Sun Secure Global Desktop Software Relaease Notes

Sun Secure Global Desktop Software 4.
3
Release Notes
These release notes contain important information about Sun Secure Global Desktop Software
version 4.3, including system requirements, new features and enhancements, and known
limitations and problems. Read this document before you install and use this release.
Part Number: 819-6253
Revision History
Version Description
January Microsoft Windows Vista is now supported as a client platform. Additional known
2007 issues.
December
Additional known issue with SecurID authentication.
2006
November Added details of smart card support, additional known bugs and corrections to the
2006 documentation.
November
Additional known bugs and list of bug fixes.
2006
October
Additional known bugs and updated support for Certificate Authorities.
2006
September
First released version of release notes.
2006
June 2006 Beta release.
Contents
System Requirements
New Features in This Release
Changes in This Release
Fixes in This Release
End-Of-Support Statements
Known Bugs and Issues
Documentation Issues
System Requirements
This section describes the system requirements for Sun Secure Global Desktop Software 4.3. It
has the following sections:
Hardware Requirements
Installation Platforms
Operating System Modifications
Web Server Requirements
Network Requirements
Supported Protocols
Security Support
Proxy Server Support
Supported Authentication Mechanisms
Supported Applications
Requirements for the Sun Secure Global Desktop Enhancement Module
Printing Support
Smart Card Support
Platform Support for the Secure Global Desktop Client
Platform Support for the Classic Webtop
Hardware Requirements
Use the following hardware requirements as a guide and not as an exact sizing tool. For detailed
help with hardware requirements, contact a Sun Secure Global Desktop Software sales office.
The requirements for a server hosting Secure Global Desktop can be calculated based on the
total of the following:
What is needed to install and run Secure Global Desktop.
What is needed for each user who logs in to Secure Global Desktop on the server and runs
applications.
The following are the requirements for installing and running Secure Global Desktop:
256MB free disk space, plus another 300MB at install time
256MB RAM
1GHz processor
Network Interface Card (NIC)
Note This is in addition to what is required for the operating system itself and assumes the server
will be used only for Secure Global Desktop.
The following are the requirements to support users who log in to Secure Global Desktop and
run applications. The actual CPU and memory requirements can vary significantly depending on
the applications used:
20MB for each user.
On SPARC® platforms, 15MHz for each user.
On x86 platforms, 20MHz for each user.
Installation Platforms
The following are the supported installation platforms for Sun Secure Global Desktop Software
4.3:
Operating System Supported Versions
Solaris™ Operating System (Solaris OS) on SPARC platforms 8, 9, 10
Solaris OS on x86 platforms 10
Red Hat Enterprise Linux (Intel x86 32-bit) 3, 4
Fedora Linux (Intel x86 32-bit) Core 5
SUSE Linux Enterprise Server (Intel x86 32-bit) 9, 10
You may have to make some operating system modifications.
Operating System Modifications

You must make the following operating system modifications to the host before you install
Secure Global Desktop. Without these modifications the software may not install properly or
operate correctly.
Linux Kernel 2.4+ (all distributions)
Make sure you allocate swap that is at least twice the size of physical memory. So if you have
1GB RAM, increase your swap to 2GB.
Fedora Core 5
Secure Global Desktop will not install if the libXp.so.6 library is not available on the host.
This library was deprecated in Fedora Core 3. However the file is still available in the libXp
package.
The libXm.so.3 library is required to support 5250 and 3270 applications. The library is
available in the OpenMotif 2.2 package. The absence of this file no longer causes the installation
to fail.
SUSE Linux Enterprise Server 9 with Service Pack 2
Secure Global Desktop will not install if the libgdbm.so.2 library is not available on the host.
SUSE Linux Enterprise Server 9 with Service Pack 2 contains version 3 of the library by default.
You must obtain and install version 2 of the library before installing Secure Global Desktop.
SUSE Linux Enterprise Server 10
Secure Global Desktop will not install if the libgdbm.so.2 and libexpat.so.0 libraries are not
available on the host. SUSE Linux Enterprise Server 10 contains version 3 and version 1 of these
libraries by default. You must obtain and install the required version of these libraries before
installing Secure Global Desktop.
Solaris 8+ OS on SPARC Platforms
Solaris OS comes in the following distributions: Core, End User, Development and Entire
Distribution. You must install at least the End User distribution to get the necessary libraries
required by Secure Global Desktop. If you do not, Secure Global Desktop will not install.
You should install the appropriate patches for your Solaris OS version. These are available from
the SunSolve Online.
Note The patches recommended by Sun Microsystems for Solaris OS may not apply to Siemens
Solaris-based systems. For information about which patches to install on these systems, refer to
your Siemens contact or the Siemens web site.
Secure Global Desktop requires the /usr/lib/libsendfile.so library. If this library is
missing, Secure Global Desktop will not install. This library may be included with your
SUNWcsl (Core Solaris Libraries) package or you may have to apply patch 111297-01 (available
from the SunSolve Online) to get it.
Solaris 8 OS /dev/random Pseudo Device
You will not be able to log in to Secure Global Desktop on Solaris 8 OS platforms if the host
does not have the /dev/random pseudo device. You must install patch 112438-03 to obtain this
device.
Using Solaris OS as an Application Server
Each emulator session requires one pseudo-tty. For example, 50 users running 10 applications
each on one application server requires 500 pseudo-ttys.
To set the number of pseudo-ttys, first back up your /etc/system file. Then edit the file and add
the following line:
set pt_cnt=limit
where limit is the number of pseudo-ttys you require.
To create the new devices, reboot with the -r option.
See SunSolve Online for advice on increasing pseudo-ttys.
Web Server Requirements

A web server is an essential part of a working Secure Global Desktop installation. Secure Global
Desktop includes a web server, the Secure Global Desktop Web Server, that is pre-configured for
use with Secure Global Desktop. The Secure Global Desktop Web Server consists of the
following components:
Component Version
Apache HTTP Server 1.3.36
mod_ssl 2.8.27
OpenSSL 0.9.8d
mod_jk 1.2.15
Apache Jakarta Tomcat 5.0.28
Apache Axis 1.2
The Secure Global Desktop Web Server is installed when you install Secure Global Desktop.
However, you can use your own web server with Secure Global Desktop if you want. How you
do this is described in the Secure Global Desktop Administration Guide.
Network Requirements
You must configure your network for use with Secure Global Desktop:
Hosts must have DNS entries that can be resolved by all clients.
DNS lookups and reverse lookups for a host must always succeed.
All client devices must use DNS.
Client devices must be able to make TCP/IP connections to Secure Global Desktop on the
following ports:
80/tcp for HTTP connections between client devices and the Secure Global Desktop
Web Server. The port number may vary depending on the port selected on
installation.
443/tcp for accessing an HTTPS web server.
3144/tcp for standard (unencrypted) connections between client devices and Secure
Global Desktop.
5307/tcp for SSL-based connections between client devices and Secure Global
Desktop.
To be able to run applications, Secure Global Desktop must be able to make TCP/IP
connections to application servers. The ports you need to open depend on the types of
application you are using, for example:
22/tcp for X and character applications using SSH.
23/tcp for Windows, X and character applications using telnet.
3389/tcp for Windows applications configured to use Windows Terminal Services.
6010/tcp and above for X applications
The Secure Global Desktop Administration Guide has detailed information about the ports used
by Secure Global Desktop and how to use Secure Global Desktop with firewalls.
Supported Protocols
Secure Global Desktop supports the following protocols:
Microsoft Remote Desktop Protocol (RDP) version 5.2
Hypertext Transfer Protocol (HTTP)
HTTP over Secure Sockets Layer (HTTPS)
Secure Shell (SSH) version 2 or later
Citrix Independent Computing Architecture (ICA)
Telnet VT, American National Standards Institute (ANSI)
TN3270E
TN5250
Security Support
Secure Global Desktop supports secure connections from clients using the following protocols:
Secure Socket Layer (SSL) version 3.0
Transport Layer Security (TLS) version 1.0
The following encryption cipher suites are supported:
RSA_WITH_AES_256_CBC_SHA
RSA_WITH_AES_128_CBC_SHA
RSA_WITH_3DES_EDE_CBC_SHA
RSA_WITH_RC4_128_SHA
RSA_WITH_RC4_128_MD5
RSA_WITH_DES_CBC_SHA
Note the Java technology client does not support any AES cipher suites.
Secure Global Desktop supports Base 64-encoded PEM-format X.509 certificates that have been
signed with any of the following Certificate Authority (CA) certificates (root certificates):
Baltimore CyberTrust Code Signing Root
Baltimore CyberTrust Root
Entrust.net CA
Entrust.net Client CA 1
Entrust.net Client CA 2
Entrust.net Server CA 1
Entrust.net Server CA 2
Equifax Secure CA
Equifax Secure eBusiness CA 1
Equifax Secure eBusiness CA 2
Equifax Secure Global eBusiness CA
GeoTrust Global CA
The Go Daddy Group, Inc. Class 2 CA
GTE CyberTrust Root
GTE CyberTrust Global Root
GTE CyberTrust Root 5
Starfield Technologies, Inc. Class 2 CA
Thawte Personal Basic CA
Thawte Personal Freemail CA
Thawte Personal Premium CA
Thawte Premium CA
Thawte Server CA
http://www.valicert.com
VeriSign Class 1 Public Primary CA - G1
VeriSign/RSA Secure Server
Additional certificate types can be supported by installing the CA's certificate (the root
certificate) for that CA.
Proxy Server Support

To use Secure Global Desktop with a proxy server, the proxy server must support tunneling.
For the browser-based webtop, you can use HTTP, Secure (SSL) or SOCKS v5 proxy servers.
For the classic webtop, the Java technology clients can use HTTP, Secure (SSL) or SOCKS v5
proxy servers. For the Native Clients, you can only use HTTP and SOCKS v5 proxy servers.
For SOCKS v5 proxy servers, Secure Global Desktop supports the Basic and No authentication
required authentication methods. No server-side configuration is required.
Supported Authentication Mechanisms

