Update 7.1-1.4
Avira Antivirus
Due to a misconfigured update procedure the scanner failed to connect with the servers for online queries after the signature
update from 2020-01-14, about 16:00 CET.
Tagging the subject of quarantined mails
The email attachment filter looks for emails with possibly dangerous attachments and either quarantines them or delivers them
without the attachments. As an option you can now tag the subject of affected emails with an arbitrary text.
Protocol definition from DNS SRV records
In the "Definitions" menu IP objects can be configured which represent a DNS SRV record. One part of the information published
by SRV records is the UDP or TCP port where the service is made available. It is now possible to refer from a protocol definition
to an IP object to collect its port information and make it usable as a protocol.
Domain signatures in S/MIME gateway
Inbound emails with domain signatures will be tagged with an additional "[SIGNED BY <*@domain>]".
Mail clients should issue a warning when displaying emails with a domain signature, as the sender address doesn't match the
certificate. So in addition to the option to remove all correct signatures, we've added an option to remove domain signatures
only.
Occasional throughput problems due to Intrusion Prevention
Minor bugfixes and improvements
IMAP group folders
For the mail server each user group used to represent a mail distribution list. Each group member received an individual copy
of mails addressed to the group. Now you can decide per group if the group should have no special meaning for the mail server,
be treated as a mail distribution list or if a shared IMAP folder should be provided for the group members.
Management of remote "Orbiter" devices
This feature is still incomplete and experimental. We would appreciate your feedback.
In the new menu "System > Remote devices" you can record your "Orbiters". If access to the devices is possible, a brief status
including the version number is shown. It is also possible to remotely update the devices. At the moment this requires at
least version 3.1.1 on the Orbiters.
Please note that currently only the system which issued the VPN setup package for a remote device is able to connect with
it. In one of the next releases we will add the possibility to authorize access manually.
Exclude connections from IPS processing
Based on protocol, source and destination addresses, connections can be excluded from being processed by the Intrusion Prevention
System now.
Delivery of quarantined mails to local mailboxes
Delivery of quarantined emails to local mailboxes didn't work. Delivery to internal mailserver and access to quarantined attachments
were not affected.
Endless loop when viewing IPsec log
In most IPsec log lines there's a link which opens an extra window to show all lines associated with the same connection.
This extra window caused an endless loop, resulting in permanent high system load.
Minor bugfixes and improvements
Licensing of S/MIME gateway option
At the request of many of our customers we changed the licensing of the S/MIME gateway. It is now no longer licensed by user
count but by the number of S/MIME keys. No license is required for S/MIME keys used as domain certificate (see next section).
New S/MIME gateway features
The S/MIME gateway now support the non-standardized concept of domain certificates. This feature can be used for free on almost
all systems (exception: licenses without mail option like Enterprise VPN or Enterprise Proxy). With domain certificates, the
S/MIME communication with specific peers is protected by a single S/MIME certificate for the whole domain instead of one certificate
per email address. It is even possible to use the certificate of an internal CA. The peers however have to use S/MIME software
which supports this concept and set it up accordingly.
It is no longer necessary to add users when the S/MIME gateway is used in combination with an internal mail server. For internal
mail servers that guarantee correct sender addresses, a separate list with corresponding S/MIME keys is now maintained.
In the user administration you can now configure multiple S/MIME keys per user. When signing outbound emails the system will
automatically select the matching key.
In previous releases it was possible to add multiple keys per user to decrypt inbound emails which had been encrypted with
an old key. This functionality is now provided by the key-ring (see next section).
Backup when updating a key-pair in the keyring
When changing a key-pair in the keypair, a backup of the previous key-pair is kept on the device.
The S/MIME gateway uses backup keys to decrypt emails which have been encrypted with the old key during a key rollover phase.
Removal of expired entries in DNS IP objects
The default setting for deleting expired entries in DNS IP objects has been changed from "immediately" to "after 6 hours".
This prevents permanent service restarts if DNS entries change after few minutes or even seconds. The update will alter the
configuration of all IP objects which remove "immediately" automatically.
Let's Encrypt certificates
The Let's Encrypt client now uses the ACMEv2 protocol.
DHCP relay server
On all ethernet and VLAN interfaces the device can now act as a DHCP relay server, forwarding requests from clients to a DHCP
server in a different network.
Endless loop when viewing IPsec log
In most IPsec log lines there's a link which opens an extra window to show all lines associated with the same connection.
This extra window caused an endless loop, resulting in permanent high system load.
Minor bugfixes and improvements
Update of the POP3/IMAP4 server
This update fixes a critical security issue. An attacker was able to read protected information or even execute their own
program code without authentication.
Improved macro detection in email attachments
Now macros will also be recognized if office documents have been mailed directly (not as attachment) or if they are attached
to an attached email.
New categories for the commercial URL filter
New categories have been added to the commercial URL filter: Arms and weapons, DNS-over-HTTPS, Movies and series with questionable
legal status, Education, Restaurants and recipe sites, Buy or rent a place to live, Stock markets and trading systems.
Adding new certificates to the keyring
For each certificate the corresponding root and intermediate CA certificates have to be stored. Previously the CA certificates
had to be uploaded manually for each new certificate. Now the certificates of well-known root CAs will be added automatically.
Certificates of intermediate CAs will be cached upon the first upload and added automatically when required by subsequent
certificates. Adding multiple similar certificates as required by the S/MIME gateway feature becomes much more convenient
in this way.
Minor bugfixes and improvements
Secure
DEFENDO forces a collection of best-of-breed security modules like firewall, VPN, proxies, virus scanner and anti spam system to
interact for one purpose:
To be protected from all online threats and unwanted contents like malicious code, spam and hacker attacks.
Flexible
Each IT scenario is different. The DEFENDO product family will adapt precisely to your demands.
DEFENDO applies for simple internet connections of small companies, for headquarters / branch office WANs, as well as for complex
multi-tiered firewall systems.
More good reasons
- No backdoors
- More than 20 years of Internet security experience
- Award-winning product
- Support by our development engineers
- Reseller loyalty
- Made in Germany