Release Notes

Please see this FAQ entry and this FAQ entry about changes when upgrading to 11.0 from a previous release.

Cerberus FTP Server 11 does not officially support Windows Server 2008 and 2008 R2. Cerberus will continue supporting version 10 on Windows Server 2008 and 2008 R2. Please see Minimum System Requirements for more details.

Cerberus FTP Server 11.0 introduced a couple of minor, yet backward-incompatible changes to the Cerberus SOAP API. In particular, the SOAP API operations for GetLicenseInfo and GetLogMessages now provide richer data. Please see the Cerberus SOAP API Reference for more information about the SOAP API.

Version 11.3.19 Official Release — 2/17/2023

• Fixed: Addressed OpenSSL security vulnerabilities with a patch for CVE-2023-0286, CVE-2023-0215, CVE-2022-4304
• Fixed: Upgraded to curl 7.88.0 to address CVE-2023-23914, CVE-2023-23915, CVE-2023-23916

Version 11.3.18 Official Release — 11/7/2022

• Fixed: Upgraded to curl 7.86.0 to address CVE-2022-32221, CVE-2022-35260, CVE-2022-42915, CVE-2022-42916

Version 11.3.17 Official Release — 7/18/2022

• Fixed: In Event Manager, event variables that are modifiable by users and are used in file paths are now escaped
• Fixed: Addressed OpenSSL security vulnerabilities with a patch for CVE-2022-2068
• Fixed: Upgraded to curl 7.84.0 to address CVE-2022-32205, CVE-2022-32206, CVE-2022-32207, CVE-2022-32208

Version 11.3.16 Official Release — 6/13/2022

• Fixed: Upgraded to curl 7.83.1 to address CVE-2022-30115, CVE-2022-27782, CVE-2022-27781, CVE-2022-27780, CVE-2022-27779, CVE-2022-27778

Version 11.3.15 Official Release — 5/9/2022

• Fixed: Upgraded to moment.js 2.29.3 to address CVE-2022-24785
• Fixed: Upgraded to zlib 1.2.12 to address CVE-2018-25032
• Fixed: Upgraded to curl 7.83.0 to address CVE-2022-22576, CVE-2022-27774, CVE-2022-27775, and CVE-2022-27776
• Fixed: Addressed OpenSSL security vulnerabilities with a patch for CVE-2022-1292
• Fixed: Upgraded to gSOAP 2.8.121

Version 11.3.14 Official Release — 3/28/2022

• Fixed: Updated to the latest version of jQuery UI to address cross-site scripting (XSS) vulnerabilities
• Fixed: Addressed OpenSSL security vulnerabilities with a patch for CVE-2022-0778

Version 11.3.13 Official Release — 1/18/2022

• Fixed: Upgraded to curl 7.80.0

Version 11.3.12 Official Release — 10/26/2021

• Fixed: Upgraded to curl 7.79.1
• Fixed: For some passwords, passwords did not deserialize correctly causing failed password validations

Version 11.3.11 Official Release — 9/22/2021

• Fixed: Upgraded to curl 7.79.0 to address security vulnerabilities
• Fixed: Upgraded to gSOAP 2.8.116 to address security vulnerabilities

Version 11.3.10 Official Release — 9/2/2021

• New: Added support for TLS Extension #23 Extended Master Secret (EMS) to mitigate Triple Handshake (3SHAKE) and other potential attacks
• Fixed: Addressed OpenSSL security vulnerabilities with a patch for CVE-2021-3712
• Fixed: Replaced colorbox jQuery lightbox plugin to address security vulnerabilities
• Fixed: Upgraded to curl 7.78.0 to address security vulnerabilities

Version 11.3.9 Official Release — 7/20/2021

• Fixed: Address a vulnerability to SSL renegotiation denial of service
• Fixed: Incorrect search results are shown in tables when there are multiple, concurrent search requests that are received out of order

Version 11.3.8 Official Release — 6/22/2021

• Fixed: Upgraded to curl 7.77.0 to address security vulnerabilities
• Fixed: HTTP/S web client was not displaying correctly in the browser
• Fixed: In User Manager, changing a user’s password cleared the “Password Never Expires” constraint
• Fixed: Syslog logging was not initialized correctly at start up
• Fixed: In Web Administration, a script error occurred when using the file browser

Version 11.3.7 Official Release — 5/17/2021

• Fixed: Duplicate folders when AD user is assigned to multiple groups with the same virtual directories
• Fixed: Missing file and directory upload browser button icons on mobile devices
• Fixed: Cerberus terminates due to unhandled exception
• New: SCP preserve timestamps option for file uploads

Version 11.3.6 Official Release — 4/21/2021

• Fixed: Cerberus contained a privilege escalation vulnerability from loading a DLL from a non-privileged path
• Fixed: In HTTP/S web client, users cannot download a folder or file with a percent sign in the name
• Fixed: Upgraded to curl 7.76.1

Version 11.3.5 Official Release — 4/7/2021

• Fixed: Cerberus contained a privilege escalation vulnerability from loading an OpenSSL configuration file from a non-privileged path
• Fixed: Upgraded to curl 7.76.0 to address security vulnerabilities
• Fixed: Cerberus crashed when Report Manager has a bad database configuration and sending a session report email
• Fixed: Memory leak when encrypting/decrypting data
• Fixed: Cisco Unified Communications Manager cannot send backups to Cerberus via SFTP when FIPS is enabled
• Fixed: Cisco hardware cannot upload via SCP and fails with error message
• Fixed: SFTP clients failed key exchange when the server or the client sent an initial key exchange packet and incorrectly guessed the algorithm the other side was using
• Fixed: HTTP/S web client and Event Manager cannot unzip zip files that are not entirely consistent
• Fixed: In HTTP/S web client, users that double-click on a directory can reach an inconsistent state and an incorrect breadcrumb

Version 11.3.4 Official Release — 3/9/2021

• New: In Server Manager, there is now an option to control exclusive upload file locking for SSH SFTP version 4 and lower
• New: Upgraded to curl 7.75.0

Version 11.3.3 Official Release — 2/23/2021

• New: Improved performance for customers with many client connections per second and authenticating with native Cerberus users
• New: In User Manager, improved search performance when there are many users
• New: When viewing a selected user account, User Manager now allows creating a new group in addition to selecting an existing group
• Fixed: Addressed OpenSSL security vulnerabilities with patches for CVE-2021-23839, CVE-2021-23840, CVE-2021-23841
• Fixed: Upgraded to jQuery validation 1.19.3 to address security vulnerabilities
• Fixed: Cannot access Cerberus Desktop GUI when cookie support is disabled
• Fixed: Cerberus Desktop GUI showed many errors when the “HTTP/S Web Admin Session Timeout” value was very low
• Fixed: Cerberus did not consistently timeout Web Administration sessions
• Fixed: In Server Manager, HSTS cannot be set on HTTP/S Admin listeners
• Fixed: In Report Manager, the log showed numerous errors when using SQL Server 2012
• Fixed: In User Manager, users and groups with special characters did not display correctly
• Many minor bug fixes and improvements

Version 11.3.2 Official Release — 1/21/2021

• New: On the Advanced tab of Server Manager, Cerberus now allows enabling experimental beta features
• New: Active Directory Users page allows native-like administration and mapping changes for AD users (beta feature)
• New: LDAP Users page allows native-like administration and mapping changes for LDAP users (beta feature)
• New: Cerberus now provides more logging when repairing a corrupted stats.dat file
• New: User Manager now allows the revocation of a public share from the context menu
• New: Server Manager now allows admins to force users’ browsers to reload HTTP/S Web Client static resources instead of loading cached versions
• Fixed: Cerberus Desktop GUI is slow or unresponsive after updating to version 11.3.1
• Fixed: Cerberus crashed when SFTP clients sent an invalid SFTP packet
• Fixed: LDAP search results failed to find users when there are more than 1000 users
• Fixed: When disabling FIPS 140-2, Server Manager did not display a warning that Cerberus needs to be restarted
• Many minor bug fixes and improvements

Version 11.3.1 Official Release — 12/15/2020

• New: Cerberus now uses KeyPair’s FIPS 140-2-validated cryptographic module with Certificate #3503
• New: In Server Manager, Cerberus now allows a configurable value for the Web Administration session timeout
• New: In the Interfaces window, Cerberus now displays more detailed security-related feedback and messages for each listener.
• New: User Manager now allows searching users by their first and last names
• New: User Manager now displays the date a user was created
• New: Web Administration now shows the labels for SMTP servers to more easily differentiate between multiple servers
• New: Report Manager now warns when an unsupported ODBC driver is selected
• Fixed: Addressed OpenSSL security vulnerabilities with patches for CVE-2020-1971 and CVE-2020-1968
• Fixed: Upgraded to curl 7.74.0 to address curl security vulnerabilities
• Fixed: Cerberus passed sensitive values in URLs that could expose them to people with access to server and application logs
• Fixed: Cerberus crashed when server certificate and private key are missing and SSL/TLS is enabled
• Fixed: Cerberus failed to verify an LDAP server without manually entering the correct password on the Binding Options page
• Fixed: In Report Manager, Cerberus logs errors when writing audit records for administrator actions to a MySQL database
• Fixed: Users could not enable 2FA even though they are required to do so because “Allow 2 Factor” had not been checked
• Fixed: Users cannot login because User Manager allowed admins to set the invalid state in which “Require Password Change on Login” is checked but the user is not allowed to change their password
• Fixed: Report Manager cannot connect to SQL Server database when the database name includes a hyphen
• Many minor bug fixes and improvements