Secure Global Desktop supports the following mechanisms for authenticating users:
Lightweight Directory Access Protocol (LDAP) version 3
Microsoft Active Directory
Network Information Service (NIS)
Microsoft Windows Domains
RSA SecurID
Web server authentication (HTTP/HTTPS Basic Authentication), including Public Key
Infrastructure (PKI) client certificates
SecurID Authentication
Secure Global Desktop works with versions 4, 5 and 6 of the RSA ACE/Server.
SecurID authentication is not supported on Solaris OS on x86 platforms.
Supported LDAP Directory Servers
As Secure Global Desktop supports version 3 of the standard LDAP protocol, you should be able
to use the LDAP login authority and the LDAP search methods for classic web server
authentication and third-party authentication with any LDAP version 3-compliant directory
server. Secure Global Desktop supports this functionality on the following directory servers:
Sun Java™ System Directory Server version 4.1+ (formerly known as Sun ONE, Netscape or
iPlanet Directory Server)
Other directory servers may work, but are not supported.
The Active Directory login authority is only supported on Microsoft Active Directory.
The Directory Services Integration (sometimes known as webtop generation) functionality is
supported on:
Sun Java System Directory Server version 4.1+ (formerly known as Sun ONE, Netscape or
iPlanet Directory Server)
Other directory servers may work, but are not supported.
Supported Applications
You can use Secure Global Desktop to access the following types of applications:
Microsoft Windows
Character applications running on Solaris OS, Linux, HP-UX and AIX
X applications running on Solaris OS, Linux, HP-UX and AIX
IBM mainframe and AS/400
Web applications (using HTML and Java technology)
Requirements For Sun Secure Global Desktop Enhancement Module

The Sun Secure Global Desktop Enhancement Module is software component that can be
installed on an application server to provide the following additional functionality to Secure
Global Desktop:
Advanced load balancing
Client drive mapping
Seamless windows (from Windows application servers only)
The following are the supported installation platforms for the Enhancement Module:
Operating System Supported Versions
Windows Server 2003
Microsoft Windows Windows 2000 Server
Microsoft Windows XP Professional
Solaris OS on SPARC platforms 8, 9, 10
Solaris OS on x86 platforms 10
Red Hat Enterprise Linux (Intel x86 32-bit) 3, 4
Fedora Linux (Intel x86 32-bit) Core 5
SUSE Linux Enterprise Server (Intel x86 32-bit) 9, 10
On Microsoft Windows XP Professional platforms, only client drive mapping is supported.
Seamless windows and advanced load balancing are not supported.
Printing Support
Secure Global Desktop supports printing to PostScript, PCL and text only printers attached to the
user's client device.
The Secure Global Desktop tta_print_converter script performs any conversion needed to
format print jobs correctly for the client printer. To convert from Postscript to PCL, Ghostscript
must be installed on the Secure Global Desktop server.
To support Secure Global Desktop PDF printing, Ghostscript version 6.52 or later must installed
on the Secure Global Desktop server. The Ghostscript distribution must include the ps2pdf
program.
Secure Global Desktop supports printing with the Common Unix Printing System (CUPS).
CUPS version 1.1.19 or later must be installed on the Secure Global Desktop server. Additional
configuration is required.
When printing from a windows application that uses the Microsoft RDP protocol, Secure Global
Desktop supports the printers supported by Windows 2000/2003. See the Windows Printer
Driver Support page for details of supported printers.
Smart Card Support

Secure Global Desktop allows users to access a smart card reader attached to their client device
from applications running on a Windows Server 2003 application server. Users can:
Log on to a Windows Server 2003 server using a smart card.
Access the data on a smart card while using an application running on a Windows 2003
Server, for example, to use a certificate for signing or encrypting an e-mail.
Secure Global Desktop should work with any Personal Computer/Smart Card (PC/SC)-compliant
smart card and reader.
Logging on to a Windows Server 2003 application server using a smart card has been tested
successfully with the following smart cards:
Client Operating System and Libraries Smart Card
ActivCard 64K
Microsoft Windows 2000 and XP Professional CryptoFlex 32K
GemPlus GPK16000
ActivCard 64K
Solaris OS with Sun Ray PC/SC Bypass package (SUNWsrcbp)
CryptoFlex 32K
ActivCard 64K
Fedora Linux with pcsc-lite 1.2.0 CryptoFlex 32K
GemPlus GPK16000
Platform Support for the Secure Global Desktop Client

To access Secure Global Desktop (at http://server.example.com/sgd), you need the Secure
Global Desktop Client and a supported web browser.
The Secure Global Desktop Client can operate in two modes:
Webtop mode - the Client uses a special web page, called a webtop, to display the controls
for a user's interaction with Secure Global Desktop. This is the default mode.
Integrated mode - the Client displays the controls for Secure Global Desktop in the user's
desktop Start Menu. Depending on other configuration factors, a web browser may only
be needed for initial authentication and for determining proxy server settings.
The following table lists the supported client platforms, the supported web browsers, and the
supported desktop menu systems when the Client is in integrated mode:
Supported Web Integrated Mode
Supported Client Platform
Browsers Support
Internet Explorer 7.0+ Microsoft Windows Start
Microsoft Windows Vista Business
Mozilla Firefox 2.0+ Menu
Internet Explorer 6.0+
Netscape 6.0+ Microsoft Windows Start
Mozilla (including Menu
Firefox) 1.4+
Netscape 6.0+ Microsoft Windows Start
Microsoft Windows 2000 Professional
Mozilla (including Menu
Firefox) 1.4+
Netscape 6.0+
Sun Java Desktop System
Solaris 8+ OS on SPARC platforms Mozilla (including
Start Menu
Firefox) 1.4+
Netscape 6.0+
Sun Java Desktop System
Solaris 10 OS on x86 platforms Mozilla (including
Start Menu
Firefox) 1.4+
Mac OS X 10.4+ Safari 2.0+ Not supported
Netscape 6.0+
Red Hat Enterprise Linux (Intel x86 32- Gnome or KDE Start
Mozilla (including
bit) 3, 4 Menu
Firefox) 1.4+
Netscape 6.0+
Gnome or KDE Start
Fedora Linux (Intel x86 32-bit) Core 5 Mozilla (including
Menu
Firefox) 1.4+
Netscape 6.0+
Gnome or KDE Start
Fedora Linux (x86_64) Core 5 Mozilla (including
Menu
Firefox) 1.4+
Netscape 6.0+
SUSE Linux Enterprise Server (Intel Gnome or KDE Start
Mozilla (including
x86 32-bit) 8, 9 Menu
Firefox) 1.4+
Red Hat Desktop version 3.0 Netscape 6.0+ Gnome or KDE Start
Mozilla (including
Menu
Firefox) 1.4+
Netscape 6.0+
Gnome or KDE Start
SUSE Linux 9.1 Personal Desktop Mozilla (including
Menu
Firefox) 1.4+
For x86_64 platforms, only 32-bit versions of web browsers are supported.
Beta versions or preview releases of web browsers are not supported.
To support the following functionality, the web browser must have Java technology enabled:
To automatically download and install the Secure Global Desktop Client.
To display an application in a web browser.
To determine proxy server settings from the user's default web browser.
The following are the supported Plug-ins for Java technology:
Sun Java Plug-in version 1.6.0 (Microsoft Windows Vista only).
This Plug-in is the only supported Plug-in for Microsoft Windows Vista. This Plug-in is
not supported on any other client platform.
Sun Java Plug-in version 1.5.0
For best results, client devices must be configured for at least 256 colors.
Serial port mapping is only supported on Unix, Linux and Windows platforms.
Platform Support for the Classic Webtop

To use the classic webtop (at http://server.example.com/tarantella) you need either the
Sun Secure Global Desktop Native Client or the Java technology client running in a web
browser.
The following table lists the supported client platforms and the supported web browsers and
Native Clients for those platforms.
Supported Web
Supported Client Platform Supported Native Client
Browsers
Netscape 6.0+ Native Client for
Mozilla (including Microsoft Windows
Firefox) 1.4+
Netscape 6.0+ Native Client for
Microsoft Windows 2000 Professional
Mozilla (including Microsoft Windows
Firefox) 1.4+
Netscape 6.0+
Solaris 8+ OS on SPARC platforms Mozilla (including Native Client for UNIX
Firefox) 1.4+
Netscape 6.0+
Solaris 10 OS on x86 platforms Mozilla (including Native Client for UNIX
Firefox) 1.4+
Native Client for Mac OS
Mac OS X 10.4+
X
Netscape 6.0+
Red Hat Enterprise Linux (Intel x86 32-
Mozilla (including Native Client for Linux
bit) 3, 4
Firefox) 1.4+
Netscape 6.0+
Fedora Linux (Intel x86 32-bit) Core 5 Mozilla (including Native Client for Linux
Firefox) 1.4+
Netscape 6.0+
SUSE Linux Enterprise Server (Intel
Mozilla (including Native Client for Linux
x86 32-bit) 8, 9
Firefox) 1.4+
Netscape 6.0+
Red Hat Desktop version 3.0 Mozilla (including Native Client for Linux
Firefox) 1.4+
Netscape 6.0+
SUSE Linux 9.1 Personal Desktop Mozilla (including Native Client for Linux
Firefox) 1.4+
Beta versions or preview releases of web browsers are not supported.
A supported web browser must have Java technology enabled. The following are the supported
Plug-ins for Java technology:
Because of changes to security in Secure Global Desktop version 4.0, you cannot use the version
4.x Native Clients or Java clients to connect to a version 3.x Secure Global Desktop server. You
must use a version 3.x client instead.
For best results, client devices must be configured for at least 256 colors.
Client limitations
The Native Clients and Java technology clients are no longer being actively developed, but they
are still supported. Support for these client types will cease in a future release of Secure Global
Desktop. The following lists the limitations of these client types:
Client drive mapping is only supported by the Java technology client on Microsoft
Windows client platforms.
PDF printing is only supported by the Native Client and Java technology client on Microsoft
Audio is only supported by the Native Client on Solaris OS, Linux, Mac OS X and Microsoft
Seamless windows is not supported.
Smart cards are only supported by the Native Client on Solaris OS, Linux and Microsoft
Web server and third-party authentication is not supported by the Native Client.
Serial port mapping is not supported.
New Features in This Release

The new features of Sun Secure Global Desktop Software 4.3 are:
Closer integration with client desktop systems
Integration with the Desktop Start Menu
Single Sign-on
Managing Client Configuration With Profiles
Mobile Proxy Server Configuration
Enhanced Command Line for the Secure Global Desktop Client
Manually Installable Secure Global Desktop Client
Enhanced support for Windows, Unix and Linux applications
New X Server
PDF Printing for UNIX, Linux and Mac OS X Clients
Client Drive Mapping for UNIX and Linux Applications
Support for Serial Ports in Windows Applications
Support for the Remote Desktop on Microsoft Windows XP Professional
Support for Connections to the Console Session with Windows Server 2003 Terminal
Services
More Security
Initial Connection Is Always Secure
Protecting Clients Against Unauthorized Servers
Controlled Copy and Paste
Support for SecurID for Application Server Authentication
Support for Users in Different Locales
Localized User Interface
Translated Documentation
Language Support in Expect Scripts
Integration with the Desktop Start Menu

