Lantronix Advanced Console Manager Software Release Notes Version 9.3.0.0 December 13, 2023 Copyright 2023, Lantronix Release notes are also available on the Lantronix web site (www.lantronix.com) and via anonymous FTP from ftp.lantronix.com. Contact Lantronix or your reseller for more information. This document describes the Lantronix SLC firmware release 9.3.0.0. =============== RELEASE SUMMARY =============== Current release: 9.3.0.0 ============================= ADDITIONAL PRODUCTS SUPPORTED ============================= V9.3.0.0 supports the SLC8008, SLC8016, SLC8024, SLC8032, SLC8040 and SLC8048 Advanced Console Managers. ================= FIRMWARE RELEASES ================= file: slcupdate-9.3.0.0R9.tgz key: 895e3b022122c52281c4c0367c5a5135 Do not rename the firmware file - it must retain the same filename in order for the firmware upgrade to complete successfully. The firmware can be updated via either the 'Firmware & Configurations' web page, or with the 'admin ftp' and 'admin firmware' CLI commands. Updating firmware via tftp does not use the FTP login, password, or path settings. The firmware update will be applied to the alternate boot bank. Downgrading firmware versions is not supported. ===== NOTES ===== - The ConsoleFlow client is now enabled by default. If a factory default is performed and the ConsoleFlow client was not previously enabled, after reboot it will be enabled and actively trying to connect to ConsoleFlow. - The minimum LPM (Lantronix Provisioning Manager) version required for the SLC 9.3.0.0 firmware release is 6.5.3. - For G52x devices used as fail-over devices with the SLC, the minimum required firmware version for the G52x device is 2.1.0.0. ============ NEW FEATURES ============ - SSH Out to IPv6 Addresses SSH out from the CLI to IPv6 addresses and hostnames that resolve to IPv6 addresses is now supported. - Protocol Source IP Address Selection The source IP address selection for Syslog, DNS, NTP, TACACS+, and SNMP have been expanded to include IPv4 and IPv6 addresses for both physical interfaces (Eth1 and Eth2), as well as IPv4 and IPv6 addresses for both virtual interfaces (VEth1 and VEth2). - IPv6 Static Routing IPv6 static routes can now be configured. Link local IPv6 gateways require that a scope identifier be specified for the gateway. - SSH Upgrade The SSH server and client applications have been upgraded to include the latest vulnerability fixes. - LCD Reboot to Alternate Bank The LCD now supports a feature that allows the user to reboot to the alternate boot bank. - FIPS Mode FIPS mode is still supported, however this feature is now deprecated. - Changes to CLI syntax: o added auto option to "admin sysinfo" o added "eth1" and "eth2" to "set network dnssrcipaddr" and "set snmp trapsrcipaddr" options o added srcipv6addr option to "set tacacs+" o added srcipv6addr option to "set ntp" o added trapsrcipv6addr option to "set snmp" o added dnssrcipv6addr option to "set network" o added syslogsrcipaddr and syslogsrcipv6addr options to "set services" o added ipv6route option to "set routing" o added veth1 and veth2 to "diag ping ethport" and "diag ping6 ethport" options ========= BUG FIXES ========= ========== KNOWN BUGS ========== - Changing the source IP address for DNS, TACACS and Remote Syslog from a value other than "none" to any other value requires that a NAT timeout expire in the firewall rules before the change can take effect. This means that no traffic that matches the firewall rule can be sent from the SLC for approximately a minute. This allows the subsystem that matches packets with rules to restart with a new rule. For example, to change the Remote Syslog source IP address from one value to another: - remove (unconfigure) Remote Syslog servers and set all Remote Syslog source IP address options to "None" (this halts all outbound Remote Syslog packets) - wait approximately one minute - reconfigure the Remote Syslog servers and source IP address options to the new desired values - In certain configurations, SNMP enterprise traps may use the physical Eth1 or Eth2 IPv6 address as the source IP address instead of a configured IPv6 source address. - When configuring the HSPA+ Gateway from the SLC, connectivity issues between the SLC and the gateway may cause the HSPA+ configuration on the SLC and the configuration on the HSPA+ to become out of sync, and indicate that the configuration was successful when it actually failed. The workaround is to reissue/reapply the gateway configuration from the SLC. A reboot or power cycle of the HSPA+ gateway may also be required. - CLI "show routing" and "diag" commands may hang waiting for user input After issuing the CLI command "show routing" or "diag" commands "arp", "arp6", "lookup", "netstat", "nettrace" or "ping", the CLI may hang waiting for user input when the output from the command would normally be displayed. Pressing any key repeatedly will cause the output to be displayed. ==================== DOCUMENTATION ERRATA ==================== ================= PREVIOUS RELEASES ================= [ 9.2.0.0 NEW FEATURES ] - Sysinfo Diagnostics Auto Feature An 'auto' option has been added to the CLI "admin sysinfo" option to support saving sysinfo files in a CLI batch script. For example, a