Version 11.3.0 Official Release — 11/17/2020

• New: User Manager now has a “horizontal” layout to reduce the amount of scrolling when administering native users and groups
• New: Usability improvements to Extension Blocking in User Manager
• New: The Summary page now warns when a certificate is expiring or has expired
• New: The Summary page now warns when remote host certificate verification is disabled
• New: In Server Manager, admins can now customize the issuer name to something other than “Cerberus” when using OTP for two-factor authentication
• Fixed: Cerberus did not enforce password history policy for web administrator accounts
• Fixed: In web administration and web client, Cerberus allowed a malicious actor to spoof content with misleading messages designed to trick users
• Fixed: In web administration and web client, browsers may store pages in the user’s browser cache that could be accessible to a malicious actor on a public computer, a shared system, or a machine in a semi-public area.
• Fixed: In web administration, Cerberus disclosed passwords or other sensitive data in an unmasked format in the HTTP response
• Fixed: In Report Manager, the log showed numerous errors when using SQL Server Express LocalDB 2012
• Fixed: Enhanced log filtering only filtered the first IP address and ignored any additional filters
• Many minor bug fixes and improvements

Version 11.2.9 Official Release — 10/26/2020

• Fixed: In User Manager, CSV export of users allowed formula symbols that could enable an attacker to inject malicious commands when viewed in Microsoft Excel
• Fixed: In Server Manager, the private key password and the Duo secret key were disclosed in an unmasked format in the HTTP response
• Fixed: In User Manager, a warning message was shown when creating a new user
• Fixed: In Event Manager, an error message was shown when creating a scheduled task even though the scheduled task was created successfully
• In Log Manager, the Time column no longer wraps
• In Server Manager, the Remote page now shows a message to secondary admins indicating only primary admins are allowed to access these settings
• User Manager now sets the Password Last Changed value for a cloned user account to the current time
• Other minor bug fixes and improvements

Version 11.2.8 Official Release — 10/19/2020

• Fixed: Updated to the latest version of MomentJS to address a vulnerability to regular expression denial of service
• Fixed: HTTP/S web client localization allowed language translations that could include malicious JavaScript
• Fixed: Cerberus crashed when HTTP/S web client served a file with a timestamp in which the year is more than 3000
• Fixed: In the log, Cerberus sometimes attributed system tasks to users
• Fixed: When uploading via SCP, some SCP clients showed the transfer as failed even though the transfer was successful
• Fixed: In SOAP API, GetGroupInformation always returned empty “sshOptions”
• Fixed: Sync Manager added a new server entry instead of updating the existing entry when editing the IP address
• Authentication for Active Directory users now only queries users using a legacy API if “Try Alternative Active Directory Check” is enabled
• In web administration and web client, Cerberus now creates intermediate directories when creating directories
• Cerberus now supports DUO Federal for two-factor authentication
• Report Manager now creates a database index on the ‘files’ table for MySQL/MariaDB
• User Manager now sets the Last Login value for a cloned user account to be “Unknown”
• Other minor bug fixes and improvements

Version 11.2.7 Official Release — 9/3/2020

• Fixed: Cerberus crashed when HTTP clients request invalid ranges
• Fixed: Cerberus crashed when loading certificates from an invalid PFX file
• Fixed: LDAP user was not able to change password when LDAP configuration has SSL enabled
• Fixed: Memory leak in Cerberus Desktop GUI
• Fixed: In Event Manager, Session Report email did not render correctly in MS Outlook
• In web administration, tables did not remember settings for number of rows per page
• Other minor bug fixes and improvements

Version 11.2.6 Official Release — 8/11/2020

• Fixed: Even when logging in via SFTP and the SSH Authentication Method is “Public Key,” Cerberus unnecessarily prompted for a password change

Version 11.2.5 Official Release — 7/15/2020

• New: Report Manager now supports the PostgreSQL database
• Fixed: Extension blocking did not reject prohibited file extensions from being uploaded with SCP
• Fixed: Log Manager did not show the time in the local time format
• Fixed: In Event Manager, Logoff Event rules with Email Session Report action could only select Default Email Server even though there are multiple SMTP servers
• Fixed: In Report Manager, Cerberus failed to generate a File Report when using SQL Server 2008 R2 as the database

Version 11.2.4 Official Release — 6/29/2020

• Fixed: Cerberus crashed when an FTP client uploads a file using MODE Z compression
• Fixed: When running as an application (as opposed to running as a Windows Service), Cerberus did not verify remote host certificates
• Fixed: Cerberus could not verify valid remote host certificates because of expired certificates in the OS trust store
• Fixed: Event Manager did not trigger a Directory Created Event when a dragging and dropping a folder in the HTTP/S web client
• Fixed: Event Manager did not trigger a File Transfer Event when uploading a file to a virtual directory with a trailing slash
• Other minor bug fixes and improvements

Version 11.2.3 Official Release — 6/15/2020

• New: Log files can now be filtered by IP or username
• New: In Server Manager, changing admin passwords is now separate from editing admin accounts
• Fixed: In Event Manager, the HTTP Post event action stopped including variables
• Fixed: In Event Manager, the error “An address incompatible with the requested protocol was used” occurred when connecting to an SMTP server
• Fixed: Cerberus service would not start on Windows Server 2008
• Fixed: When responding to an FTP STOR command, Cerberus sent a 426 reply instead of a 500 reply when the parent folder does not exist
• Fixed: In User Manager, CSV import of users allowed users in groups that did not exist
• Fixed: Images and videos cannot be previewed in the HTTP/S web client
• Other minor bug fixes and improvements

Version 11.2.2 Official Release — 5/27/2020

• Fixed: Upgraded to jQuery 3.5.1 to address jQuery security vulnerabilities
• Fixed: Closing Cerberus Desktop GUI minimized to system tray instead of closing application
• Fixed: Cerberus installer did not shutdown running Cerberus GUI process
• Fixed: HTTP/S web client cannot download files with pound sign in the filename
• Fixed: In User Manager, virtual directories with paths created with %USER% variable cannot be edited
• Fixed: In User Manager, virtual directories with names created with %USER% variable cannot be deleted
• Fixed: In User Manager, the %USER% variable did not expand correctly in nested paths
• Fixed: In Server Manager, when creating or editing an admin account, it was possible to check “Require 2 Factor” without also checking “Allow 2 Factor”
• Many minor bug fixes and improvements

Version 11.2.1 Official Release — 5/5/2020

• Fixed: Cerberus crashed when HTTP/S web client received a malformed URL
• Fixed: HTTP/S web client and Folder Monitor did not handle folders ending with a period
• Fixed: In Event Manager, a regular expression worked in the Regular Expression Tester but not in actual use
• Fixed: In Server Manager, when creating a new administrator, you could not set the permissions for the administrator
• Many minor bug fixes and improvements

Version 11.2.0 Official Release — 4/22/2020

• Cerberus customers that block outgoing connections with their firewall should only have to allow connections to the domain www.cerberusftpserver.com with IP address 216.92.201.26 for Cerberus to auto-update
• New: Cerberus now performs certificate and host name verification for all outgoing SSL/TLS connections by default
• New: Event Manager now has a Transfer File Target that allows transferring files to another server via SFTP, FTP, FTPS, HTTP PUT, and HTTPS PUT
• New: Event Manager now has labels for Event Targets so that administrators can assign unique names to differentiate between them
• Removed unnecessary newlines from the log
• Fixed: When Cerberus checks for updates, those outgoing SSL/TLS connections did not verify the certificate or host name
• Fixed: In User Manager, requiring a user to change their password does not actually force the user to change their password after logging in
• Fixed: Log Manager displays a “parseerror” message when the log contains binary data
• Fixed: In Event Manager, modifying a cloned event applies changes to the original event
• Fixed: In Server Manager, changes to SSH Security Defaults are automatically saved without confirmation
• Other minor bug fixes and improvements

Version 11.1.0 Official Release — 3/19/2020

• User Manager guided workflows for creating users and groups, including enhanced data validation and error checking
• Upgraded admin password change controls for setting and changing user and administrator passwords
• Easily adjust generated password lengths beyond the minimum at the time of password generation
• Multiple enhancements to the Log Manager including a continuous log view with no paging, a configurable refresh rate, visual indications to indicate when the log will next refresh, as well as a dedicated context menu item and toolbar button to immediately refresh the log
• Added support for additional SSH2 key exchange methods to include diffie-hellman-group14-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512
• Upgraded to gSOAP 2.8.99 to address gSOAP security vulnerabilities
• FTP commands for setting file date/time provide better error messages on failure
• Fixed: Filter/Find for HTTP/S web client allows bypassing of virtual directory permissions
• Fixed: In User Manager, new users and groups no longer need an initial save before you can add new virtual directories
• Fixed: In User Manager, the disable date constraint for users and groups ignores PM times
• Other minor bug fixes and improvements

Version 11.0.10 Official Release — 2/20/2020

• Fixed: Memory leak when querying which groups a user is a member of in Active Directory

Version 11.0.9 Official Release — 2/18/2020

• Fixed: Memory leak when statistics file cannot be opened at startup
• Fixed: Cerberus crashes when there are multiple HTTP/S web client requests for a new localization language file
• Fixed: Log Manager displays a “parseerror” message when the log contains binary data
• Fixed: SCP does not handle using single quotes around filenames
• Allow administrators to view queue sizes for diagnostic purposes
• Other minor bug fixes and improvements

Version 11.0.8 Official Release — 1/27/2020

• Fixed: Memory leaks when transferring files via SFTP
• Fixed: Cerberus crashes when HTTP/S web client receives a malformed URL
• In Active Directory administration, searching for users and groups when creating mappings will now use the Binding Options credentials instead of the credentials for the account running the Cerberus FTP Server Windows service
• Other minor bug fixes and improvements

Version 11.0.7 Official Release — 1/22/2020

• Fixed: In Log Manager, scripts errors occur when using the right-click menu options
• Fixed: In User Manager, updating a user shows an error message when using group overrides
• Other minor bug fixes and improvements