The Secure Global Desktop Client can now operate in either of the following modes: Webtop
mode and Integrated mode.
Webtop mode - uses a web browser to display the webtop in the same way as previous
releases. This is the default mode.
Integrated mode - the webtop content (the links for starting applications) display in the
desktop Start Menu so that users can run remote applications in the same way as local
applications. Depending on how you configure Start Menu integration, there may be no
need to use a web browser.
Note Integrated mode is the recommended mode if your organization prefers not to use Java™
technology on the client device. Integrated mode is not available for the classic webtop.
To use Integrated mode, the user must log in to Secure Global Desktop by clicking the Login
link on their desktop Start Menu. Integrated mode is not available if you start a web browser and
log in.
Working in integrated mode simplifies session management. Unlike the webtop, there are no
controls for suspending and resuming applications. Instead, when the user logs out, the Client
automatically suspends or ends all running emulator sessions. When the user logs in again, the
Client automatically resumes all suspended sessions.
Printing is simplified too, printing is always "on" and print jobs go straight to the printer the user
selected. Unlike the webtop, print jobs cannot be managed individually.
If the user needs to display a webtop, for example to resume a suspended application or manage
printing, they can click the Webtop link on the Start Menu. The webtop is displayed in their
default web browser.
If the user has arranged any of their webtop content to display in groups, those groups are also
used in the Start Menu. If the group is configured to hide webtop content, the content does not
display in the Start Menu.
To log out of Secure Global Desktop, the user clicks the Logout link on the Start Menu.
For details of which desktop systems can be used in integrated mode, see Platform Support for
the Secure Global Desktop Client.
Administration Guide Reading
Integrating Secure Global Desktop with the desktop Start Menu
Configuring the Sun Secure Global Desktop Client for desktop Start Menu integration
Can users access Secure Global Desktop without Java™ technology?
Single Sign-on
It is now possible to configure the Secure Global Desktop Client so that it starts automatically
when a user logs in to their client device. The Client can also cache an authentication token that
allows a user to start a webtop session automatically without having to log in manually. When
the Client is configured in this way, users experience the benefits of a single sign-on.
Automatic login is achieved through a new authentication token login authority (ATLA). If the
Client presents a valid authentication token, the user is automatically authenticated to Secure
Global Desktop. To generate an authentication token, users must perform an initial log in using a
web browser and then manually generate the authentication token by editing their profile. A
separate token is needed for each Secure Global Desktop server the user connects to.
The authentication token login authority
Using the authentication token login authority for automatic logins
The tarantella tokencache command
Managing Client Configuration With Profiles

The desktop Start Menu and single sign-on features mean that the Secure Global Desktop Client
requires some configuration to be able to connect to Secure Global Desktop. Not only that,
different configurations may be needed in different situations, for example because the user is in
the office or working at home. To be able to manage multiple Client configurations, this release
introduces profiles as the method for storing a group of Client settings. Each profile allows you
to configure the following:
The URL to connect to.
The operating mode of the Client, whether Webtop mode or Integrated mode.
Whether automatic logins are enabled.
Whether the Client should start automatically when the user logs in to their client device.
Proxy server configuration, whether the settings are manually configured in the profile or
determined from the web browser.
Reconnection settings for controlling what happens when the Client loses its connection with
Secure Global Desktop.
Logging settings for controlling what information is written to the Client log file.
The path to the PDF viewer used for PDF printing on Solaris OS, Linux and Mac OS X
clients.
Secure Global Desktop Administrators have full control over the creation of profiles. On an
Administrator's webtop there is a new administration tool, Profile Editor, that allows you to
create and edit profiles for organization, organizational unit (OU) and profile objects in the
Tarantella System Objects organization. By defining profiles for these objects , Administrators
can deploy common default Client configurations to users.
Administrators can also control whether users can create and edit their own profiles. User profile
editing can be enabled array-wide, for an organization, for an OU or for individual users. By
default, user profile editing is enabled. Users create and edit profiles from the Edit button on
their webtop.
There is a system-wide default profile, which is configured to give users the standard webtop
behavior available in previous releases. Administrators can edit this profile.
Once the Client is connected to Secure Global Desktop, the profile configured for the user is
copied from the Secure Global Desktop server to the client device. If a user edits their profile,
the changes are stored only on the client device.
Profiles and the Sun Secure Global Desktop Client
Profile Editing (--editprofile)
Mobile Proxy Server Configuration

When users connect to Secure Global Desktop from a variety of locations, there is often a need
for different client proxy server settings. Ensuring that users have the correct proxy settings can
also be difficult to administer. This release introduces mobile proxy server configuration which
allows the Secure Global Desktop Client to use the profile to determine the proxy server settings.
The profile allows proxy settings to be specified:
Manually - the proxy settings are stored in the profile itself.
Automatically - the proxy settings are obtained from the user's default web browser.
If the Client is running in Integrated mode and configured to use the web browser settings, the
Client obtains the proxy settings by loading the URL specified in the profile in the user's default
web browser. As the Client caches the settings it obtains, the Client can be configured to use the
settings in the cache so that the user's default web browser only has to be started once.
Note to be able to determine the proxy settings from a web browser, the web browser must have
Java technology enabled.
Using Secure Global Desktop with proxy servers
Profiles and the Sun Secure Global Desktop Client
Enhanced Command Line for the Secure Global Desktop Client

To support the use of profiles, the command line for the Secure Global Desktop Client on all
platforms has been enhanced. There are now arguments to specify:
The profile to use.
The URL to connect to (overrides the URL in the profile).
The preferred language to use.
The application to start (for launching single applications).
These enhancements allow you to create your own scripts for starting the Client and for running
single applications.
Working with the Sun Secure Global Desktop Client
Launching a single application without displaying a webtop
Manually Installable Secure Global Desktop Client

To support running the Secure Global Desktop Client in Integrated mode or in environments that
have web browsers without Java technology enabled, you can now manually download and
install the Secure Global Desktop Client. You download the Client from a Secure Global
Desktop Server at http://server.example.com. Click Install the Sun Secure Global Desktop
Client.
Working with the Sun Secure Global Desktop Client
New X Server
This release includes a new X server, based on X11R6.8.2. The new X server delivered
significant speed and bandwidth use improvements in benchmark tests when compared to
version 4.2.
The updated server supports the following X extensions:
BIG-REQUESTS
BLINK
DAMAGE
DEC-XTRAP
DOUBLE-BUFFER
Extended-Visual-Information
GLX
MIT-SCREEN-SAVER
MIT-SHM
MIT-SUNDRY-NONSTANDARD
NATIVE-WND
RDP
RECORD
RENDER
SCO-MISC
SECURITY
SGI-GLX
SHAPE
SYNC
TOG-CUP
X-Resource
XC-APPGROUP
XC-MISC
XFIXES
XFree86-Bigfont
XTEST
XTTDEV
The new X server also includes support for some additional X fonts. The Speedo font is no
longer available.
New Enable X Security Extension Attribute
X application objects have a new attribute, Enable X Security Extension (--
securityextension), which allows you to enable the X Security Extension for an application.
If you need to run an X application from a host that may not be secure, you should enable the X
Security Extension and run the application in untrusted mode. This restricts the operations that
the X application can perform in the X server and protects the display. X security only works
with versions of SSH that support the -Y option. For OpenSSH, this is version 3.8 or later.
What X fonts are installed?
Enable X Security Extension (--securityextension)
Installing and using SSH with Secure Global Desktop
PDF Printing for UNIX, Linux and Mac OS X Clients

The Secure Global Desktop Client on UNIX, Linux and Mac OS X client devices now supports
PDF printing. On these clients, printing to a Secure Global Desktop PDF printer causes the
document to be displayed in a PDF viewer where the file can be printed and/or saved. By default
Secure Global Desktop supports the following PDF viewers.
Client Platform Default PDF Viewer
Solaris OS on SPARC platforms Adobe Reader (acroread)
Solaris OS on x86 platforms GNOME PDF Viewer (gpdf)
Linux GNOME PDF Viewer (gpdf)
Mac OS X Preview.app
To be able to use a default viewer, the application must be on the user's PATH.
If an alternative PDF viewer is preferred, the full path to the alternative viewer can be specified
in the profile used by the Secure Global Desktop Client.
Note when specifying a PDF printer on UNIX, Linux and Mac OS X client devices, there is no
difference between the "Universal PDF" and "Print to Local PDF File" printers as the document
is always displayed in a PDF viewer.
PDF printing on Microsoft Windows client devices is unchanged.
Configuring Secure Global Desktop PDF printing
Client Drive Mapping for UNIX and Linux Applications

Client drive mapping is now available for UNIX and Linux applications. This applies to the
Secure Global Desktop Client, the Native Client and the Java technology client.
When you enable client drive mapping in Array Manager this enables client drive mapping for
UNIX, Linux and Windows applications.
The attributes for managing access rights to client drives available for organization,
organizational unit and person objects apply only to Windows client devices regardless of
whether they are connected to Windows, UNIX or Linux applications.
As in the previous release, the drives that are mapped for UNIX, Linux and Mac OS X client
devices are controlled by entries in the user's configuration file, $HOME/.tarantella/native-
cdm-config.
For client drive mapping to be available for UNIX and Linux applications:
The Sun Secure Global Desktop Enhancement Module must be installed and running on the
UNIX and Linux application server. Currently you have to manually start the client drive
mapping service with the /opt/tta_tem/bin/tem startcdm command.
The application server must have an Network File System (NFS) server installed and
running. The NFS server must export a directory that will be used for client drive
mapping. By default, this is /smb. It is possible to specify a different directory in the
/opt/tta_tem/etc/client.prf file. The entry in this file has the format
NFS_server/mount/mountpoint .
Client drive mapping must be enabled in the array.
The Secure Global Desktop client drive mapping service must be started in the array,
tarantella start cdm.
The access rights to client drives must be configured in Object Manager (for Windows
clients) and in the user's configuration file (UNIX, Linux and Mac OS X clients).
When client drive mapping is enabled, the user's client drives or file systems are available by
default in the My SGD drives directory in the user's home directory. The My SGD drives
directory is a symbolic link to the NFS share that is used for client drive mapping.
Configuring client drive mapping
Support for Serial Ports in Windows Applications

Users running Windows applications on a Windows Terminal Server can now access the serial
ports on their client device.
To be able to access a serial port:
COM port mapping must be enabled in the Terminal Services Configuration (it is by default).
Serial port mapping must be enabled on the Array properties panel in Array Manager (it is by
default).
Access to serial ports must enabled for either an organization, an organizational unit or a
person object. Access permissions can be inherited.
Secure Global Desktop clients must be able to enumerate the serial ports on client devices.
The Secure Global Desktop Administration Guide has details of how to map serial ports.
Users must have read-write access to the serial ports that they want to access.
Serial port mapping is available to the Secure Global Desktop Client and the Native Client
running on Windows, Solaris and Linux client devices.
Configuring access to serial ports
Serial Port Mapping (--serialport)
Support for the Remote Desktop on Microsoft Windows XP Professional