script that saves a sysinfo file every 60 seconds: [slc]> show script type batch name auto_sysinfo ___Batch Script 'auto_sysinfo'_______________________________________________ Group/Perms: Adm/ad,nt,sv,dt,lu,ra,um,dp,ub,rs,fc,dr,sn,wb,sk,do,sd,md,rp,di set cnt 5 while { $cnt >= 1 } { admin sysinfo save SLCsysinfo location usb auto enable sleep 60 set cnt [expr $cnt - 1] } - SSH Two Factor Authentication SSH 2FA has been added; when enabled, this requires users to configure a public key in addition to entering a password when authenticating to the SLC. - Speed Test Diagnostics A network performance test (via speedtest.net) has been added to the CLI to test performance of various network configurations, including performance of a cellular connection. See "diag speedtest" for more information. - SSH Server Host Keys The SSH server host keys can be removed with a CLI command; on reboot, the SLC will automatically regenerate the SSH server host keys. - SNMP Resource Utilization Traps Traps for resource (disk and memory) have been added; the traps are sent when the resource goes over 90% utilization. - TACACS+ Port The TCP port used for communication to a TACACS+ server can now be configured. - USB Device Port support for Prolific PL2303GS Support for Prolific PL2303GS USB Serial converters has been added for USB Device Ports. - Configuration Text File Character Escape An "escapechar" option has been added to the CLI commands "admin config commands" and "admin config batch" to escape any backslash '\' characters in the output. If escapechar is enabled with "admin config commands", any '\' character in the output will be prepended with an additional '\' character. If escapechar is enabled with "admin config batch", it will handle de-escaping (removing the prepended '\') in the input, before running the CLI command. - Ethernet Virtual Interfaces Support for two virtual interfaces has been added; these interfaces act similar to a real physical interface, with an assigned IP address and netmask. For more information see the online help for Virtual Interfaces. In addition, a virtual interface can be selected as the interface to use for outgoing SSH sessions (CLI command "connect direct ssh"), as well as NTP, SNMP, DNS and TACACS+ packets. - Power Supply Failure On dual power supply models, when a power supply fails, the failure is now logged every 120 minutes until the failure is corrected. Previously the failure was only logged when the issue was detected. - Changes to CLI syntax: o added auto option to "admin sysinfo" o added port and srcipaddr options to "set tacacs+" o added escapechar option to "admin config commands" and "admin config batch" o added "diag speedtest" o added "set sshkey server remove" o added "set virtual" and "show virtual" o added iface option to "connect direct ssh" o added local as a location for "admin sysinfo" o added srcipaddr option to "set ntp" o added trapsrciface option to "set snmp" o added dnssrcipaddr to "set network" [ 9.2.0.0 BUG FIXES ] - IPv6 with Ethernet Bonding Previously if Ethernet bonding was enabled, IPv6 was not supported with the bonding interface. This has been fixed in this release. [ 9.1.0.0 NEW FEATURES ] - SSH Algorithm Features Two options to control which algorithms are supported by the SSH server have been added: RSA Host Key Algorithms (enables or disables support for RSA server host key algorithms; enabled by default) and NIST Algorithms (enables or disables NIST Key Exchange algorithms and server host key algorithms; enabled by default). - SSH Upgrade The SSH server and client have been upgraded to a more secure version. DSA SSH keys are no longer supported. NOTE: due to the removal of less secure algorithms, users with older SSH clients may not be able to connect to the SLC via SSH after this firmware version is installed. If a SSH client cannot connect to the SLC, most SSH clients can be run in verbose or debug mode which will display what algorithms the client is offering to the SLC SSH server and the reasons for connection failure. SSH connections out of the SLC to older SSH servers may also fail to connect. - IP Filter Rule Limit The maximum number of rules allowed in an IP filter ruleset has been changed; 256 rules are now supported. - Syslog Version Format The system log format has been upgraded from RFC3164 to RFC5424. This upgrade applies to the format of the system log files stored internally as well as the format of the system log messages sent to a remote syslog server. For example, the RFC3164 syslog format: Mar 8 11:55:44 2023 slcfc31 SLC-SLB/xasd: sw/info-Running logrotate The RFC5424 format: 2023-03-08T11:55:44.027127+00:00 slcfc31 SLC-SLB/xasd: sw/info - Running logrotate After installing this release, booting to a bank running an older firmware version will result in logs with both RFC3164 and RFC5424 format logs in the system log, and the older firmware version will not be capable of date sorting both formats. - Discovery Server for Secure Lantronix Network The capability to disable the discovery server that listens for requests to search the network for Lantronix devices has been added. - Changes to CLI syntax: o added nist, rsahostkeys and discoveryserver options to "set services" o removed dsakeys