Version 11.0.6 Official Release — 1/13/2020

• Upgraded to OpenSSL 1.0.2u to address OpenSSL security vulnerabilities
• Cerberus now shows a warning that legacy managers are deprecated and will be removed in a future version
• Other minor bug fixes and improvements

Version 11.0.5 Official Release — 1/6/2020

• Fixed: Unzip for HTTP/S web client allows bypassing of blocked file extensions
• Fixed: Folder Monitor status is never updated
• Other minor bug fixes and improvements

Version 11.0.4 Official Release — 12/23/2019

• Fixed: XSS Vulnerability When Previewing SVG Content
• Fixed: In User Manager, removing a native Cerberus user from a group shows an error message
• Fixed: Public shares are shown even though they have expired
• Fixed: Public shares allow creating shares that are already expired
• Log Manager displays much faster now
• In Active Directory administration, searching for users and groups when creating mappings should be faster
• Other minor bug fixes and improvements

Version 11.0.3 Official Release — 12/9/2019

• Fixed: Zip and unzip for HTTP/S web client allow bypass of virtual directory permissions
• We now show a warning during installation that Cerberus 11 is not officially supported on Windows Server 2008 and 2008 R2
• Other minor bug fixes and improvements

Version 11.0.2 Official Release — 12/2/2019

• Fixed: In Event Manager, Scheduled Tasks drift later after each run
• Fixed: In Event Manager, Scheduled Tasks do not run as scheduled for weekdays
• Fixed: Long message notifications are not formatted correctly
• Fixed: Cerberus displays an error message for missing MF.dll on Windows Server 2008 R2
• Fixed: Cerberus install fails even though Internet Explorer 9+ has been installed
• Other minor bug fixes and improvements

Version 11.0.1 Official Release — 11/18/2019

• Fixed: Cerberus does not lock out a user’s account after numerous failed 2FA attempts allowing brute force attacks
• Fixed: HTTP/S web client public shares are vulnerable to a XSS attack that can execute arbitrary JavaScript
• Other minor bug fixes and improvements

Version 11.0.0 Official Release — 11/5/2019

• Significantly faster performance (up to 10x) when writing files across the network using the Server Message Block (SMB) protocol
• Enhancements to User Manager UI (Desktop GUI and web administration) for a responsive and consistent experience across devices
• In web administration, User Manager now allows managing blocked file extensions and CSV export/import of users
• User Manager provides richer visual feedback when previewing the import of users from a CSV file
• User Manager shows all of the members of a group including Cerberus Native users, LDAP users, AD users, and AD groups
• Web administration now shows connections, transfers, and logging
• Log Manager logs IP addresses and usernames when logging connection-related events
• Log Manager allows administrators to download log files
• Log Manager provides features such as searching, row grouping, column sorting, and showing/hiding columns
• New notification system displays small pop-up notifications about events that are important to the user
• New notification system allow administrators to view a history of changes made during their session
• Redesigned Server Manager for better segmentation and grouping of server configuration options
• In Server Manager, administrators can require uppercase and lowercase letters in their password complexity policy
• Cerberus supports nested group membership for the AD “Require Security Group Membership” option
• HTTP/S web client localization can now be accessed and modified directly from the Desktop GUI
• Fixed: Password reset is vulnerable to HTTP host header attack allowing malicious password reset emails

Version 10.0.31 Official Release — 4/21/2021

• Fixed: Cerberus contained a privilege escalation vulnerability from loading a DLL from a non-privileged path

Version 10.0.30 Official Release — 2/23/2021

• Fixed: Addressed OpenSSL security vulnerabilities with patches for CVE-2021-23839, CVE-2021-23840, CVE-2021-23841

Version 10.0.29 Official Release — 1/21/2021

• Fixed: Cerberus crashed when SFTP clients sent an invalid SFTP packet

Version 10.0.28 Official Release — 12/15/2020

• Fixed: Addressed OpenSSL security vulnerabilities with patches for CVE-2020-1971 and CVE-2020-1968

Version 10.0.27 Official Release — 9/3/2020

• Fixed: Cerberus crashed when HTTP clients request invalid ranges
• Fixed: Cerberus crashed when loading certificates from an invalid PFX file

Version 10.0.26 Official Release — 7/15/2020

• Fixed: Extension blocking did not reject prohibited file extensions from being uploaded with SCP

Version 10.0.25 Official Release — 5/27/2020

• Fixed: Upgraded to jQuery 3.5.1 to address jQuery security vulnerabilities
• Fixed: Cerberus installer did not shutdown running Cerberus GUI process

Version 10.0.24 Official Release — 5/5/2020

• Fixed: Cerberus crashed when HTTP/S web client received a malformed URL

Version 10.0.23 Official Release — 3/19/2020

• Fixed: Filter/Find for HTTP/S web client allows bypassing of virtual directory permissions
• Upgraded to gSOAP 2.8.99 to address gSOAP security vulnerabilities

Version 10.0.22 Official Release — 1/27/2020

• Fixed: Cerberus crashes when HTTP/S web client receives a malformed URL

Version 10.0.21 Official Release — 1/13/2020

• Upgraded to OpenSSL 1.0.2u to address OpenSSL security vulnerabilities

Version 10.0.20 Official Release — 1/6/2020

• Fixed: Unzip for HTTP/S web client allows bypassing of blocked file extensions

Version 10.0.19 Official Release — 12/23/2019

• Fixed: Preview of SVG files by HTTP/S web client may execute malicious scripts

Version 10.0.18 Official Release — 12/9/2019

• Fixed: Cerberus does not lock out a user’s account after numerous failed 2FA attempts allowing brute force attacks
• Fixed: Permission bypass through the zip and/or unzip permission
• Fixed: Cerberus displays an error message for missing MF.dll on Windows Server 2008 and 2008 R2
• Fixed: Cerberus install fails even though Internet Explorer 9+ has been installed
• Other minor bug fixes and improvements

Version 10.0.17 Official Release — 11/18/2019

• Fixed: Password reset is vulnerable to HTTP host header attack allowing malicious password reset emails
• Fixed: HTTP/S web client public shares are vulnerable to a XSS attack that can execute arbitrary JavaScript
• Other minor bug fixes and improvements

Version 10.0.16 Official Release — 9/30/2019

• Upgraded to OpenSSL 1.0.2t to address OpenSSL security vulnerabilities
• Fixed: Extension blocking does not reject prohibited file extensions from being uploaded in certain situations
• Fixed: Cerberus crashes on startup when it cannot make outbound Internet connections
• Fixed: Cerberus crashes when SFTP client sends an invalid SSH packet header
• Fixed: Cerberus cannot update itself when configured to use a proxy
• Fixed: In Report Manager, the Disabled column in Last Login Statistics Report does not consider user’s group membership
• Fixed: In web administration, Server Manager cannot generate a self-signed Elliptic Curve Cryptography (ECC) certificate
• Other minor bug fixes and improvements

Version 10.0.15.1 Official Release — 9/4/2019

• Fixed: HTTP security header for Content-Security-Policy is blocking access to Google reCAPTCHA and Duo Security

Version 10.0.15 Official Release — 9/3/2019

• In the log, the remote port is now shown in addition to the IP address for incoming connection requests
• Updated HTTP security header for Content-Security-Policy to include “default-src” directive as a best practice to prevent XSS attacks
• Fixed: Email is vulnerable to SMTP header injection in the Subject field
• Fixed: HTTP/S web client users could alter the shared files of other users
• Other minor bug fixes and improvements

Version 10.0.14 Official Release — 8/7/2019

• Fixed: Group settings requiring multifactor authentication are ignored when users login via HTTP/S
• Fixed: In Server Manager, enabling FIPS 140-2 when using a PKCS#12 certificate for the server key pair causes an error and unusable SSL configuration
• Fixed: Event Manager does not trigger file transfer event for HTTP/S downloads when file is 0 bytes
• Fixed: When command-line FTP clients issue list commands, group and owner names are not displayed
• Fixed: When command-line FTP clients issue list commands, last-modified timestamp is formatted incorrectly
• Other minor bug fixes and improvements

Version 10.0.13 Official Release — 7/9/2019

• In the HTTP/S web client, security questions are now only shown on the account page if password resets are enabled
• Added the Same-Site browser cookie attribute as a security best practice for preventing CSRF attacks
• In Server Manager, updated the UI for the logging page to make it more clear that the Syslog port is configurable
• Improved accessibility in the HTTP/S web client for users that require assistive technology (screen reader, keyboard-only navigation, etc.)
• Fixed: Emails sent from Cerberus are blocked by some spam filters
• Fixed: Cerberus identifies Windows Server 2019 as Windows Server 2016 in the logs
• Many minor bug fixes and improvements

Version 10.0.12 Official Release — 6/3/2019

• Upgraded to OpenSSL 1.0.2s to address OpenSSL security vulnerabilities
• Fixed: Verification of LDAP configuration uses stale configuration settings
• Fixed: Cerberus ignores proxy settings during update process
• Fixed: MFMT FTP command fails to modify the last modification time for directories
• Other minor bug fixes and improvements

Version 10.0.11 Official Release — 5/13/2019

• The About dialog now displays the serial number for the license
• SCP has better support for downloading large files
• Improved how session IDs are generated to increase entropy
• Fixed: Server crashes with certain invalid Active Directory configurations
• Fixed: User Manager saves invalid Active Directory and LDAP configurations
• Fixed: In Report Manager, connecting to a MySQL 8.0 database returns an authentication error
• Fixed: Users could reset their password even though they are not allowed to change their password
• Fixed: In the Desktop GUI, unable to configure Captcha settings for HTTP/S web client interfaces
• Other minor bug fixes and improvements

Version 10.0.10 Official Release — 4/22/2019

• Desktop GUI now supports keyboard shortcuts and other keyboard controls in all windows
• Report Manager now shows a progress dialog when updating the reporting database configuration
• In Server Manager, the Remote page now shows the SOAP service endpoint URL based on the current server configuration
• Fixed: In Event Manager, email notifications for file transfer events of FTP uploads and downloads always show file size of 0 bytes
• Other minor bug fixes and improvements