Microsoft Windows XP Professional includes the Remote Desktop feature that allows you to
access a computer using the Remote Desktop Protocol. You can now use Secure Global Desktop
and Remote Desktop, for example, to give users to access their office PC when they are out of
the office. Only full Windows desktop sessions are supported.
You can also install the Secure Global Desktop Enhancement Module on Windows XP
Professional to provide support for client drive mapping. Advanced load balancing and seamless
windows are not supported.
Using Remote Desktop on Microsoft Windows XP Professional
Support for Connections to the Console Session with Windows Server 2003
Terminal Services
The Secure Global Desktop Terminal Services Client (ttatsc) now supports an additional
-console option which allows you to connect to the console session with Windows Server 2003
Terminal Services.
You can specify this option with the Protocol Arguments (--protoargs) attribute on the
Windows application object.
Initial Connection Is Always Secure

When Secure Global Desktop is first installed, the initial connection between a Secure Global
Desktop client and a Secure Global Desktop server is secured with SSL. However, after the user
has logged in, the connection is downgraded to a standard connection. To be able to use SSL
permanently for connections to Secure Global Desktop, you must enable Secure Global Desktop
security services.
Port 5307/tcp is used for SSL-based connections between client devices and Secure Global
Desktop. You may have to open this port in your firewall to allow clients to connect.
If you are using the array routes feature (tarantella config edit --tarantella-config-
array-netservice-proxy-routes) and a route includes the :ssl option, you must configure
the Secure Global Desktop SSL Daemon to accept unencrypted connections using the Accept
plaintext on secure port attribute on the server-specific Security Properties panel in Array
Manager (tarantella config edit --security-acceptplaintext).
Securing client connections with Secure Global Desktop security services
Using Secure Global Desktop with proxy servers
Protecting Clients Against Unauthorized Servers

As the Secure Global Desktop Client can now start and log in automatically, it is vital that users
only connect to a host that is trusted. In this release, users must explicitly authorize the
connection to Secure Global Desktop.
When a user connects to a Secure Global Desktop host for the first time, they see an Untrusted
Initial Connection warning message that asks them whether they really want to connect to the
host. The message displays the hostname and fingerprint of the security certificate for the server
they are connecting to. Users should check these details before clicking Yes. Once a user has
agreed to the connection, they are not prompted again unless there is a problem.
To ensure that users only connect to Secure Global Desktop servers that are trusted, Secure
Global Desktop Administrators should:
Provide users with a list of hostnames and fingerprints for the servers that are trusted. Use the
tarantella security fingerprint command on each member of the array to obtain a
list of fingerprints.
Explain to users the security implications of agreeing to connect to server.
In a fresh installation, each Secure Global Desktop host has its own self-signed security
certificate. Administrators should obtain and install a valid X.509 certificate for each Secure
Global Desktop host.
Note If you are using the classic webtop, the Java technology client prompts users every time it
connects to a Secure Global Desktop server. The Native Client never prompts users.
Users and trusted Secure Global Desktop servers
The tarantella security fingerprint command
User prompts and X.509 certificates
Controlled Copy And Paste

Secure Global Desktop Administrators now have control over copy and paste operations in
Windows and X application sessions. Administrators can configure copy and paste as follows:
Copy and paste for Secure Global Desktop as a whole can be enabled or disabled.
Copy and paste can be enabled or disabled for organization, organizational unit or person
objects. This gives Administrators control over who is allowed to copy and paste.
Applications can be assigned a Clipboard Security Level. Data can only be copied if the
target application (the application receiving the data) has the same Clipboard Security
Level or higher as the source application. This allows Administrators to secure the data
available through particular applications.
The Secure Global Desktop Client can be assigned a Clipboard Security Level. Data can only
be copied to applications running on the client device if the Secure Global Desktop Client
has the same Clipboard Security Level or higher as the source application. This allows
Administrators to secure the flow of data outside of Secure Global Desktop.
If a user attempts a copy and paste operation that is not permitted, for example because of
differing security levels, they paste the following message instead of the copied data:
Sun Secure Global Desktop Software: Copied data not available to this
application
Using copy and paste with Secure Global Desktop
Users are unable to copy and paste text or graphics
Clipboard Access (--clipboard)
Clipboard Security Level (--clipboardlevel)
Support for SecurID for Application Server Authentication

As well as using RSA SecurID to authenticate users to Secure Global Desktop, you can use
SecurID for application server authentication when launching X and character applications.
To use SecurID authentication, you should first ensure that users can log to the application server
in using SecurID before introducing Secure Global Desktop. When you are ready to use SecurID
authentication, configure the application to use the securid/unix.exp Login script.
Using SecurID for application server authentication
Login scripts supplied with Secure Global Desktop
Localized User Interface
This release contains localized user interfaces for:
French
Japanese
Korean
Simplified Chinese
Traditional Chinese
By visiting a different URL or selecting a language on the Secure Global Desktop Web Server
home page (http://server.example.com), users can run a webtop in their preferred language.
The Secure Global Desktop Client too can be started in a preferred language.
The following are not localized:
The administration tools Object Manager and Array Manager
The classic webtop
The Secure Global Desktop Native Client and Java technology client
Working with users in different locales
Translated Documentation
The following translations of Secure Global Desktop Documentation are available:
Release Administration User
Language Installation Guide
Notes Guide Guide
French Yes Yes No Yes
Japanese Yes Yes Yes Yes
Korean Yes Yes No Yes
Simplified Chinese Yes Yes No Yes
Traditional Chinese Yes Yes No Yes
Not all pages in the Administration Guide have been translated into Japanese.
Language Support in Expect Scripts

The Expect scripts used to start applications on application servers have also been enhanced to
support system prompts in different languages. By default, the languages supported by Secure
Global Desktop are supported.
To allow the Expect scripts to work with system prompts in different languages, there is new
Host Locale (--hostlocale) attribute on host objects that allows you to specify the locale of the
host.
Host Locale (--hostlocale)
Changes in This Release

Sun Secure Global Desktop Software 4.3 contains the following changes:
Single Installable Package
SSL Daemon Always Running
User Preferences File on UNIX, Linux and Mac OS X Client Devices
Window Close Action (--windowclose) Attribute
Support for PAM for UNIX User Authentication
PDF Printing
Client Certificates for Active Directory Login Authority
Secure Global Desktop Certificate Store
Licensing
Application Connection Methods
Simultaneous Webtop Connections Attribute
Mainframe (3270) Applications
Single Installable Package

This release introduces a single package for installing Secure Global Desktop. When you install
Secure Global Desktop, you install all the packages that previously had to be installed separately
(including the font packages). The use of the components is controlled by the license keys
installed in the array.
SSL Daemon Always Running

As the initial connection to Secure Global Desktop is now always secure, this means that the
Secure Global Desktop SSL Daemon is always running even if Secure Global Desktop security
services have not been enabled.
User Preferences File on UNIX, Linux and Mac OS X Client Devices

In previous releases, a user preferences file was used to configure the Secure Global Desktop
Client on UNIX, Linux and Mac OS X client devices. With the introduction of profiles, the
preferences file is only used for the Native Client on these platforms.
Window Close Action (--windowclose) Attribute
In previous releases, the Window Close Action (--windowclose) attribute was only available to X
applications that were configured to display using client window management. The use of this
attribute has been extended to include X, Windows and character applications that are configured
to display using an independent window.
The change means that closing an independent window may end or suspend the emulator
session. The default is to end the session.
Support for PAM for UNIX User Authentication

Secure Global Desktop now supports PAM (Pluggable Authentication Modules) for UNIX user
authentication. The change affects the following login authorities:
ENS
UNIX User
UNIX Group
Secure Global Desktop uses PAM for user authentication, account operations and password
operations.
When you install Secure Global Desktop on Linux platforms, Setup automatically creates PAM
configuration entries for Secure Global Desktop by copying the current configuration for the
passwd program and creating the /etc/pam.d/tarantella file. On Solaris OS platforms, you
can add a new entry for Secure Global Desktop (tarantella) in the /etc/pam.conf file if
required.
Using PAM gives Secure Global Desktop Administrators more flexibility and control over UNIX
user authentication, for example by adding new login tests, account limits, or valid password
checks.
PDF Printing
As a result of the changes introduced in this release to support PDF printing on UNIX, Linux and
Mac OS X client devices, the Display Adobe Reader Print dialog (--pdfprompt) attribute has
been removed from the Printing properties panel in Array Manager and from the Printing panel
for organization, organizational unit and person objects in Object Manager.
This change means that when users print with the Universal PDF printer on Windows clients, the
print job is automatically sent to the client's default printer. To be able to choose which client
printer the print job is sent to, users must now select the Print to Local PDF File printer.
Client Certificates for Active Directory Login Authority

When using the Active Directory login authority, there is a new Use Certificates checkbox on the
Secure Global Desktop Login properties panel in Array Manager. If Active Directory is
configured to require client certificate and you have created and installed a client certificate for
Secure Global Desktop, then you no longer need to configure the username and password of a
privileged user.
Secure Global Desktop Certificate Store

The password used for the Secure Global Desktop certificate store
(/opt/tarantella/var/info/certs/sslkeystore) is no longer hard-coded to 123456.
Instead each store now has a random password, which is stored in
/opt/tarantella/var/info/key. Use this password with the -storepass and -keypass
options when using keytool.
Licensing
Version 4.2 contained the following changes to licensing:
Activation license keys are no longer required to enable an array.
Named user licensing is no longer available.
Maintenance and Right to upgrade license keys are no longer available.
If you upgrade from an earlier version your existing product license keys will be automatically
converted and your existing Maintenance and Right to upgrade license keys will be deleted.
Application Connection Methods

From version 4.1, Secure Global Desktop no longer supports the rlogin and rcmd connection
methods for starting applications. If you upgrade from an earlier version, you must change the
connection method for any applications that use these methods.
Simultaneous Webtop Connections Attribute

From version 4.1, Secure Global Desktop uses a different attribute for the Maximum
simultaneous webtop connections setting (--tuning-maxconnections). If you upgrade from an
earlier version, the default setting for this attribute will be applied.
Mainframe (3270) Applications

From version 4.0, Secure Global Desktop uses a different emulator for mainframe (3270)
applications. 3270 character and 3270 X application objects are no longer available and have
been replaced by a single 3270 application object. As the new 3270 application object has
several new attributes, it is not possible to upgrade existing 3270 application objects. If you
upgrade from an earlier version, your existing 3270 character and 3270 X applications will be
deleted when you upgrade and you will need to re-configure them.
Fixes in This Release
This section list the significant bug fixes contained in this release. They are divided into the
following areas:
Administration Tools
Application Launch
Audio
Client Drive Mapping
Clients and Webtop
Emulation
Installation and Upgrade
Internationalization and Localization
Licensing
Other
Printing
Security
Server
User Authentication
Web Services
Administration Tools
Refer
Description
ence
6433
/usr/bin owner is changed to ttasys on startup.
525
6436 The tarantella object new_xapp command does not