option from "set services" o removed dsa from "set sshkey" and "show sshkey" o added "clear updatelog" to "set cflow" o added allusers option to "set cli" [ 9.1.0.0 BUG FIXES ] - SNMP link up/down trap using incorrect interface index The SLC was sending an incorrect ifIndex when issuing an SNMP linkUp or linkDown trap; this has been fixed. - Logging and diagnostics for directory full Additional logging and diagnostics has been added for tracking when a partition is full. [ 9.0.0.1 BUG FIXES ] - ConsoleFlow Proxy Connections When configured with a proxy server, the ConsoleFlow client was not using the proxy server for remote connections. This has been fixed in this release. [ 9.0.0.0 NEW FEATURES ] - StarTech USB External Modem Support for an external USB 2.0 modem (StarTech USB 2.0 USB56KEMH2) has been added. - ConsoleFlow Audit Log Audit log messages are now pushed to the ConsoleFlow server by the ConsoleFlow client. This feature is enabled by default, and can be enabled or disabled with the Audit Log Messages setting for the ConsoleFlow client. - SNMP v3 Encryption Support for AES192 and AES256 has been added to the SNMP v3 encryption options. - Changes to CLI syntax: o added auditlogmessages option to "set cflow" o added aes192 and aes256 options to "set snmp v3encrypt" options [ 9.0.0.0 BUG FIXES ] - Command to reset a Device Port The command to reset a device port via the CLI did not fully reset the serial side of connections to the device port. This has been fixed in this release. [ 8.9.0.1 BUG FIXES ] - ConsoleFlow Registration The ConsoleFlow client now uses the MQTT host returned by the ConsoleFlow server ; this is no longer user configurable. [ 8.9.0.0 NEW FEATURES ] - Configuration Text File Support for a text file version of the SLC configuration has been added. This text file is a series of CLI commands that can be exported from the device, optionally modified, and restored to the SLC. - CLI SNMP trapenable The CLI 'set snmp trapenable' can be used with prompts (querying the user which traps should be enabled) or without prompts (by specifying a list of OIDs). See the CLI help for 'set snmp' for more information. - ConsoleFlow CLI command The 'set snmp' CLI command is now available for issuing CLI commands via ConsoleFlow. - ConsoleFlow Proxy The ConsoleFlow client now supports use of a proxy server to act as a gateway between the ConsoleFlow client and the ConsoleFlow server. HTTP and SOCKS5 proxy servers are supported. - Changes to CLI syntax: o added proxy options to "set cflow" o added ConsoleFlow connection test command "show cflow connecttest" o added IP Filter "set ipfilter delete all" [ 8.9.0.0 BUG FIXES ] - The ConsoleFlow client can periodically lose connection to the ConsoleFlow server even when there are no network / routing issues due to libwebsockets ping-pong keepalive issues. This issue has been resolved by disabling libwebsockets ping-pong keepalives in favor of MQTT ping-pong keepalives. - The ConsoleFlow client can periodically get into a state where it is unable to publish results from jobs such as bulk CLI commands. This issue has been resolved by improving the telemetry handshake process. [ 8.8.0.0 NEW FEATURES ] - Support for G520 Series Cellular Gateway The Lantronix G520 Series Cellular Gateway is now supported as an integrated fail-over gateway. - Managed Ethernet Switch Support for an integrated 16 port Ethernet Switch has been added. This switch can be used as a management LAN to provide secure access to network devices that are attached to it. See online help for more details. - Changes to CLI syntax: o added g52x option to "set network gateway faildevice" o added consoleflow option to "admin lcd screens" o added allowremoteconnection option to "set cflow" o added "admin eeprom" command [ 8.8.0.0 BUG FIXES ] - Web Server Cookie Security Security issues related to web server session cookies have been fixed. [ 8.7.0.0 NEW FEATURES ] - Modem White List A list of allowed phone numbers can be used to control dial-in access to an internal modem or USB modem. The access list can be configured to either ignore or hang up phone numbers which are not on the access list. - USB Serial Support on front USB ports The front USB ports now support connecting serial devices. The user can login to the CLI and perform a "connect direct U1" or "connect direct U2" to interact with the device. - RPM support for APC 7900B and 8865 PDUs Management for APC 7900B and 8865 PDUs via SNMP has been added. Total current for the PDU can be displayed; however the PDU does not support displaying current for each outlet. - Changes to CLI syntax: o added starttime, endtime, display and numlines options to "show auditlog" o added "diag traceroute6" o removed mqttsecurity option from "set cflow" o added "show usb serial" and "set usb serial" o added "set accesslist" and "show accesslist" [ 8.7.0.0 BUG FIXES ] - ConsoleFlow Connection Issues Fixes for ConsoleFlow connection issues, including the “SSL: couldn't create a context” error. This caused telemetry to not be updated and some operations (for example, CLI Commands) to not run. - Ethernet Bonding When enabled, Ethernet Bonding was displaying the incorrect status, and dropping packets. This has been resolved.