2020-02-10

Microsoft recommends administrators to do hardening on Active Directory Domain Controllers

Microsoft has released an article where they recommend administrators to enable LDAP channel binding and LDAP signing on Active Directory Domain Controllers because of a vulnerability found in the default configuration for Lightweight Directory Access Protocol (LDAP).

Microsoft will release a security update in March 2020 to change the default configuration of LDAP channel binding and LDAP signing. This article describes steps that can be done in the meantime: https://support.microsoft.com/en-us/help/4520412/2020-ldap-channel-binding-and-ldap-signing-requirement-for-windows

After the configuration is changed (manually or by the update), you must enable to use SSL and upload the SSL certificate of the AD in Hybrid Access Gateway's CA certificate section. For instructions, see Add user storage and Add certificates ("Add certificate authority"). The SSL certificate must have the DNS name used as subject or SAN attribute in order to be valid. For more information, see Adapt Hybrid Access Gateway for endpoint identification.

2020-02-05

A Nexus Hybrid Access Gateway hotfix will be available to mitigate problems and avoid downtime due to the SameSite cookie directive change. 

For more information, see Important note on Hybrid Access Gateway and the SameSite cookie directive change.

2019-11-14

Nexus Hybrid Access Gateway 5.13.4 has been released today. Read more in the release note.

Main new feature in this release:

• Swedish BankID Interface was updated
  Hybrid Access Gateway now uses the newest version of the Swedish BankID service interface.

  The SOAP interface to Swedish BankID will be turned off in the end of February, 2020. To be able to continue to use BankID as authentication method after that date, you must update Hybrid Access Gateway to 5.13.4. 

2019-02-01

Nexus is proud to announce the availability of Nexus Hybrid Access Gateway 5.13.1. Click here for release note.

Main new features in this release:

• It is now possible to login to Swedish BankID using a QR code. This featured function is optional. 
• The Ubuntu base image of the virtual appliance was updated from version 14.04 to version 18.04. This update includes many fixes of vulnerabilities related to the previous operating system version. See also Hardening of the Hybrid Access Gateway appliance. Since the virtualization tools are no longer included in the Ubuntu base image then the appliance now requires internet access to install them.

2018-11-16

Nexus is proud to announce the availability of Nexus Hybrid Access Gateway 5.13. Click here for release note.

Main new features in this release:

• OpenID Connect is now supported by Hybrid Access Gateway
  The federation technology OpenID Connect can now be used as an authentication method in Nexus Hybrid Access Gateway. This means that Hybrid Access Gateway can be connected to external Identity Providers (IdPs) that support OpenID Connect, for example Google, Norwegian BankID and Verimi.

• Added support for Oracle database
  The new version of Hybrid Access Gateway has support for Oracle database to be used as external database.

  Due to required changes on a database level a dialect must be added if using an external report database before upgrading to the new version. Without the dialect entry, the connection to the reporting database will fail unless the entry was entered and the administration service was restarted. For further information, see Change report database for Hybrid Access Gateway.

• Direct integration of Nexus Personal Desktop
  Secure login is now even more convenient in Hybrid Access Gateway, with added smart card support via Nexus Personal Desktop, which is useful, for example, to make digital signatures in Nexus GO Signing.

• Improved hardening of appliance
  With Hybrid Access Gateway 5.13 the hardening index of the appliance was improved to be even more secure. The overall hardening score (based on Lynis) was increased to 74.

  To improve the hardening index of Hybrid Access Gateway, an SSH configuration parameter (MaxAuthTries) was introduced with Hybrid Access Gateway version 5.13.0. This configuration parameter limits the maximal authentication attempts to the amount of two. This change can affect the SSH authentication, if the client has more than one private key configured that is not configured for the corresponding user in Hybrid Access Gateway. In this case, an authentication with username and password will fail. If this setting affects you, you can increase the amount of authentication attempts.

  To increase the amount of authentication attempts:

  1. Change the parameter 
     MaxAuthTries within the file /etc/ssh/sshd_config to a suitable number.

  In case of Hybrid Access Gateway upgrades, this change has to be done after the appliance has been upgraded successfully.

2018-05-07

Nexus is proud to announce the availability of Nexus Hybrid Access Gateway 5.12. Click here for release note.

Main new features in this release:

• OATH authentication with Google Authenticator et al
  The OATH authentication method in Hybrid Access Gateway now supports software token like Google Authenticator or Microsoft Authenticator. With Personal Mobile 3.7 or higher Nexus provides its own implementation of OATH as a software token.
• Authentication with Freja eID
  With the introduction of Freja eID, Hybrid Access Gateway now supports three different Swedish eIDs. It supports (Mobilt) BankID and Freja eID over a native interface and AB Svenska Pass over SAML.

• Authentication with Personal Mobile certificate
  Besides raw keys Personal Mobile also supports profiles with certificates. In this case the certificates were issued by a CA such as Nexus Certificate Manager. Hybrid Access Gateway now supports authentication with these certificates without the need to know about the user and its user name.

2018-05-03

For customers who use Hybrid Access Gateway together with Nexus Personal Mobile, it is recommended to start preparing for Hybrid Access Gateway 5.12, that is soon to be released.

2017-12-21

Nexus is proud to announce the availability of Nexus Hybrid Access Gateway 5.11.2. Click here for release notes.

Important issues fixed in this release:

• Nexus GO Authentication with Swedish BankID
  With the first version of the NexusGO authentication method it was not possible to map the login credential of BankID (personnel number) to an attribute of the Hybrid Access Gateway user. The user id was used by default. Therefore, the user in Hybrid Access Gateway needed to have the BankID as user id. 
  A new Extended Property "User Attribute" has been added to allow mapping to, for example, an AD attribute.