735 accept the --accel argument.
6437 Object Manager shows a warning message after renaming

203 an ENS object.
6445 Shadowing from the command line takes an invalid
405 session id.
6447
X authority cookies should not be passed via environment.
937
6450 Attributes cannot be specified in object creation but can be
323 set in object edit.
6451 tarantella license commands and Array Manager
537 display obsolete software components.
Application Launch
Ref
ere Description
nce
635
The Native Client cannot launch a web browser on Solaris
700
OS.
3
635
Native Client shifts up the full-screen webtop on Java
702
Desktop System.
2
639
227 X authorization issue causes launch failure.
9
640
With optimizelaunch enabled in the unix.exp login script,
194
the expired password handler does not work.
9
640
The filtering script (runsubscript.exp) is not being called
580
during the launch process.
8
641
Error message is displayed when a new browser window
695
application is ended with the 'X' button.
1
641
The authentication dialog returns corrupted data if the
957
password has more than eight characters.
4
642
718 Launch failure when the host is not known to ssh.
9
643
466 Password expiry handling on application launch is broken.
0
644
There should only be one ttacpe process created for each
755
webtop session.
1
645
Launch failure when ssh used over su for an application
537
running on the Secure Global Desktop host.
8
646
# characters in system login banner cause automated launch
480
process to fail.
9
647
017 Add support for SecurID ACE agent for PAM.
3
647
Custom Certificate Authority certificates not recognized and
530
cause a prompt when launching in-place applications
3
647
Root window stays around when logging out of kiosk
618
Gnome session.
0
Audio
Refere
Description
nce
641638 RDP-based audio output stops playing when using a
4 SunRay.
Client Drive Mapping

Refe
renc Description
e
6409 Error copying large(ish) files from client to server over a
765 slow network in RDP sessions.
Clients and Webtop

Ref Description
ere
nce
640
Local X server application does not launch from the JSP
815
webtop.
7
641
714 The webtop frame is blank after launching an application.
0
641
Unix Native Client using a proxy server: log in, log out, log
757
in again and the Native Client hangs.
5
641
Unix Native Client: redraw problems with kiosk
763
applications.
1
642
Secure Global Desktop Client produces errors and exits
477
when logging out of the webtop.
6
643
The Native Client SEGVs if you close the connection
213
progress window.
3
646 When Secure Global Desktop restarts, the Secure Global
595 Desktop Client spins and sends out hundreds of network
9 packets.
646
817 Wait cursor problem on SunRays.
3
Emulation
Ref
ere Description
nce
638
Edited colormap.txt intermittently ignored when security
153
is enabled.
1
638
Windows Native Client and Citrix ICA X Client: possible
609
key event incompatibility.
1
641
Character terminal session closes unexpectedly when
549
function keys are pressed.
8
641
Scalable windows applications do not toggle when scroll
769
lock pressed on Java Desktop System on Solaris 10 OS.
8
642
635 ttaxpe dies with SIGSEGV
5
642
778 Copy (ctrl+insert) causes X applications to hang.
9
643
Using the Native Client on Solaris OS, kiosk mode does not
327
display correctly.
3
643
Child window sometimes comes up below the parent
543
window using seamless windows.
7
643
548 Windows applications performance in 4.3.
9
643
Segmentation fault in the ttaxpe when running the HP
552
monitoring tool.
7
644
Windows Logo keys do not work in a Terminal Services
546
session.
7
644
646 Problems with the French locale and keymap.
9
646
736 Letter repeated twice in Remote Desktop Protocol session.
8
647
Timezone redirection fails to set correct time during
139
daylight savings. Time always out by one hour.
5
647 ESC-NumLock does not work as expected from Solaris OS
295
client/SunRay.
9
Installation and Upgrade

Refe
renc Description
e
635
The default configuration for a Java Desktop Session loses
526
some important configuration parameters.
9
636
Upgrade from 4.20.909 to later builds requires a
839
maintenance or right to upgrade license.
0
636
Root certificates for secure LDAP servers are not retained
867
during an upgrade.
5
639
662 Install fails during bean creation, server will not start.
9
640
Secure Global Desktop incorrectly handles large amount of
798
free disk space at install.
5
643
091 Problems with httpd.conf file on upgrade.
3
644
Unable to uninstall Secure Global Desktop if the external
602
DNS name is incorrect.
0
645
Cannot log in to a Secure Global Desktop server after an
363
upgrade.
8
646
Secure Global Desktop is uninstalled even though user
242
selected No.
9
Internationalization and Localization
Refe
renc Description
e
6354 In Configuration Wizard, the application list shows corrupt
105 strings with multibyte characters.
6355 The Connection Progress dialog cannot display multibyte
226 characters.
6357 Cannot copy and paste from Microsoft Windows to Solaris
040 OS.
6357 Cannot copy and paste from Microsoft Windows to
075 Microsoft Windows.
6357 Cannot copy and paste from Java Desktop System to
606 Common Desktop Environment.
6362 Client drive mapping daemon crashes with a localized
374 native-cdm-config file.
6419 Windows applications should have Unicode as the Euro
511 symbol default.
6419
Server LANG environment overrides client locale setting.
523
6447 Client window mode should be accessed with an IP address
594 instead of unix socket.
6450 Problems generating an apostrophe with a Swedish
008 keyboard.
Licensing
Refere
Description
nce
646641 Secure LDAP does not work without security licenses
5 installed.
Other
Ref Description
ere
nce
637
Authentication fails with ActivCard - Cyberflex 64k Smart
560
Card (also bug ref 607218).
0
638
474 Able to read .cgi files via web browser.
6
639
A large number of users logging in in quick succession
012
hangs the Secure Global Desktop server.
6
639 New browser window gets launched when new browser
362 windows applications are launched with the CTRL key
3 pressed.
640
Secure Global Desktop Server exits with error code 129,
785
signal 0.
5
640
New blank browser window opens on exiting the application
815
opened in new browser window mode.
9
640
Secure Global Desktop Enhancement Module for Intel
911
Solaris appears to fail.
7
641
Using telnet to connect to localhost port 1023 causes the
016
Protocol Engine Manager to use 100% CPU.
1
641 Client window manager applications display Minimize and
896 Maximize buttons that are not present in original
5 application.
643
Secure Global Desktop Apache includes development
024
private paths and configurations.
3
643
Unable to copy paste to and from a WCP IWM session from
039
the classic webtop.
6
643
Setting keepalive to 0 causes keepalives to be sent
615
continuously.
5
644
214 Quitting Gnome session causes ttaxpe to use 100% CPU.
2
644
Secure Global Desktop Web Server starts but remains
627
attached to the console.
1
Printing
Ref
ere Description
nce
637
Printer properties (such as paper size) do not appear to be
622
stored between RDP sessions.
1
640
Driver name duplicated if printing is configured at OU and
629
user level.
2
642 Windows Native Client detects
128 DEFAULT_PRINTER_UNKNOWN when there is no
3 printer configured on the client device.
642
Login delay induced by inaccessible network printer
785
attached to client device.
2
Security
Refe
renc Description
e
6419 LDAP searches of Active Directory contacts AD servers in
520 other regions for information.
6446 The prompt for password change does not appear after a
338 password has expired.
6446 Cannot create an array after enabling SSL connections
437 between array members.
6457 Validate user input to the login box to prevent cross-site
984 scripting attacks.
6468
ttassl daemon core dumps due to sigsegv, signal 11.
699
6469
Apply OpenSSL security patch secadv_20060905.txt
123
6476
Apply OpenSSL security patch secadv_20060928.txt
728
6478
Cascading Stylesheets vulnerability.
735
Server
Refe
renc Description
e
637
tarantella status command report is incorrect when
974
SSL connections between array members is enabled.
3
639
Array problems when one of the array members is not
236
contactable.
5
639
Cannot successfully promote a secondary server to a
374
primary if the primary server is down.
5
644
Array behavior when joining and detaching members of an
520
array that is licensed.
0
User Authentication
Ref
ere Description
nce
638
If the krb5.conf file has errors, user login hangs and the
341
server continuously writes exceptions to jserver.log.
7
640
Ambiguous login is not allowed if invalid credentials were
012
provided the first time.
3
641
Active Directory authentication fails silently if one tree of a
570
forest is not configured in the krb5.conf file.
9
643
Windows Native Client does not display an error message if
968
an Active Directory password change fails.
8
645
426 Expect script updated for German Solaris OS applications.
1
646
Oberthur AuthentIC card not recognized when using Secure
026
Global Desktop (fixed for Windows Clients only).
3
646
Active Directory PKI infrastructure does not failover to the
556
next global catalog server.
9
647
187 SecurID login authority issues.
7
Web Services
Ref
ere Description
nce
639
Anonymous users can create and edit webtop groups. This
126
info will be stored on disk and not cleaned up.
2
642
Secure Global Desktop Web Server exposes too much
718
information.
5
End-Of-Support Statements
Customers with a valid support agreement can upgrade to the latest version of Sun Secure Global
Desktop Software free of charge.
The following table lists the end-of-support dates for previous Secure Global Desktop and
Tarantella software products:
Software Product Version Supported Until
Secure Global Desktop Enterprise Edition 4.1 March 31, 2007
Secure Global Desktop Software Appliance 4.0 March 31, 2007
Tarantella Enterprise 3 (including TASP) 3.40 March 31, 2007
Known Bugs and Issues