Version 10.0.9 Official Release — 4/1/2019

• In Event Manager, a variable for the unique session ID is now available for events generated by logged in users
• Updated optional HTTP security header for X-XSS-Protection to “1; mode=block” to prevent the web browser from rendering pages if a potential XSS reflection attack is detected
• Fixed: XSS vulnerability in HTTP/S web client
• Fixed: In web administration, cannot view or edit description for a group with User Manager
• Fixed: In Report Manager, exported CSV files display international characters incorrectly
• Fixed: When uploading via SCP, names of files and folders with international characters do not transfer correctly
• Fixed: SCP download fails when filenames include a space character
• Fixed: SCP recursive download fails when empty folders exist in the directory tree
• Many minor bug fixes and improvements

Version 10.0.8 Official Release — 3/11/2019

• Upgraded to OpenSSL 1.0.2r to address OpenSSL security vulnerabilities
• Display password policy requirements in every place in which passwords are changed
• Fixed: XSS vulnerability in web administration
• Fixed: When importing users from CSV, settings for users with overrides are lost
• Fixed: When exporting users to CSV, not all user properties are exported
• Fixed: In HTTP/S web client, folders with ampersand character in their name are not shown correctly
• Fixed: Usernames with space character cannot setup 2FA when using an authenticator app on iOS devices
• Fixed: HTTP/S web client session timesout even though session timeout is disabled
• Other minor bug fixes and improvements

Version 10.0.7 Official Release — 2/15/2019

• Added labels for Active Directory domains
• Updated to the latest version of gSOAP
• Fixed: Active Directory users cannot change their password when the user must change their password at next login
• Fixed: User is disabled when their authentication requirement is “Public Key OR Password” and the setting “Disable account if last login exceeds X days” is enabled even though the user had previously successfully logged in (within the specified time frame)
• Fixed: A user logging in with a public key and “Public Key OR Password” authentication requirement was not restricted by IP or protocol
• Fixed: When uploading, SCP users without “Create Directory” permissions could create directories
• Fixed: In web administration, Server Manager allows setting admin passwords that are not compliant with the password policy
• Fixed: In web administration, when adding a new user, User Manager does not warn when a user with that username already exists
• Fixed: Added support for ABOR FTP command
• Other minor bug fixes and improvements

Version 10.0.6 Official Release — 1/30/2019

• In Server Manager, added a configuration option to allow reading from files being uploaded
• Fixed: HTTP/S web client does not allow users to change their password when 2FA is enabled
• Fixed: In some circumstances, the Service Connect dialog of the Desktop GUI displays the admin password in the username field
• Fixed: In the legacy Server manager, the primary administrator account can be deleted
• Fixed: In web administration, on the remote tab of Server Manager, you are able to rename an admin account to an existing admin account
• Fixed: HTTP/S web client does not show folder contents when a user’s virtual directory path ends with a backslash
• Other minor bug fixes and improvements

Version 10.0.5 Official Release — 1/3/2019

• Completed Windows Server 2019 certification
• The summary page shows a warning for weak password policies
• When using the Desktop GUI, the menu for Server Manager is now static and fixed to the top of the screen
• Added support for XCRC FTP command with start and end points
• Added support for ABOR FTP command for IBM AS/400
• Fixed: Cannot change password when connected to the server using WinSCP over SFTP
• Fixed: Cannot upload file using SCP
• Other minor bug fixes and improvements

Version 10.0.4 Official Release — 12/12/2018

• Upgraded to OpenSSL 1.0.2q to address OpenSSL security vulnerabilities
• Auto-generate a policy-compliant password for public shares
• More intuitive status indicators for IP Listeners on the Summary page
• Added more detailed debug logging for unrecognized FTP commands
• Fixed: In web administration, Server Manager cannot disable public share settings
• Other minor bug fixes and improvements

Version 10.0.3 Official Release — 11/19/2018

• Fixed: When LDAP users are logging into the HTTP/S web client, they are prompted to set security questions

Version 10.0.2 Official Release — 11/14/2018

• Fixed: UI cannot connect to service after setting remote password during the Getting Started Wizard

Version 10.0.1 Official Release — 11/13/2018

• Fixed: Sync Manager overwrites the primary admin account on the remote server

Version 10.0.0 Official Release — 11/8/2018

• Two-factor authentication for web administration
• Enhancements to Server Manager UI (Desktop GUI and web administration) for a responsive and consistent experience across devices
• Added initial capability for transferring files over Secure Copy Protocol (SCP), a “remote copy” capability leveraging SSH to provide authentication and secure transfer
• Numerous improvements to HTTP/S web client including faster and more scalable page rendering and better proxy handling for requests
• A more consistent UI and easier to use controls for web administration
• Added separate options for requiring two-factor authentication when users login with FTP or SFTP, in addition to HTTP/S
• Added new settings for controlling optional HTTP security headers
• Added an option to toggle HSTS for an HTTPS listener
• Added an option to require web client users to acknowledge and consent to the welcome message during login
• After upgrading Cerberus, the summary page shows a warning as a reminder to switch back the account used to run the Cerberus Windows service if it was reset during the upgrade
• The summary page shows a warning when there are accounts configured to allow anonymous access
• The summary page shows a warning that recommends disabling old and insecure versions of TLS 1.0 and 1.1 for SSL-based SOAP (Remote) connections
• HTTPS listeners show when HSTS is enabled
• Prevent web browsers from autofilling password fields when setting a password for another user
• Fixed: Server Manager settings are reverted after a service restart because they were not saved to configuration
• Fixed: Event Manager does not trigger account password expiring event
• Fixed: In Event Manager, subtasks remain disabled when editing or cloning an existing event action
• Fixed: Display issues for mobile HTTP/S web client
• Fixed: Formatting issues for the welcome message when viewed in the HTTP/S web client
• Fixed: Web browser script error when generating a User and File report on 32-bit Windows Server 2008 with IE 9
• Fixed: Language translations do not include web client login failure messages
• Fixed: SOAP API does not allow setting MFA settings on a user account
• Fixed: Backup and restore does not include log4j XML files

Please see this important FAQ entry about changes to web administration for users upgrading to 9.0 from a previous release.

Version 9.0.18 Official Release — 1/13/2020

• Upgraded to OpenSSL 1.0.2u to address OpenSSL security vulnerabilities

Version 9.0.17 Official Release — 9/30/2019

• Upgraded to OpenSSL 1.0.2t to address OpenSSL security vulnerabilities
• Fixed: Email is vulnerable to SMTP header injection in the Subject field
• Fixed: HTTP/S web client users could alter the shared files of other users
• Fixed: Extension blocking does not reject prohibited file extensions from being uploaded in certain situations
• Fixed: Cerberus crashes on startup when it cannot make outbound Internet connections
• Fixed: Cerberus cannot update itself when configured to use a proxy
• Other minor bug fixes and improvements

Version 9.0.16 Official Release — 6/3/2019

• Upgraded to OpenSSL 1.0.2s to address OpenSSL security vulnerabilities

Version 9.0.15 Official Release — 5/13/2019

• The About dialog now displays the serial number for the license
• Improved how session IDs are generated to increase entropy

Version 9.0.14 Official Release — 3/11/2019

• Upgraded to OpenSSL 1.0.2r to address OpenSSL security vulnerabilities
• Fixed: XSS vulnerability in web administration

Version 9.0.13 Official Release — 12/12/2018

• Upgraded to OpenSSL 1.0.2q to address OpenSSL security vulnerabilities
• Other minor bug fixes and improvements

Version 9.0.12 Official Release — 10/15/2018

• The free IP geolocation service we used is no longer available. We’ve provided a workaround by moving to a new geolocation service.
• Fixed: Cannot disable 2FA from web administration.

Version 9.0.11 Official Release — 9/26/2018

• Fixed: Settings configuration changes and interface listener changes are lost after a server restart
• Fixed: IP Manager incorrectly blocks a new IP range forever when adding the IP range (in CIDR format) with “Never Block this IP” enabled
• Fixed: After a service restart, “Send public emails from SMTP server account instead of user email address” setting is not being honored
• Fixed: The “Password Change Policy” settings are not saved correctly through the User Manager in web administration
• Fixed: When setting the database configuration for Reporting, configuration options do not update based on ODBC driver selection

Version 9.0.10 Official Release — 9/12/2018

• Fixed: Event Manager does not trigger a failed file transfer event when there is an unsuccessful upload from the HTTP/S web client
• Fixed: Event Manager removes the failure action when editing the event action that the failure action is associated with
• Fixed: Report Manager throws a SQL error when generating a login report with a date range

Version 9.0.9 Official Release — 8/29/2018

• Fixed: Desktop GUI Admin is slow to initialize if the server does not have Internet access
• Fixed: Non-compliant HTTP 1.1 behavior related to closing connections
• Fixed: Older 1.0 group configuration files do not get upgraded when upgrading to the latest version of Cerberus FTP Server

Version 9.0.8 Official Release — 8/16/2018

• Upgraded to OpenSSL 1.0.2p to address OpenSSL security vulnerabilities
• SFTP file transfer performance improvements
• Fixed: Non-English folder names are not displaying correctly in the HTTP/S web client
• Fixed: Empty folders are not included in zip files created in the HTTP/S web client
• Fixed: Report Manager searches are slow when querying with no limit. Report Manager now requires a limit and warns when queries may take longer.

