j



    OpenSSL Security Advisory [07-Jan-2009] : http://www.openssl.org/news/secadv_20090107.txt



2. UPDATED - Installer



    Bug-fix - silent installation support. Following silent scenarios are available now:



  switch '/S' - install with default credentials created by the installer

  switch '/S /u=user /p=password' - install with user-specified credentials



Minor improvements including better support for version checks

 

3. UPDATED - Copsshadm 1.1.0.1



    Don't hide existing accounts from XP/Vista logon screen



4. UPDATED - Many core tools

MD5 Signature:

18f70f8545914fb08f9d14907b5c37e4 *Copssh_2.0.1_Installer.zip



SHA256 Signature:

2ff9be57a4b171979a9379e282cfb946264fd5f3cea9581a53713a23223e0f39 *Copssh_2.0.1_Installer.zip



 

COPSSH - A yet another SSH Server & Client for Windows
Version 2.0.0 Update 200 - December 2008

** NB! COPSSH 2.0.0 IS NOT COMPATIBLE WITH EARLIER VERSIONS **

CHANGES FROM VERSION 1.4.6

 00. BUG FIX - Installer Update 200

 Missing DLL cygwrap-0.dll required by the newer versions of sshd is back.

 01. BUG FIX - Installer Update 100

 Update 100 includes OpenSSH version 5.1 executables. The original
 2.0.0 package had 4.7 executables as result of a packaging error.

 1. NEW - ICW technology
 
 ICW technology allows you to have multiple cygwin-based solutions
 by using a single base, as recommended by Cygwin. Copssh is now
 implemented as a repackaging of ICW Base and ICW OpenSSH packages.
 You can extend your installation by additional ICW packages like rsync,
 rbldnsd and so on. Every attempt has been made to assure that those
 fundamental changes will be transparent to end users. Copssh will
 function as before.
 
 2. NEW - Ability to specify your own service account
 
 COPSSH installer has been extended to support user-defined service
 accounts. Existing accounts and domain accounts are also supported.
 As before, it is also possible to accept suggested values by the
 installer.
 
 3. UPDATED - Copsshadm
 
 Copsshadm is updated to support user-defined service accounts.

SHA256 Signature:

 96d3738ae98ef6d85e2c88e98f1156fdd23ae93c97b5887de8b6892352a65f37 *Copssh_2.0.0_Installer.zip

I have released two Cwrsync updates with Cygwin 1.7.0, which introduces many enhancements including longer pathnames and Unicode support in file names.

The list below shows some of the changes related to rsync:

• Windows 95, 98 and Me are not supported anymore. The new DLL will not run on any of these systems.
• Mount points are no longer stored in the registry.  Use /etc/fstab and /etc/fstab.d/$USER instead.  Mount points created with mount(1) are only local to the current session and disappear when the last Cygwin process in the session exits.
• PATH_MAX is now 4096.  Internally, path names can be as long as the underlying OS can handle (32K).
• UTF-8 filenames are supported now.  So far, this requires to set the environment variable CYGWIN to contain "codepage:utf8", but this will likely disappear in a few weeks time.  The setting of $LANG or $LC_CTYPE will be used instead.
• The CYGWIN environment variable options "ntsec" and "smbntsec" have been replaced by the per-mount option "acl"/"noacl".
• Reworked pipe implementation which uses overlapped IO to create more reliable interruptible pipes and fifos.
• Reworked pipe handling for better speed and better support for signal processing.
• Fallout from the long path names: If the current working directory is longer than 260 bytes, or if the current working directory is a virtual path (like /proc, /cygdrive, //server), don't call native Win32 programs since they don't understand these paths.
• On the first usage of a DOS path (C:foo, \foobar), the Cygwin DLL emits a scary warning that DOS paths shouldn't be used.  There's also the new CYGWIN=nodosfilewarning setting to disable that.

Copssh version 1.4.6 includes openssh 5.1, openssl 0.9.8h and cygwin 1.5.25-15. Upgrade is strongly recommended as OpenSSL 0.9.8h addresses two moderate security vulnerabilities. In addition, OpenSSH 5.1 has many new features and bug fixes. You will also notice that many core tools in the package are updated with the most recent versions.

Hiding the service account from welcome screen is an another convenient feature for users of XP/Vista. The copssh uninstaller is now more user friendly as it gives a warning about the consequences of uninstalling copssh with user created symbolic links/shortcuts intact.