The following are the known bugs and issues with this release:
602423 - Terminal Emulators Cannot Distinguish Between the Return Key and the Keypad
ENTER Key
6375418 - Non-ASCII Characters in Candidate Window and Status Window of Input Method
Cannot Be Displayed
6448990 - Backslash and Yen Keys Produce the Same Character in Windows Applications
6456278 - Integrated Mode Does Not Work for the Root User on Solaris 10 x86 Platforms
6458111 - On SUSE Linux Enterprise Server 10 Client Devices, the Gnome Main Menu
Crashes When Using the Integrated Client
6458548 - Renamed Start Menu Entries for the Sun Secure Global Desktop Client Are Not
Honored
6461864 - Integrated Client Does Not Work as Expected With the Gnome Desktop on SUSE
Linux Enterprise Server 9
6463946 and 6463949 - Many Keys Do Not Work For Japanese Users in Applications That
Display in a Web Browser Window
6464809 - System Login Banners Containing Characters Such as "#", "$" or "=" Cause the
Login Scripts to Fail When the Connection Method is SSH
6466958 - You Cannot Use Shift + Click or Control + Click With the Integrated Client
6468173 - Using Secure Global Desktop on SunRays Causes the Wait Cursor to Always
Display
6468716 - Keyboard Does Not Work in Gnome Sessions on Solaris 10 OS on SPARC
Platforms
6470197 - Compiling Your Own Apache Modules for Use With the Secure Global Desktop
Web Server Fails
6476194 - Shortcuts for the Integrated Client do not Display on the KDE Desktop Menu on
SUSE Linux Enterprise Server 10
6476661 - Integrated Client Does Not Work as Expected With the Gnome Desktop on Red
Hat Enterprise Linux 4
6477187 - Client Drive Mapping Fails if the Client for Microsoft Networks Is Not Enabled
on a Microsoft Windows Application Server
6477549 - Integrated Client Does Not Work as Expected With the Gnome Desktop on Red
Hat Enterprise Linux 3
6480880 - Integrated Client Does Not Work With Relocated Webtops
6481148 - Localized Text Is Not Used During Installation
6481312 - Upgrading to Version 4.3 Resets the Available Connection Types
6482912 - Secure Global Desktop Client Will Not Install Automatically Using Internet
Explorer 7 With Microsoft Windows Vista
6486551 - Fewest Application Sessions Load Balancing Does Not Detect When a Server Is
Unavailable
6508528 - Launching an X Application Is Slow Or Fails on Application Servers That Are
Not Running Solaris OS or Linux
6518152 - The Integrated Client Start Menu is Not Updated Correctly On Microsoft
Windows Vista
List of Applications in the Desktop Start Menu Are Not Sorted Alphabetically
Start Menu Entries Do Not Display on Sun Java Desktop
Users with Sun Type 7 Japanese Keyboards Cannot Input Characters Correctly Using Secure
Global Desktop
Users Cannot Use SecurID to Authenticate to Secure Global Desktop
602423 - Emulators Cannot Distinguish Between the Return Key and the
Keypad ENTER Key
Problem
Secure Global Desktop X and character emulators cannot distinguish between the Return key
and the keypad ENTER key on the user's client keyboard.
Cause
A known issue.
Solution
By default, the Secure Global Desktop Client and the Native Client map the keypad ENTER key
to Return in both X and character emulator sessions. With additional configuration this behavior
can be changed.
To change the behavior of the keypad ENTER key in a character application session, you need
to set up a keymap for your character application object (--keymap) and add a mapping for
KPENTER, for example:
KPENTER="hello"
To change the behavior of the keypad ENTER key in a Windows/X application session, you
need to modify your X keymap (for example, xuniversal.txt) and add a mapping for the
KP_Enter key, for example:
92 KP_Enter KP_Enter NoSymbol NoSymbol 0x801c
Warning! The X keymap is a global/user resource, so all applications for that user may be
affected by this change. If any of these applications do not handle KP_Enter, then you may need
to consult your X/Windows application vendor for assistance.
Note The Java™ technology clients are unable to distinguish between RETURN and the keypad
ENTER key.
6375418 - Non-ASCII Characters in Candidate Window and Status Window

of Input Method Cannot Be Displayed
Problem
Users in Chinese (Simplified and Traditional), Japanese, and Korean locales cannot display non-
ASCII characters in the candidate and status windows of the input method when running
applications on a Solaris OS application server. This affects Solaris 8, 9, 10 and 10u1 OS
platforms.
Cause
Missing font path configuration on the Secure Global Desktop server.
Solution
Add Chinese, Japanese, and Korean font path information to the font server on the Secure Global
Desktop host.
For example, if the Secure Global Desktop Server is installed on a Solaris 10 OS platform and
you are using the Simplified Chinese input method:
1. Edit the /usr/openwin/lib/X11/fontserver.cfg file and add the Chinese font path
information as follows:
clone-self = on
use-syslog = off
catalogue
=/usr/openwin/lib/locale/zh_CN.GB18030/X11/fonts/75dpi,/usr/openwin/lib
/locale/zh_CN.GB18030/X11/fonts/TrueType,
/
usr/openwin/lib/locale/zh.GBK/X11/fonts/75dpi,/usr/openwin/lib/locale/z
h.GBK/X11/fonts/TrueType,/usr/openwin/lib/locale/zh/X11/fonts/75dpi,
/
usr/openwin/lib/locale/zh/X11/fonts/TrueType,/usr/openwin/lib/locale/zh
.UTF-
8/X11/fonts/misc,/usr/openwin/lib/locale/iso_8859_2/X11/fonts/75dpi,
/
usr/openwin/lib/locale/iso_8859_2/X11/fonts/Type1,/usr/openwin/lib/loca
le/iso_8859_2/X11/fonts/TrueType,/usr/openwin/lib/locale/iso_8859_4/X11
/fonts/75dpi,
/
usr/openwin/lib/locale/iso_8859_4/X11/fonts/Type1,/usr/openwin/lib/loca
le/iso_8859_5/X11/fonts/75dpi,/usr/openwin/lib/locale/iso_8859_5/X11/fo
nts/Type1,
/
usr/openwin/lib/locale/iso_8859_5/X11/fonts/TrueType,/usr/openwin/lib/l
ocale/ar/X11/fonts/TrueType,/usr/openwin/lib/locale/iso_8859_7/X11/font
s/TrueType,
/
usr/openwin/lib/locale/iso_8859_7/X11/fonts/75dpi,/usr/openwin/lib/loca
le/iso_8859_7/X11/fonts/Type1,/usr/openwin/lib/locale/iso_8859_8/X11/fo
nts/Type1,
/
ocale/iso_8859_9/X11/fonts/75dpi,/usr/openwin/lib/locale/iso_8859_9/X11
/fonts/Type1,
/
ocale/iso_8859_15/X11/fonts/TrueType
# in decipoints
default-point-size = 120
default-resolutions = 75,75,100,100
2. Restart the font server on the Secure Global Desktop host.
svcadm restart xfs
3. Configure Secure Global Desktop with the location of the font server.
In Array Manager, select X Protocol Engine properties.
In the Font Path box, type the details of the font server, for example tcp/boston:7100
Note Changes to font path information only take effect for new Protocol Engines only.
Existing Protocol Engines are not affected.
The Secure Global Desktop Administration Guide has more detailed information on using your
own X fonts, see "How do I use my own X fonts?"
Alternatively, on Solaris 10 OS application servers only, upgrading to the latest version of the
Internet Intranet Input Method Framework (IIIMF) should also fix the problem.
6448990 - Backslash and Yen Keys Produce the Same Character in Windows
Applications
Problem
When using Japanese PC 106 or Sun Type 7 Japanese keyboards with Windows applications
running through Secure Global Desktop, the Yen and Backslash keys produce the same result.
Cause
A known issue with key handling.
Solution
Modify the Xsun keytable or the Xorg keytable on the client device.
For example, change the /usr/openwin/etc/keytables/Japan7.kt file as follows:
...
#137 RN XK_backslash XK_bar XK_prolongedsound
137 RN XK_yen XK_bar XK_prolongedsound
...
#39 RN XK_0 XK_asciitilde XK_kana_WA XK_kana_WO
39 RN XK_0 XK_0 XK_kana_WA XK_kana_WO
...
For example, change the /usr/X11/lib/X11/xkb/symbols/sun/jp file as follows:
...
# key <AE13> { [ backslash, bar ], [ prolongedsound ] };
key <AE13> { [ yen, bar ], [ prolongedsound ] };
...
# key <AE10> { [ 0, asciitilde ], [ kana_WA, kana_WO ] };
key <AE10> { [ 0, 0], [ kana_WA, kana_WO ] };
...
After making these changes, you must restart dtlogin:
/etc/init.d/dtlogin stop
/etc/init.d/dtlogin start
6456278 - Integrated Mode Does Not Work for the Root User on Solaris 10
x86 Platforms
Problem
On Solaris 10 x86 platforms, enabling Integrated mode when you are logged in as root does not
add applications to the desktop Start Menu. You may also see the following warning:
gnome-vfs-modules-WARNING **: Error writing vfolder configuration file
"//.gnome2/vfolders/applications.vfolder-info": File not found.
Cause
A known issue with the Gnome Virtual File System (VFS).
Solution
There is currently no solution.
6458111 - On SUSE Linux Enterprise Server 10 Client Devices, the Gnome

Main Menu Crashes When Using the Integrated Client
Problem
On client devices running SUSE Linux Enterprise Server 10, the Gnome Main Menu crashes
when using the Integrated Client. The crash usually occurs on login or logout.
Cause
A known problem with the Gnome Main Menu applet on SUSE Linux Enterprise Server 10
(Novell bug reference 186555).
Solution
Disabling the Recently Used Applications functionality improves the stability of the Gnome
Main Menu.
Run the following commands on the client device:
gconftool-2 --set --type=list \
--list-type=int /desktop/gnome/applications/main-menu/lock-
down/showable_file_types [0,2]
pkill main-menu
pkill application-browser
6458548 - Renamed Start Menu Entries for the Sun Secure Global Desktop
Client Are Not Honored
Problem
When configured to operate in Integrated mode, the Sun Secure Global Desktop Client creates
entries in the desktop Start Menu. It is possible to rename these entries, but the changes are not
honored by the Client.
Cause
Renaming Start Menu entries is not supported.
Solution
Do not rename the Secure Global Desktop Start Menu entries.
6461864 - Integrated Client Does Not Work as Expected With the Gnome
Desktop on SUSE Linux Enterprise Server 9
Problem
After enabling the Automatic Client Login or the Add Applications to Start Menu options in
your profile, the Secure Global Desktop Client does not start automatically when you log in to
the Gnome Desktop and/or the Start Menu is not updated with webtop content when you log in
to Secure Global Desktop.
Cause
A known bug with Gnome Desktop on SUSE Linux Enterprise Server 9. The directories
containing the .menu files are not monitored and so changes to the Start Menu are not detected.
Solution
The workaround is run the following command to restart the gnome-panel and pick up new menu
information:
pkill gnome-panel
Note you must run this command to update the menu each time the menu changes.
6463946 and 6463949 - Many Keys Do Not Work For Japanese Users in
Applications That Display in a Web Browser Window
Problem
Japanese users working with applications that are configured to display on the webtop or in a
new browser window find that many keys do not work. Problems have been noticed with the
Windows key, the Applications key, and the Katakana, Zenkaku_Hankaku, Hiragana and
Muhenkan keys.
Cause
Applications configured to display on the webtop or in a new browser window, use the classic
Java technology client. This client has not been internationalized or localized.
Solution
Change the application's Display Using attribute so that the application displays in either a kiosk,
an independent or a seamless window.
6464809 - System Login Banners Containing Characters Such as "#", "$" or