Version 9.0.7.1 Official Release — 7/31/2018

• Fixed: The contents of folders with an ampersand in the name are always empty in the HTTP/S web client

Version 9.0.7 Official Release — 7/26/2018

• Enhanced the “Deny FXP Transfer” option to also reject passive mode data connections for FTP when the data connection originates from a connection different than the control connection
• Added a passive port randomization option (disabled by default) on the Advanced page for FTP data connections to prevent possible passive mode data connection hijacking attempts
• Fixed: File Statistic Report Error when running a basic report from the Tools menu
• Fixed: You can open the Sync Manager (even though it’s non-functional) in editions that don’t support the Sync Manager
• Fixed: The IP Listener Status box does not reflect listener initialization failures
• Fixed: The Sync Manager sidebar link is always displayed in web administration, regardless of edition
• Fixed: Can’t delete/edit addresses added via CIDR in the IP Manager
• Fixed: Adding a new IP range using CIDR in new IP Manager will expire immediately

Version 9.0.6.1 Official Release — 7/11/2018

• The free IP geolocation service we used is no longer available. We’ve provided a temporary workaround by moving to a new geolocation service.
• Changed the Report Manager Filename field to File path to better reflect that field’s use
• Added a public uploads filter to the Report Manager’s search console
• Other minor bug fixes and improvements

Version 9.0.6 Official Release — 6/29/2018

• New localization page to allow web administrators to easily change and update language translations for the HTTPS web client
• The password policy is now displayed on the Account Requests page for new users requesting accounts
• Added a comprehensive log report to detail exactly where the mismatch was when a client/server SSH key exchange failed because of no common key exchange protocols, encryption, mac, or compression parameters
• Removed the Restart, Start, and Stop menu items from the File menu in the Cerberus GUI to avoid admin confusion
• Changes to SSH key exchange protocols, ciphers, or mac settings no longer require a service restart and now become active as soon as the changes are saved
• Fixed a bug where downloading a publicly shared file containing special international characters will display the incorrect name when using Internet Explorer
• Fixed a bug where modifying existing IP addresses in the IP Manager wasn’t working correctly
• Fixed a bug where Log Manager in Web Administration cuts off filter value in the select box
• Fixed a bug where AD and LDAP attribute searches were case sensitive, but should not have been
• Fixed a bug where Last Download status was always Never for shares displayed on the user’s Shares page

Version 9.0.5.3 Official Release — 5/4/2018

• Fixed a bug with web client password resets that prevented reset emails from being sent
• Added a section to show the current password policy for creating a password on account requests
• The settings.xml file is now serialized to a temporary file first before replacing the settings.xml file for added safety
• Updated jQuery to version 3.0.3.1 in both the web client and web administration

Version 9.0.5.2 Official Release — 4/25/2018

• Fixed a bug that prevented Diffie-Hellman key exchange from working for SFTP when in FIPS mode
• Fixed a bug that could crash a remote server when syncing shared files using the Sync Manager
• Fixed a bug that required setting the password a second time for remote admin users when they are created through web administration
• File and directory names now expand to take up as much width as available in the web client

Version 9.0.5.1 Official Release — 4/23/2018

• Fixed a bug that prevented users from revoking public shares
• Added an option to specify domain server binding credentials for AD authentication
• Fixed a bug that prevented web client security questions and answers from saving
• Added options to enable Kerberos sealing or SSL encryption for domain communications

Version 9.0.5 Official Release — 4/06/2018

• Added support for DUO Security for 2 factor authentication
• Added a new Sync Manager for the desktop UI
• Added a new Overviews page to the Sync Manager
• Added a new Overviews page to the Report Manager
• Added a page to configure database connections in the Report Manager
• Upgraded OpenSSL to version 1.0.2o to address vulnerabilities in OpenSSL
• Fixed a bug that resulted in a server crash when HTTPS web client users logged out in the middle of uploading a file

Version 9.0.4 Official Release — 2/28/2018

• Added options to allow and require 2 factor authentication for users and groups
• Added 2 factor authentication support for LDAP and Active Directory web client users
• Added a new IP Manager to manage IP blocking
• Added an option to show the password when filling out a new account request
• Added context-menu support for virtual directory management in web administration
• Added double-click support for editing virtual directories in web administration
• Added select all/none for virtual directories in the web administration
• Selecting a directory will now populate a default virtual directory name in the virtual directory dialog in web administration
• Added options to automatically generate passwords and show passwords when changing or setting a password for the first time in web administration
• Added an indicator showing whether the password and password confirmation inputs match for web administration password boxes
• Added an indicator of the current password policy in the change/set password dialogs in web administration
• Added a password generator for web administration change password dialogs
• Added SHA256 SSH public key fingerprint generation when validating certificates
• The Share and Email dialogs for public sharing now indicate whether a password is required in the placeholder text for the share password field
• Admin password resets of user accounts now ensure password policy enforcement like the desktop admin UI
• Event Manager event actions can now have no variables selected for an action
• Added option to select all/none for event variables to be included in inh3idual email actions
• Added a dedicated download button on files in public directory shares
• Fixed bug preventing selecting/unselecting a variable in the Event Manager’s variable list when clicking directly on the checkbox
• Fixed a problem with IE9 and HTTPS web client uploads
• Fixed truncating uploaded file names with semicolons in the web client
• Disabling FTPES advertisement now denies TLS upgrade requests

Version 9.0.3.1 Official Release — 12/19/2017

• Enforce CSRF token on 2F verification and upload forms
• Add more strict cache control headers to sensitive pages
• Fixed the address book not appearing for LDAP and AD accounts in the web client

Version 9.0.3.0 Official Release — 12/08/2017

• Upgraded to OpenSSL 1.0.2n to address OpenSSL security vulnerabilities
• Enhanced the web IP Manager
• Fixed a folder monitor UI bug
• Fixed a user manager UI bug that resulted in no group being displayed for a user
• Miscellaneous bug fixes

Version 9.0.2.0 Official Release — 11/17/2017

• We now support very large path lengths when the underlying path is a UNC share
• Enhanced the web IP Manager
• Fixed a bug that resulted in public file share folder and file zipping returning zero-length zip archives
• Fixed a bug in the IP Manager
• Added country logging for IP geolocation
• IP geolocation optimizations

Version 9.0.1.0 Official Release — 11/06/2017

• Upgraded to OpenSSL 1.0.2m to address OpenSSL security vulnerabilities
• New zip and unzip library with support for archives greater than 2GB
• New global option to disable displaying file sharing tabs and button in the web client
• Improved pagination in the web client and web administration
• Fixed a bug that reversed the current and latest version labels on the summary page
• Fixed an HTTPS web client file upload bug
• Added an “overwriting existing file” label for when web client uploads are overwriting an existing file
• Fixed a bug that resulted in AD accounts that use directory attributes for SSH public key authentication being unable to retrieve the SSH key from AD
• Fixed a bug that caused an FTP rename that overwrites an existing file to fail even when the “allow rename to overwrite existing files” FTP option is selected
• Fixed support for IPv6 addresses
• FIxed IP address note wasn’t getting added in web administration for CIDR ranges
• Fixed a bug in web administration that prevented administrators from changing their passwords

Version 9.0.0.6 Official Release — 9/25/2017

• Fixed a bug in the HTTPS web client that resulted in no Share button for certain types of files
• Improved the share and email a public link web client dialogs with better error handling

Version 9.0.0.5 Official Release — 9/21/2017

• Added an Add Folder button to the HTTPS client upload control for browsers that support it
• Fixed pre-upload existence and resume checking for files uploaded through folder drag and drop
• Added displaying of full relative file path for files when uploading folders in the web client
• Fixed various UI issues in the web client
• Shared file or folder notification emails now properly reflect whether the file is uploaded or downloaded
• Event Manager admin changes are better logged for auditing purposes
• Fixed several possible crashing bugs related to public file share uploads and public file share access

Version 9.0.0.4 Official Release — 9/11/2017

• HTTPS web client UI cleanup
• Miscellaneous minor bug fixes and performance improvements

Version 9.0.0.3 Official Release — 8/30/2017

• Fixed a potential web administration crash
• Updated the SOAP library
• Fixed the WSDL link from the web administrator page
• Miscellaneous minor bug fixes and performance improvements
• Included additional web client translations for German, Danish, Norwegian, Polish, Hungarian, Arabic, French, Chinese, Russian, and Finnish
• Removed SEED and CAMELLIA ciphers from our default cipher lists

Version 9.0.0.2 Official Release — 8/25/2017

• Improved geolocation of IP addresses and error reporting
• Fixed a bug where the Summary and Interfaces couldn’t be displayed for some configurations
• Performance improvements

Version 9.0.0.1 Official Release — 8/21/2017

• Bug fixes for web clients viewing the using a default language other than English
• Bug fixes and a fallback summary and interfaces page for Server Core installations that do not support the IE browser control
• Other bug fixes

Version 9.0 Official Release — 8/15/2017

• HTTP/S web client two-factor authentication with any HOTP client
• Updated HTTP/S web client user interface
• Multiple language support for the HTTP/S web client
• Updated web administration, events, and reporting dialogs
• New server administrator auditing reporting
• Resizable User Manager, Server Manager, and IP Manager dialogs
• Complete rewrite of web administration code for better performance and security
• Web administration now uses session-based authentication instead of basic authentication to allow sign in and sign out capability
• New scalable summary page
• Better DPI handling for embedded web page controls
• Significant performance improvements through code rewrites and a move to the Visual Studio 2017 compiler and CRT libraries
• Added an option to allow replacing a file on rename with FTP
• Added an option to allow disabling FTP TLS upgrade advertisement for plain FTP connections
• Added an option to enforce the system password policy on public file shares
• Enhanced Share settings page on the web client
• Added support for locking and unlocking specific regions of files for the SSH SFTP commands BLOCK and UNBLOCK
• Reduced log verbosity for initial connection messages (without any loss of information)
• Compatibility with Azure SQL Server and encrypted database connections for the auditing and reporting database
• The downloader’s IP address is now recorded and included on file access reports for public file uploads and downloads

