Release Notes

file:///T|/htdocs/SOFTWARE/svradmin/5.1/en/readme/readme_sa.txt[10/23/2012 1:31:47 PM]
* To allow Single Sign-on for Server Administrator, without prompts
for user credentials, perform the following steps:
1. Navigate to "Tools" in Internet Explorer.
2. Under "Tools", click "Internet Options"
3. Under "Internet Options", click the "Security" tab.
4. Select "Trusted sites".
5. Click the "Custom Level" button.
6. Under "User Authentication", select the "Automatic Logon with
current username and password" radio button. Press ‘OK’ to exit
the “Custom Level” window.
7. Now select the “Advanced” tab, and under "HTTP 1.1 settings",
make sure "Use HTTP 1.1" is checked.
8. Click "OK" and restart your browser.
* If you run a security scanner tool (such as Nessus) against the
Server Administrator Web server, certain security warnings against
port 1311 running the Server Administrator Web server might be
displayed. The following warnings have been investigated by Dell
engineering and are determined to be "false positives"
(invalid security warnings) that you can safely ignore:
* "The Web server on 1311 allows scripts to read sensitive
configuration and / or XML files." Dell has determined that this
warning is a false positive.
* "The Web server on 1311 allows to delete " / " which implies that
the Web server will allow a remote user to delete the files in
root on the server." Dell has determined that this warning is a
false positive.
* "The Web server on 1311 might be susceptible to a 'WWW Infinite
Request' attack." Dell has determined that this warning is a false
positive.
* "It is possible to make the remote thttpd server execute arbitrary
code by sending a request like: GET If-Modified-Since:AAA[...]AAAA
Solution: If you are using thttpd, upgrade to version 2.0. If you
are not, then contact your vendor and ask for a patch, or change
your Web server. CVE on this one is CAN-2000-0359". Dell has
determined that this warning is a false positive.
* Enabling Integrated Windows Authentication in Internet Explorer
is not required to activate the Single Sign-On feature.
* Server Administrator security settings are not applicable for Active
Directory users. Active Directory users with read-only login can
access Server Administrator, even after access is blocked in the
preferences page of Server Administrator.