"=" Cause the Login Scripts to Fail When the Connection Method is SSH
Problem
When the connection method is SSH, system login banners containing characters such as "#",
"$" or "=" cause the login scripts to fail.
Cause
The SGD login scripts interpret characters such as "#", "$" or "=" as a command prompt. When
the login scripts detect a command prompt, they stop checking for a password prompt.
Solution
Do one of the following:
Edit the /opt/tarantella/var/serverresources/expect/procs.exp login script.
Change the following line:
set seen_pw_or_ssh_prompt 0
to
set seen_pw_or_ssh_prompt 1
Configure SSH on your system to use client keys. This bypasses the password prompt.
Remove the characters causing the problem from the system login banner.
6466958 - You Cannot Use Shift + Click or Control + Click With the
Integrated Client
Problem
Secure Global Desktop allows users to change the way an application is displayed by holding
down the Control key when clicking the link to start an application. Holding down the Shift key
allows users to start an application as a different user. Neither of these options work when
clicking links in the desktop Start Menu (Integrated Client).
Cause
This functionality is not yet available to the Integrated Client.
Solution
To use this functionality, you must start the application from a webtop. To display a webtop,
click the Webtop link in the Start Menu.
6468173 - Using Secure Global Desktop on SunRays Causes the Wait Cursor
to Always Display
Problem
When accessing Secure Global Desktop from a SunRay, the cursor shape changes to the wait
cursor and does not change back again.
Cause
A known issue.
Solution
The workaround is to set an environment variable TTA_GNOME_VERSION that contains the version
of Gnome you are using. For example add the following lines to your .profile
TTA_GNOME_VERSION=2.6.0
export TTA_GNOME_VERSION
6468716 - Keyboard Does Not Work in Gnome Sessions on Solaris 10 OS on

SPARC Platforms
Problem
After starting a Gnome session on Solaris 10 OS on Sparc platforms, users are unable to input
anything with the keyboard. The mouse, however, does work.
Cause
A known bug with remote Gnome sessions, see http://bugzilla.gnome.org/show_bug.cgi?
id=170318. The Sun Microsystems bug reference is 6239595.
Solution
This specific problem was fixed in patch ID 119542. This patch was also included in a
cumulative patch ID 122212 for the Gnome Desktop. Both patches are available from SunSolve
Online.
The workaround is to create a Gnome configuration file
/etc/gconf/gconf.xml.defaults/apps/gnome_settings_daemon/keybindings/
%gconf.xml with the following content:
<?xml version="1.0"?>
<gconf>
<entry name="volume_up" mtime="1110896708"
type="string"><stringvalue></stringvalue></entry>
<entry name="volume_mute" mtime="1110896705"
<entry name="volume_down" mtime="1110896702"
<entry name="help" mtime="1110896698"
type="string">>stringvalue></stringvalue></entry>
</gconf>
6470197 - Compiling Your Own Apache Modules for Use With the Secure
Global Desktop Web Server Fails
Problem
When you compile your own Apache modules for use with the Secure Global Desktop Web
Server, the compilation fails because of a missing egcc compiler.
Cause
The configuration file for the Apache eXtenSion tool (apxs) that is used to build extension
modules for the Secure Global Desktop Web Server uses the egcc compiler and this may not be
available on your system.
Solution
Either modify the apxs configuration file
(/opt/tarantella/webserver/apache/version/bin/apxs) to use a compiler that is available
on your system or create a symlink for egcc that links to the compiler on your system.
6476194 - Shortcuts for the Integrated Client do not Display on the KDE
Desktop Menu on SUSE Linux Enterprise Server 10
Problem
Shortcuts for the Integrated Client do not display on the KDE Desktop Menu on SUSE Linux
Enterprise Server 10.
Cause
SUSE-specific configuration of the KDE menu system means that if a menu contains only one
application entry, then that single application is used in the main menu instead of the menu. If
menu entry is a sub-menu, the sub-menu does not display at all. This causes the Integrated Client
Login menu not to display.
Solution
The workaround is to add the following line to the [menus] section of
$HOME/.kde/share/config/kickerrc:
ReduceMenuDepth=false
Then run the following command for the KDE panel to immediately pick up the changes:
dcop kicker kicker restart
All subsequent KDE sessions will automatically use this setting.
6476661- Integrated Client Does Not Work as Expected With the Gnome
Desktop on Red Hat Enterprise Linux 4
Problem
After enabling the Automatic Client Login or the Add Applications to Start Menu options in
your profile, the Secure Global Desktop Client does not start automatically when you log in to
the Gnome Desktop and/or the Start Menu is not updated with webtop content when you log in
to Secure Global Desktop.
Cause
A known bug with Gnome Desktop on Red Hat Enterprise Linux 4
(https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=151887). The directories containing the
.menu files are not monitored and so changes to the Start Menu are not detected.
Solution
The workaround is run the following command to restart the gnome-panel and pick up new menu
information:
pkill gnome-panel
Note you must run this command to update the menu each time the menu changes.
6477187 - Client Drive Mapping Fails if the Client for Microsoft Networks Is
Not Enabled on a Microsoft Windows Application Server
Problem
Client drive mapping fails if the Client for Microsoft Networks is not enabled on a Microsoft
Windows application server.
Cause
The Client for Microsoft Networks must be enabled to allow remote access to files and folders.
Solution
Enable the Client for Microsoft Networks, as follows:
1. In Control Panel, double-click Network Connections.
2. Right-mouse click on the network card and select Properties.
3. On the General tab, check the box next to Client for Microsoft Networks.
4. Click OK.
6477549 - Integrated Client Does Not Work as Expected With the Gnome
Desktop on Red Hat Enterprise Linux 3
Problem
After enabling the Add Applications to Start Menu option in your profile, the Start Menu is not
updated with webtop content when you log in to Secure Global Desktop.
Starting the Secure Global Desktop Client from the command line may also result in the
following error:
-----------------------------------------------
process:5281): GLib-CRITICAL **: file gtree.c: line 261
(g_tree_destroy): assertion `tree != NULL' failed
----------------------------------------------
Cause
Red Hat Enterprise Linux 3 has menu editing disabled by default and so the Gnome Start Menu
is not updated.
The error message is not critical.
Solution
Enable menu editing for the Gnome Desktop, as follows:
1. Log in as root.
2. Change directory to the /etc/gnome-vfs-2.0/modules directory.
3. Move the default-modules.conf file as follows:
mv default-modules.conf default-modules.conf.without-menu-editing
4. Copy the default-modules.conf.with-menu-editing file as follows:
cp default-modules.conf.with-menu-editing default-modules.conf
Users must log out of the Gnome Desktop and log back in again for the change to take effect.
6480880 - Integrated Client Does Not Work With Relocated Webtops

Problem
If you relocate the browser-based webtop to your own JavaServer Pages (JSP) container, the
Integrated Client refuses to connect to Secure Global Desktop.
Cause
The Integrated Client requires some files from the Axis web application.
Solution
To use the Integrated Client, you must also copy the Axis web application to the remote host.
Copy everything in the
/opt/tarantella/webserver/tomcat/5.0.28_axis1.2/webapps/axis directory to the
remote host.
Note The axis directory contains several symbolic links, ensure these links are followed when
you copy the directory.
6481148 - Localized Text Is Not Used During Installation
Problem
When you install Secure Global Desktop in a supported locale, the language used during the
installation is English.
Cause
To see localized text during installation, the gettext package must be installed on the host. If this
package is missing, the installation defaults to English.
Solution
Ensure the gettext package is installed before installing Secure Global Desktop.
6481312 - Upgrading to Version 4.3 Resets the Available Connection Types

Problem
After upgrading to version 4.3, a server that was configured to accept only secure connections
now accepts standard and secure connections.
Cause
A known issue.
Solution
Re-configure the server to accept only secure connections. In Array Manager, on the Security
Properties panel for the server, uncheck the box next to Standard connections. Alternatively run
the following command:
tarantella config edit --security-connectiontypes ssl
6482912 - Secure Global Desktop Client Will Not Install Automatically Using
Internet Explorer 7 With Microsoft Windows Vista
Problem
Using Internet Explorer 7 on Microsoft Windows Vista platforms, the Secure Global Desktop
Client cannot be automatically downloaded and installed. The Client can be installed manually
and it can be installed automatically using another browser, such as Firefox.
Cause
Internet Explorer has a Protected Mode that prevents the Client downloading and installing
automatically.
Solution
Add the Secure Global Desktop server to the list of Trusted Sites list in Internet Explorer's
Security Settings.
6486551 - Fewest Application Sessions Load Balancing Does Not Detect When
a Server Is Unavailable
Problem
The Fewest application sessions method of load balancing applications does not detect when an
application server is unavailable to launch applications. The result is that Secure Global Desktop
tries to launch an application on a server that is not available and it does not fail over to the next
available host.
Cause
A known issue.
Solution
This problem will be fixed in a future release of Secure Global Desktop.
The workaround is to edit the host object in Object manager and uncheck the Available to launch
applications box (--available false). This removes the host from the list of servers that can
run applications.
6508528 - Launching an X Application Is Slow Or Fails on Application

Servers That Are Not Running Solaris OS or Linux
Problem
Launching an X application on an application server that is not running Solaris OS or Linux is
either slow or fails (times out).
Cause
A known issue with the procs.exp Expect script used to launch applications.
Solution
The workaround is to edit procs.exp script as follows:
1. Log in as root.
2. Change to the /opt/tarantella/var/serverresources/expect directory.
3. Create a back-up of the procs.exp file.
4. Edit the procs.exp file and replace the set_os function with the following:
proc set_os { } {
global os
if { $os != "" } {
return
}
send -s "uname -s\n"

expect {
-re "SunOS" {
set os "Solaris"
}
-re "Linux" {
send -s "if \[ -f /etc/redhat-release \]; then
echo \"Redhat\"; elif \[ -f /etc/SuSE-release \]; then echo \"SuSE\";
else echo \"Not available\"; fi\n"
expect {
-re "Redhat" {
set os "Redhat"
}
-re "SuSE" {
set os "SuSE"
}
}
}
-re ".*\n.*\n" {
set os "Unknown"
}
}
}
5. Save the procs.exp file.
6518152 - The Integrated Client Start Menu is Not Updated Correctly On

Microsoft Windows Vista
Problem
When using the Integrated Client On Microsoft Windows Vista clients, the Start Menu is not
updated correctly when you log in and out of Secure Global Desktop.
Cause
A known issue.
Solution
List of Applications in the Desktop Start Menu Are Not Sorted Alphabetically
Problem
When using Integrated mode on Microsoft Windows client devices, users may notice that the
Start Menu entries are not sorted alphabetically.
Cause
This is caused by a Windows feature that adds new items to end of a menu rather than preserving
the alphabetical sorting.
Solution
See Microsoft KB article 177482 for details.
Start Menu Entries Do Not Display on Sun Java Desktop
Problem
On Sun Java Desktop Systems, users may find that Start Menus entries are not created for Secure
Global Desktop when they enable Integrated mode. The Start menu entries are added when they
log out of their desktop and log in again.
Cause
A known issue with the Gnome panel.
Solution
The solution is to install the following patches:
119906-05 for Solaris OS on SPARC platforms
119907-05 for Solaris OS on x86 platforms
The workaround is to log out of the desktop and log in again.
Users with Sun Type 7 Japanese Keyboards Cannot Input Characters