Version 8.0.13 Official Release — 12/08/2017

• Updated to OpenSSL 1.0.2n to address security vulnerabilities in OpenSSL

Version 8.0.12.1 Official Release — 8/1/2017

• Updated SOAP library

Version 8.0.12 Official Release — 6/1/2017

• Fixed an issue where HTTP/S session timeouts sometimes didn’t trigger a logout event
• Fixed a concurrency issue that could lead to a crash in rare instances
• Fixed an issue with basic server statistics collection that could lead to a crash or stats file corruption
• Fixed a Microsoft Edge upload error
• Rearranged the Advanced Security Dialog to group SSH2 and SSL options, and added a few more security profiles

Version 8.0.11.2 Official Release — 5/19/2017

• Fixed an issue where responses to SSH2 global requests messages weren’t sent properly
• Modified HTTPS session cookie identifiers to no longer potentially include the equals sign as a character value

Version 8.0.11.1 Official Release — 5/4/2017

• Updated the reCaptcha signup link in the reCaptcha dialog
• Authentication will no longer strip whitespace from the front and back of usernames during authentication
• The Folder Monitor can now handle directory names with ampersands
• Improvements to CSV import from third party SFTP servers
• Fixed a bug that allowed secondary web admin accounts to connect via SOAP
• Minor bug fixes

Version 8.0.11 Official Release — 3/17/2017

• Fixed a DoS vulnerability (CVE-2017-6880) related to the FTP MLST command for authenticated user in certain user configurations
• Improved FTP error checking and reporting

Version 8.0.10.3 Official Release — 3/03/2017

• Fixed an issue where HTTP/S connections would block forever when a client connection was severed during a file upload, and the uploaded file would remain locked
• Enhanced support for logging client IP addresses via the X-FORWARDED-FOR header

Version 8.0.10.2 Official Release — 3/01/2017

• Fixed a DoS vulnerability (CVE-2017-6367) in a third party library related to SOAP and web administration
• Added saveToDisk and createNonExistentDirectories options to the AddUser SOAP API call

Version 8.0.10.1 Official Release — 2/09/2017

• Better compatibility with some HTTP/S proxy servers for update checking and other GET operations
• Added a failed PASV mode bind retry attempt that will automatically retry binding to a new passive port up to 3 times if a port is already in use
• Fixed an issue with the “exclude passive port range” option not getting saved for Sync Manager settings
• Fixed bug that prevented folder uploads to public shares
• Setting the “Require Password change every X Days” option is no longer necessary for enforcing the “Require Password Change” setting on an account

Version 8.0.10 Official Release — 1/31/2017

• Updated to OpenSSL 1.0.2j from OpenSSL 1.0.2k to address security vulnerabilities in OpenSSL
• Minor bug fixes

Version 8.0.9 Official Release — 1/4/2017

• Public uploads now trigger a public file transfer event, and you can differentiate a public download from a public upload using rule conditions
• Executable target event actions now properly report error codes and wait for process execution to complete
• Administrators can configure a max wait time for executable event actions to complete before processing the next action

Version 8.0.8.4 Official Release — 12/19/2016

• Fixed a bug with adding conditions in the Event Manager
• Fixed a bug where a logout event won’t be generated for specific situations where an HTTP/S session times
• Fixed a bug where Event Manager external process actions would always trigger a failure action, even if the process returned a success code

Version 8.0.8.3 Official Release — 12/13/2016

• Fixed a Firefox bug causing uploads to fail for public file uploads through the HTTPS web client in some instances
• SSH SFTP bug fix for the FSTAT command
• SSH SFTP requests for global requests not get a proper error response

Version 8.0.8.2 Official Release — 12/5/2016

• Fixed a bug in web administration that prevented changing SSH authentication method on accounts
• Fixed an SSH SFTP bug that resulted in the FSTAT command failing
• Fixed a bug that caused password changes for AD users to fail
• Added execute permissions bits for user, group, and other execute fields on old-style UNIX directory listings for directories to help with compatibility with some clients
• Added several HTTP security headers (X-XSS-Protection, Content-Security-Policy, X-Content-Type-Options)

Version 8.0.8.1 Official Release — 11/18/2016

• Fixed a Firefox bug causing uploads to fail through the HTTPS web client in some instances
• Added support for folder uploads through Firefox with the HTTPS web client
• Fixed a bug where zero length file uploads didn’t trigger a file transfer event
• Added a “Follow referrals” option for Active Directory user searches
• Minor UI changes to show disabled authentication sources on the Policy page

Version 8.0.8 Official Release — 11/14/2016

• Updated to OpenSSL 1.0.2j from OpenSSL 1.0.1u
• Fixed a bug where zero length file uploads didn’t trigger a file transfer event
• Enhanced file policy result logging
• Added an FTP passive mode option to always use the internal IP for plain FTP passive mode responses
• FTP AUTH commands will now send an “Unavailable” response when FTPES is requested but TLS is disabled on the server
• Added an option during a server backup restore operation to not import the license key from the backup
• Improvements to AD and LDAP password changing

Version 8.0.7.1 Official Release — 10/12/2016

• Fixed an HTTPS web client bug that could result in a crash when downloading files in chunks
• Added an SSH SFTP legacy file handles mode for dealing with buggy clients that relay on SSH SFTP file handles being the actual file path
• Changes to some SSH settings no longer require a service restart
• Removed case sensitivity for mapping AD user names as UPN names to Cerberus groups

Version 8.0.7.0 Official Release — 9/22/2016

• Updated to OpenSSL 1.0.1u to address bug fixes and security vulnerabilties in OpenSSL
• Server no longer locks a file in SSH SFTP for both read and write access if only one of read or write locking is requested by the client
• The server can now properly keep track of SSH SFTP sessions that open multiple simultaneous handles to the same file or directory
• Better logging and handling of HTTPS client commands and uploads
• Removed Triple DES from the default cipher list for SSL client connections and web administration
• The Summary page now warns if 3DES or RC4 are enabled for SSL connections
• Fixed a bug that resulted in the groups field being omitted from native account reports in the Report Manager
• Fixed a UI bug on the desktop Account Requests page that resulted in fields getting reset when selecting a group for the appoved account

Version 8.0.6.1 Official Release — 9/7/2016

• Public shares can now just have upload only permission (no download)
• Fixed several bugs for LDAP and AD authentication that used a directory attribute for the default virtual directories for users
• Enhanced SMTP authentication error logging

Version 8.0.6 Official Release — 8/16/2016

• Bug fixes and usability improvements in the User Manager
• Tab support for moving through user fields in the User Manager
• Support for the X-FORWARDED-FOR header for HTTP/S traffic for logging and IP management
• Improved proxy support for upgrade checking
• AD and LDAP mapping dialogs are now resizable
• Fixed the “Do Not Send Session Report if Empty” flag always being set to false when editing an email session report action
• Password generator now generates passwords that are at least 6 characters, even if password policy has no minimum length
• Fixed bug that could cause password generator to crash

Version 8.0.5.1 Official Release — 8/03/2016

• Fixed a bug that could result in a CPU spike in the Enterprise edition until the service is restarted

Version 8.0.5 Official Release — 8/02/2016

• New random, policy compliant password generation option for native accounts in the desktop UI
• Added an option to set a native account to require password change on next login without having to reset password
• Added the LDAP server label field to the desktop UI
• Added additional user icons to differentiate user states in the User Manager
• Added a Legend dialog to display what the different user icons mean
• Added URL redirect support to the web client for selecting authenticated links when the user isn’t authenticated
• HTTP/S session timeouts now properly trigger a logout event and session end time in the statistics database
• Minor UI improvements and bug fixes

Version 8.0.4 Official Release — 7/23/2016

• Added options to control requiring account request settings on the account request signup form
• Added an option to set a custom denial message for email notification when requested accounts are denied
• Redesigned Shares web client page
• Removed the default selection of TCP/IP as the network protocol for SQL Server ODBC drivers
• Usuability enhancements and bug fixes for the New User Dialog in the User Manager
• AD authentication optimizations to speed up and remove unnecessary domain queries
• Numerous minor bug fixes and usuability enhancements with the UI

Version 8.0.3 Official Release — 6/22/2016

• Fixed a statistics bug that recorded the wrong value for the filename of a publicly shared file for reports
• Fixed a UI bug that always deleted the first secondary web admin account in the list regardless of which account was selected for deletion
• Added an Add New User dialog to the User Manager to streamline adding new users
• Added the SSH authentication method Password OR Public Key to the available authentication options list
• Added a dialog to allow adding or updating SMTP servers on the Public Shares page of the User Manager
• Added additional quick configuration options to the Summary page
• Added limited support for authenticated redirects
• Added manual proxy support to the General page of the Server Manager
• Fixed some refresh and drawing inconsistencies on the main admin UI

Version 8.0.2 Official Release — 5/25/2016

• Fixed a bug that sometimes resulted in being unable to send session report logoff emails
• Fixed several minor Event Manager UI bugs
• Added workarond for SSH clients that don’t pad signatures RSA signatures in public key authentication
• Added a GetGroupInformation SOAP API call to retrieve group information
• New, high-DPI icons for nearly every part of the desktop admin GUI
• Improved User and Group pages in the User Manager
• Lots of UI bug fixes in the User Manager

Version 8.0.1 Official Release — 5/05/2016

• Upgraded to OpenSSL 1.0.1t
• Added an option to allow unauthenticated users to upload files to publicly shared folder links
• Added options to delete empty folders and to filer files using regular expressions for folder monitoring
• Added restricted upload file extension blocking in the User Manager for Professional end Enterprise editions
• Added a regular expression testing dialog to the Event Manager for regular expression event conditions and folder monitor file filters
• Added SSH SFTP copy-file extension command for performing remote file copies on the server
• Added user directory access information to the Account Report option in the Report Manager
• UI enhancements to the Event Manager
• Fixed a bug that could result in losing AD and LDAP settings when upgrading old settings files
• Fixed a bug that prevented the %USER% variable from working in public key certificate paths for Cerberus groups

Version 8.0.0.9 Official Release — 3/07/2016

• Fixed a bug with certain international operating systems configurations that resulted in a failure to retrieve summary information, and errors opening the desktop Event Manager and Report Manager.