Correctly Using Secure Global Desktop
Problem
Users with Sun Type 7 Japanese keyboards cannot input characters correctly using Secure
Global Desktop.
Cause
Missing Solaris OS keytable on the client device.
Solution
Install the appropriate patch to install the keytable on the client device:
Platform Required Patch
Solaris 10 OS on SPARC platforms 121868-03
Solaris 10 OS on x86 platforms 121869-03
Users Cannot Use SecurID to Authenticate to Secure Global Desktop

Problem
Users cannot use SecurID to authenticate to Secure Global Desktop.
Cause
The binary used for SecurID authentication (ttasecurid) is not included in this build.
Solution
A workaround is to use web server authentication to an RSA SecurID server.
A solution to this issue is expected in the near future. If you require further information, contact
Sun Support.
Documentation Issues
The following are the known documentation issues with this release:
Correction to the Integrated Client Documentation
Instructions for Relocating the Webtop to Another Host Do Not Work for the Integrated
Client
Correction to Supported Versions of SecurID
Correction to Instructions for Securing Connections to Microsoft Active Directory
tarantella license query command
Multiple External DNS Names and Server Certificates
Copy and Paste Documentation
Correction to the Integrated Client Documentation

Secure Global Desktop allows users to change the way an application is displayed by holding
down the Control key when clicking the link to start an application. Holding down the Shift key
allows users to start an application as a different user.
The Secure Global Desktop Administration Guide and User Guide incorrectly state that this
functionality is available when using the Integrated Client.
To use this functionality, you must start the application from a webtop. To display a webtop,
click the Webtop link in the Start Menu.
Instructions for Relocating the Webtop to Another Host Do Not Work for the
Integrated Client
The page Relocating the browser-based webtop to your own JSP container contains instructions
for moving the webtop to another host.
These instructions are valid if you want to work in Webtop mode. To use the Integrated Client,
however, you must also copy the Axis web application to the remote host. Copy everything in
the /opt/tarantella/webserver/tomcat/5.0.28_axis1.2/webapps/axis directory to the
remote host.
Note The axis directory contains several symbolic links, ensure these links are followed when
you copy the directory.
Correction to Supported Versions of SecurID
The Secure Global Desktop Administration Guide incorrectly states that the SecurID login
authority works with versions 4 and 5 of the RSA ACE/Server.
This login authority works with versions 4, 5 and 6.
Correction to Instructions for Securing Connections to Microsoft Active

Directory
The page Securing connections to Active Directory and LDAP directory servers gives
instructions on creating client certificates for use with Microsoft Active Directory. In step 9 the
instructions state "ensure DER is selected". This should be "ensure Base 64 encoded is selected".
tarantella license query command

The documentation for tarantella license query command shows the output of some
sample commands that includes TSP (Security) licenses. The tarantella license query
command no longer counts and displays information about these license types.
Multiple External DNS Names and Server Certificates

If you are using the multiple external DNS names feature and you want to enable secure
connections, you need an X.509 certificate and key for each DNS name that is being used.
To configure Secure Global Desktop to use multiple certificates, you use tarantella config
edit --tarantella-config-ssldaemon-certfiles "filter" ... command to configure
the certificate and key to use for a particular client and server combination. Each filter has the
form:
"clientip:clientport:serverip:serverport:keyfile:certfile"
On the command line, enclose each filter in quotes and use a space to separate the filters. You
can use wildcards for the ports and IP addresses. The order of the filters is important, as the first
matching filter found is used.
Set up your filters to match the same client connections as your external DNS names
configuration. For example, you configure the external DNS names as follows:
tarantella config edit --server-dns-external "192.168.5.*:boston.indigo-
insurance.com" "*:www.indigo-insurance.com"
To configure the certificates and keys for these names, run the following command:
tarantella config edit --tarantella-config-ssldaemon-certfiles \
"192.168.5.*:*:192.168.5.24:*:/opt/tarantella/var/tsp/key.pem:/opt/tarantell
a/var/tsp/cert.pem" \
"*:*:192.168.10.24:*:/opt/tarantella/var/tsp/externalkey.pem:/opt/tarantella
/var/tsp/externalcert.pem"
With this configuration, clients with an IP address beginning 192.168.5 connect to boston.indigo-
insurance.com and receive an SSL connection using the key and certificate defined in the filter.
All other clients connect to www.indigo-insurance.com. If the order of the filters was reversed,
all clients would receive an SSL connection using the key and certificate defined for
www.indigo-insurance.com.
Copy and Paste Documentation

The documentation for the new copy and paste security feature does not contain the following
last-minute changes to the software.
Non-ASCII Text
The documentation recommends that you run the Secure Global Desktop server in a UTF-8
locale to allow the successful copy and paste of non-ASCII text. However, in circumstances
where it may not be possible to do this, you can specify a UTF-8 locale by installing a UTF-8
locale and setting a TTA_TEXTCONV_LANG environment variable. For example:
TTA_TEXTCONVLANG=en_GB.UTF8; export TTA_TEXTCONVLANG
Disabling Copy and Paste to Client Devices
The documentation also recommends disabling copy and paste operations with client devices by
setting the client security level to be lower or higher than the applications being used. You can
disable all client copy and paste operations by selecting disabled from the list for the Clipboard:
Client security level attribute on the Array Properties panel of Array Manager or with the
tarantella config edit --array-clipboard-clientlevel -1 command.
Copyright © 1997-2006 Sun Microsystems, Inc. All rights reserved.

Sun Microsystems, Inc. has intellectual property rights relating to technology embodied in the
product that is described in this document. In particular, and without limitation, these intellectual
property rights may include one or more of the U.S. patents listed at http://www.sun.com/patents
and one or more additional patents or pending patent applications in the U.S. and in other
countries.
U.S. Government Rights - Commercial software. Government users are subject to the Sun
Microsystems, Inc. standard license agreement and applicable provisions of the FAR and its
supplements.
This distribution may include materials developed by third parties.Sun, Sun Microsystems, the
Sun logo, Java and Solaris are trademarks or registered trademarks of Sun Microsystems, Inc. in
the U.S. and other countries. All SPARC trademarks are used under license and are trademarks
or registered trademarks of SPARC International, Inc. in the U.S. and other countries.
UNIX is a registered trademark in the U.S. and other countries, exclusively licensed through
X/Open Company, Ltd.
Copyright © 1997-2006 Sun Microsystems, Inc. Tous droits réservés.
Sun Microsystems, Inc. détient les droits de propriété intellectuels relatifs à la technologie
incorporée dans le produit qui est décrit dans ce document. En particulier, et ce sans limitation,
ces droits de propriété intellectuelle peuvent inclure un ou plus des brevets américains listés à
l'adresse http://www.sun.com/patents et un ou les brevets supplémentaires ou les applications de
brevet en attente aux Etats - Unis et dans les autres pays.
L'utilisation est soumise aux termes du contrat de licence.
Cette distribution peut comprendre des composants développés par des tierces parties.
Sun, Sun Microsystems, le logo Sun, Java et Solaris sont des marques de fabrique ou des
marques déposées de Sun Microsystems, Inc. aux Etats-Unis et dans d'autres pays.
Toutes les marques SPARC sont utilisées sous licence et sont des marques de fabrique ou des
marques déposées de SPARC International, Inc. aux Etats-Unis et dans d'autres pays.
UNIX est une marque déposée aux Etats-Unis et dans d'autres pays et licenciée exlusivement par
X/Open Company, Ltd.

Sun Secure Global Desktop Software Relaease Notes

Uploaded by

Copyright:

Available Formats

Sun Secure Global Desktop Software Relaease Notes

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Sun Secure Global Desktop Software Relaease Notes

Uploaded by

Copyright:

Available Formats

Sun Secure Global Desktop Software 4.

Operating System Modifications

Web Server Requirements

Proxy Server Support

Supported Authentication Mechanisms

Requirements For Sun Secure Global Desktop Enhancement Module

Smart Card Support

Platform Support for the Secure Global Desktop Client

Platform Support for the Classic Webtop

New Features in This Release

Integration with the Desktop Start Menu

Managing Client Configuration With Profiles

Mobile Proxy Server Configuration

Enhanced Command Line for the Secure Global Desktop Client

Manually Installable Secure Global Desktop Client

PDF Printing for UNIX, Linux and Mac OS X Clients

Client Drive Mapping for UNIX and Linux Applications

Support for Serial Ports in Windows Applications

Support for the Remote Desktop on Microsoft Windows XP Professional

Initial Connection Is Always Secure

Protecting Clients Against Unauthorized Servers

Controlled Copy And Paste

Support for SecurID for Application Server Authentication

Language Support in Expect Scripts

Changes in This Release

Single Installable Package

SSL Daemon Always Running

User Preferences File on UNIX, Linux and Mac OS X Client Devices

Support for PAM for UNIX User Authentication

Client Certificates for Active Directory Login Authority

Secure Global Desktop Certificate Store

Application Connection Methods

Simultaneous Webtop Connections Attribute

Mainframe (3270) Applications

6436 The tarantella object new_xapp command does not

6437 Object Manager shows a warning message after renaming

Client Drive Mapping

Clients and Webtop

Installation and Upgrade

Known Bugs and Issues

6375418 - Non-ASCII Characters in Candidate Window and Status Window

6458111 - On SUSE Linux Enterprise Server 10 Client Devices, the Gnome

6464809 - System Login Banners Containing Characters Such as "#", "$" or

6468716 - Keyboard Does Not Work in Gnome Sessions on Solaris 10 OS on

6480880 - Integrated Client Does Not Work With Relocated Webtops

6481312 - Upgrading to Version 4.3 Resets the Available Connection Types

6508528 - Launching an X Application Is Slow Or Fails on Application

send -s "uname -s\n"

6518152 - The Integrated Client Start Menu is Not Updated Correctly On

Users with Sun Type 7 Japanese Keyboards Cannot Input Characters

Users Cannot Use SecurID to Authenticate to Secure Global Desktop

Correction to the Integrated Client Documentation

Correction to Instructions for Securing Connections to Microsoft Active

tarantella license query command

Multiple External DNS Names and Server Certificates

Copy and Paste Documentation

Copyright © 1997-2006 Sun Microsystems, Inc. All rights reserved.

You might also like