Version 8.0.0.8 Official Release — 3/03/2016

• Fixed a bug introduced in 8.0.0.6 that resulted in AD group to Cerberus group mappings being converted to AD user to Cerberus group mappings after saving
• Fixed unzipping on the HTTPS web client

Version 8.0.0.7 Official Release — 3/01/2016

• Upgraded to OpenSSL 1.0.1s
• Stability and performance improvements
• Changes to HTTPS web client configurations now take effect immediately

Version 8.0.0.6 Official Release — 2/05/2016

• Added option for administrators to control what key exchange protocols are allowed with SSH2
• The ChangePassword SOAP API now has an option for email notification of password changes to the end user, and for administrator resets without the prior knowledge of the user’s password
• Only send one event notification for HTTPS file uploads greater than 256 MB
• Improved error reporting for CSV input

Version 8.0.0.5 Official Release — 1/29/2016

• Upgraded to OpenSSL 1.0.1r
• Improved FTP MDTM comand handling to better differentiate between getting and setting the time on a file
• Improved error reporting on the desktop UI managers for when values are out of range for fields
• Session report emails can not be sent to multiple recipients for a session report event action
• Fixed a bug with the IP Manager’s username auto-banning feature that resulted in a failure to block usernames on the ban list
• Updated HTTPS web client and web admin web framework foundation classes
• Added ability to set a default theme for the HTTPS web client by IP address
• Fixed issue preventing users without delete permission from uploading more than 256MB of a file through the HTTP/S web client
• Fixed issue with being unable to add zip and unzip actions in the Event Manager
• Fixed issue with custom email body in events being stripped of newlines

Version 8.0.0.4 Official Release — 12/04/2015

• Upgraded to OpenSSL 1.0.1q to address OpenSSL bugs and security vulnerabilities
• SSL and SSH ephemeral DH keys now default to minimum 2048 bit strength
• Fixed a problem with verifying ECDSA signatured for client SSH public keys
• Default web administration cipher string strengthened to exclude several weaker ciphers
• Web administration SSL cipher string and protocol support can now be customized by administrators
• Enhanced error checking to prevent a client from attempting to upload a file through the HTTPS web client with an invalid name
• Event Manager email event actions can now send emails to multiple email addresses with a single email action
• Added a label field for LDAP server configurations to help admins differentiate between multiple LDAP configurations

Version 8.0.0.3 Official Release — 11/17/2015

• Fixed an LDAP and AD public key authentication bug that resulted in the server being unable to find the public key file for mapped AD or LDAP users
• Fixed the HTTPS web client allowing authenticated users to replace existing files on upload without delete permissions
• Fixed SMTP server response handling to improve compatibility with SMTP servers
• HTTPS web client will now prevent an upload from starting if the user doesn’t have permission to replace an existing file
• Added context menu support to several web administration tables
• Added basic public download statistics collection for reporting
• Minor bug fixes and improvements

Version 8.0.0.2 Official Release — 10/27/2015

• Fixed an LDAP and AD authentication bug that could result in a crash in some situations
• Fixed an restore users and settings from backup bug
• More consistent and region-specific date formats for reports

Version 8.0.0.1 Official Release — 10/24/2015

• Numerous minor bug fixed and Event Manager UI improvements
• Added right-click menu support to Event Targets and Folder Monitor tables
• Added clone rule option to event rules and sheduled tasks
• Added clone action option to event rules and schedules tasks
• Editing actions now modified edited action, instead of adding a new action
• Fixed SSH SFTP file transfers always generating an upload notification
• Added option to select AD or LDAP attribute for SSH public key location for groups in web administration
• Fixed AD and LDAP authentication bugs when using public key authentication with AD or LDAP attributes
• Cerberus desktop UI log link now opens up log directory, instead of UI-only log file

Version 8.0 Official Release — 10/14/2015

• Support uploading resume through the HTTPS web client
• New option to always prompt for administrator password when launching the desktop admin UI
• Active Directory and LDAP authentication now support default directories linked to AD and LDAP directory attributes
• The Global Home%USER and home directory default AD and LDAP mapping modes now have an option to configure home directory permissions
• Active Directory and LDAP users can now pull SSH client public keys from AD or LDAP using a directory attribute instead of a file path for the default or mapped Cerberus group’s public key path field
• New, completely re-written Event Manager for both desktop and web administration
• New Event Manager scheduled tasks
• New Event Manager action to revoke a public link given a unique public file ID
• New Event Manager action to wait for a specified number of seconds before executing next action
• New Event Manager action to execute a server backup and save it to a file
• New event trigger for account passwords expiring
• New option to specify to stop executing event actions for a rule when an action fails
• New option for emailing session reports action to not send report when session has no file activity
• New option to specify what event rule variables are included in an email event notification
• New option to specify addition body text in event emails
• Back button added to file/session reports to return to original report when selecting a session
• New option to export reports to CSV files
• New IP username auto-banning
• Detailed statistics now records directory creation
• HTTP/S web client users are now prompted to set security questions on login if they haven’t set them yet
• New HTTP/S web client context menu with cut and paste file and directory support
• You will now be prompted to automatically start the Windows Service if it is not running when you first launch the UI
• The Cerberus desktop admin application now uses a separate log configuration file to prevent any conflict when writing to the same log as the service
• Only the primary server administrator can now change remote admin settings
• Administrators can now use the %USER% variable for public key file paths in Cerberus groups for SSH authentication
• Enable or disable TLS 1.0, 1.1, and 1.2

Version 7.0.17 Official Release — 12/08/2017

• Upgraded to OpenSSL 1.0.2n to address OpenSSL bugs and security vulnerabilities
• Version 7.0 is now end-of-life and will see no further updates

Version 7.0.16 Official Release — 8/01/2017

• Updated SOAP libraries

Version 7.0.15 Official Release — 1/04/2017

• Upgraded to OpenSSL 1.0.2j from 1.0.1u

Version 7.0.14 Official Release — 9/22/2016

• Upgraded to OpenSSL 1.0.1u to address an OpenSSL security vulnerability

Version 7.0.13 Official Release — 5/05/2016

• Upgraded to OpenSSL 1.0.1t to address an OpenSSL security vulnerability

Version 7.0.12 Official Release — 3/01/2016

• Upgraded to OpenSSL 1.0.1s to address an OpenSSL security vulnerability

Version 7.0.11 Official Release — 12/04/2015

• Upgraded to OpenSSL 1.0.1q to address an OpenSSL security vulnerability

Version 7.0.10.1 Official Release — 7/28/2015

• Fixed an issue where SMTP email server tests would fail
• Fixed a potential access violation in the server
• The UI will now warn the user when a connection to the underlying Cerberus FTP Server service has been lost
• Added a wait server operation to cause an event rule to pause for a specified number of seconds before executing the next action
• Numerous minor bug fixes

Version 7.0.10 Official Release — 7/10/2015

• Upgraded to OpenSSL 1.0.1p to address an OpenSSL security vulnerability
• Fixed a bug that would result in incomplete directory reads for SSH SFTP version 6 clients and directories with large numbers of files
• Added an option to disable TLSv1.0 to the Advanced Security dialog
• Added an option to perform an alternate method of checking the AD groups an AD user belongs to for domains that don’t return group information for a user through ADSI
• Moved the XML parser for the UI settings file to the same XML framework used for the service settings file

Version 7.0.9 Official Release — 6/12/2015

• Upgraded to OpenSSL 1.0.1o to address OpenSSL bugs and security vulnerabilities

Version 7.0.8.2 Official Release — 6/09/2015

• Changed IP auto-detection to point to more reliable service

Version 7.0.8.1 Official Release — 5/08/2015

• Fixed a bug related to public IP auto-detection that could result in a server crash under certain unusual circumstances
• Fixed a bug related to user Cerberus accounts that are part of a group ignoring the group’s is anonymous setting and using the original account setting

Version 7.0.8.0 Official Release — 3/19/2015

• Upgraded to OpenSSL 1.0.1m to address OpenSSL bugs and security vulnerabilities
• Completed transition of web administration virtual directory, AD, LDAP, event, and license dialogs to new mobile-friendly framework
• CSV importer can now understand different line encodings
• Added option to exclude passive port range from syncing
• You can now customize the email subject for session reports
• Fixed synchronization and timer bugs that could result in server crashes

Version 7.0.7.0 Official Release — 2/25/2015

• Fixed socket send bug that could result in being unable to terminate a connection when a buggy client didn’t signal it was ok to send data
• Fixed a bug in FTP download resumes that could result in corrupt resumed downloads
• Added SOAP API calls to set and retrieve the IP block list
• More robust CIDR list import support
• Added check to make sure an account request cannot be approved if there is already a user with that account name (web administration)
• Added HTTPS range header support (HTTP/s file download resume and better web video playback)

Version 7.0.6.0 Official Release — 1/12/2015

• Updated to OpenSSL 1.0.1k to address security vulnerabilities in OpenSSL
• New public file sharing SOAP API call to generate a public link to an existing file

Version 7.0.5.5 Official Release — 12/15/2014

• Fixed a bug that would not allow new user or group accounts to be created through web administration
• Renaming a group through web administration now renames the group in any user accounts or AD or LDAP mappings
• Enhanced rename and add group error checking
• New RenameGroup web services API call that renames a group and all associated mappings
• Groups can no longer be deleted through web administration if there is a user that is a member of the group
• Web client public file link emailing now disallows including the password in the email subject line
• Auto-updater will now note errors contacting the update site on the summary page

Version 7.0.5.4 Official Release — 12/08/2014

• Fixed renaming users and groups in web administration
• Fixed incorrect date/time display in SFTP and HTTPS for root folders
• Fixed Send a Session Report action not being available for Logoff events when event first created
• Fixed several bugs that could result in a service crash if the log file can’t be written to (space full, UNC path can’t be reached)
• Other minor bug fixes to UI and web administration

Version 7.0.5.3 Official Release — 11/11/2014

• Properly advertise integrity checking command support for SSH SFTP to clients
• Added CRC32 checksum as SSH SFTP integrity checking option
• Do not send “..” as part of a directory listing when at a user’s root for FTP and SFTP
• Fix web administration and SOAP DLL exception

Version 7.0.5.2 Official Release — 10/31/2014

• Web client Address books are now sortable by email or name
• Auto-suggest from address book when emailing public links now returns matching names in addition to email addresses
• External event processes no longer need their paths quoted when there are spaces in the path
• The working folder now correctly resets for external event process actions when changing the path of an exiting process
• Removed emtpy log statement for HTTPS uploads
• Updated HTTPS web client and web administration core libraries
• Fix web administration and SOAP DLL exception

Version 7.0.5.1 Official Release — 10/16/2014

• Disable SSLv3.0 by default
• Add an option to enable SSLv3.0 on the Advanced Security page

Version 7.0.5 Official Release — 10/15/2014

• Updated to OpenSSL 1.0.1j to address security vulnerabilities in OpenSSL

Version 7.0.4.2 Official Release — 10/14/2014

• Added ability to set additional public file sharing options through web administration
• Added ability to customize email options for account request approvals through web administration
• Added button for testing SMTP server target configurations through web administration
• Account request email template improvements
• Minor web administration bug fixes and layout improvements
• Fixed error reporting for failed database operations – errors were previously being reported as “Invalid cursor state” instead of actual error description

Version 7.0.4.1 Official Release — 09/29/2014

• Backup and restore now includes SSH client public keys in the backup set
• Server synchronization through the sync manager now syncs SSH client public keys
• Added the sync manager to web administration
• Added database configuration to web administration
• Web administration refinements and additions
• Optimized several images to use font glyphs for web administration to reduce resource page downloads
• Added a workaround for an IE9 directory display bug for the HTTP/S web client
• Fixed several rare thread contention isues that oculd lead to server exceptions

Version 7.0.4 Official Release — 09/17/2014

• Major re-design of web administration. Switched to a more modern, responsive web framework that scales on different devices
• Added options to manage remote settings and secondary web administrators through web administration
• Added clone user and clone group functions to web administration
• Added option to test cipher strings to web administration
• Added ability to override group properties on users to web administration
• Added additional local directory and file selection controls to web administration
• Added public share editing to web administration
• Added same report generation controls present on the desktop to web administration
• Added additional advanced options to web administration
• Fixed CSV export and import for PBKDF2 HMAC SHA256 and PBKDF2 HMAC SHA512 hashed passwords by adding iteration count
• HTTP/S web client uploads now show up in the active transfers list and are tracked in the upload speed meter control
• Minor bug fixes and improvements

Version 7.0.3 Official Release — 08/07/2014

• Updated to OpenSSL 1.0.1i to address security vulnerabilities in OpenSSL
• Fixed HTTP/S web client password strength meter bug in IE8
• Disabled accounts and accounts configured to allow only SFTP access with public key authentication will no longer receive password expiring emails
• 3DES encryption cipher is now considered at 112 bit symetric strength to better reflect effective strength

Version 7.0.2 Official Release — 07/30/2014

• Disabled users will also register with the “stop authentication if user exists” Policy settings
• Added PBKDF2 HMAC SHA256 and PBKDF2 HMAC SHA256 stretched password hashing algorithms as password storage hash options
• Added ability to select active SSH2 ciphers and HMAC algorithms
• Added SSH2 cipher minimum bit strength display to Summary page
• HTTP/S web client now allows zero-length file uploads
• Fixed a problem with the web client data/time control for IE 8 users
• Added support for generating the correct share link path when connections come in from an HTTPS proxy to a Cerberus HTTP listener
• Reports now track whether a file operation succeeded or failed
• Fixed web client bug for displaying local time that only used the user setting for displaying local time

Version 7.0.1 Official Release — 07/04/2014

• Fixed a bug in web client folder uploads for Chrome
• Fixed a bug on web client email selection and address book auto-complete
• Added an option to force all publicly shared files and folders be password protected
• Added more account options for CSV import (unlimited directories, password hashes, additional account parameters)
• Added capability to export user accounts as CSV files
• Added dedicated require password change option for native accounts
• Enhanced the default cipher list for HTTPS web administration to require minimum 128-bit, strong ciphers
• Added option to initiate automatic download of zip file without storing the resulting file on the server for web client zip operations
• Clients can now modify the share until date on their own publicly shared files
• Added web client in-browser editing of simple text-based files

Version 7.0.0.3 Official Release — 06/05/2014

• Updated to OpenSSL 1.0.1h to address security vulnerabilities in OpenSSL
• Added new MAC SSH algorithms hmac-ripemd160 and hmac-ripemd160@openssh.com
• Added DeleteDirectoryFromGroup, AddDirectoryToGroup SOAP API calls
• Renamed AddRoot, DeleteRoot to AddDirectoryToUser, DeleteDirectoryFromUser SOAP API calls
• Added create directory option to AddDirectoryToUser and AddDirectoryToGroup API calls

Version 7.0.0.2 Official Release — 05/27/2014

• Fixed an information disclosure for SSH logins vulnerability. Analysis of failed login result could allow attacker to determine if an account exists or not. Thanks to Steve Embling, a Pentura Security Researcher, for discovering and reporting this vulnerability.
• Fixed ability to update to a different theme in the web client for LDAP and AD accounts
• Fixed web client file list sorting
• Hide the security question list for AD and LDAP accounts since they can’t currently use the password reset feature
• Added password strength/entropy meter to HTTP/S web client account request and change password pages

Version 7.0.0.1 Official Release — 05/22/2014

• Added 3DES back to the list of available SSH ciphers
• Added a cipher list test button and a cipher list box to the Advanced Security dialog
• Changed the ephemeral EC generated to be compatible with IE
• IE8 HTTP/S web client improvements

Version 7.0 Official release notes — 5/16/2014

• New 7.0 Release
• Redesigned HTTP/S web client that’s been optimized for both desktop and mobile browsers
• Folder upload through HTTP/S web client with Chrome
• Enhanced web client address book for users
• Web client custom theme support
• Web client search support
• Web client image and video thumbnail viewing
• Redesigned Report Manager
• Added report sorting
• Added multiple web administrators with fine grained access controls
• Publicly shared file links are now included in user statistics reporting
• Added max share duration limit for publicly shared links
• User manager UI improvements
• Event manager UI improvements
• Performance improvements
• Enhanced login reports
• New session file access email report event action
• Email notification of important events like user password expiration and password changes

Version 6.0.20 Official Release — 01/04/2017

• Upgraded to OpenSSL 1.0.1u to address OpenSSL bugs and security vulnerabilities
• Version 6.0 is end-of-life and will see no further updates

Version 6.0.19 Official Release — 5/05/2016

• Upgraded to OpenSSL 1.0.1t to address OpenSSL bugs and security vulnerabilities

Version 6.0.18 Official Release — 3/01/2016

• Upgraded to OpenSSL 1.0.1s to address OpenSSL bugs and security vulnerabilities

Version 6.0.17 Official Release — 12/05/2015

• Upgraded to OpenSSL 1.0.1r to address OpenSSL bugs and security vulnerabilities

Version 6.0.16 Official Release — 7/10/2015

• Upgraded to OpenSSL 1.0.1p to address OpenSSL bugs and security vulnerabilities
• Fixed a bug that would result in incomplete directory reads for SSH SFTP version 6 clients and directories with large numbers of files

Version 6.0.15 Official Release — 6/12/2015

• Updated to OpenSSL 1.0.1n to address security vulnerabilities in OpenSSL
• Changed IP auto-detection to point to more reliable service

Version 6.0.14 Official Release — 3/20/2015

• Updated to OpenSSL 1.0.1m to address security vulnerabilities in OpenSSL
• Updated SOAP libraries to latest version
• Binaries are now compiled against Visual Studio 2013 and accompanying CRT libraries

Version 6.0.13 Official Release — 1/08/2015

• Updated to OpenSSL 1.0.1k to address security vulnerabilities in OpenSSL

Version 6.0.12 Official Release — 10/15/2014

• Updated to OpenSSL 1.0.1j to address security vulnerabilities in OpenSSL

Version 6.0.11 Official Release — 08/08/2014

• Updated to OpenSSL 1.0.1i to address security vulnerabilities in OpenSSL

Version 6.0.10.0 Official release notes — 6/05/2014

• Updated to OpenSSL 1.0.1h to address security vulnerabilities in OpenSSL

Version 6.0.9.0 Official release notes — 5/27/2014

• Fixed information disclosure for SSH logins vulnerability. Analysis of failed login result could allow attacker to determine if an account exists or not. Thanks to Steve Embling, a Pentura Security Researcher, for discovering and reporting this issue.

Version 6.0.8.0 Official release notes — 4/24/2014

• Fixed several important memory leaks when running Personal, Standard, or Professional editions. Enterprise edition not affected.
• Fixed a bug in attribute listings for SFTP protocol version 4 clients

Version 6.0.7.2 Official release notes — 4/15/2014

• Added cache-control exception for IE 7,8 to the no-store, no-cache change introduced in 6.0.7.1 (It breaks downloads in IE 7,8 revert to previous behavior)
• Updated HTTPS web client JS libraries

Version 6.0.7.1 Official release notes — 4/07/2014

• Fixed “Disable after X failed login attempts” not working for accounts that were part of a group
• UI will properly reflect password change permissions for a user when that user is a member of a group
• HTTP/S web client will no longer prompt users with the expired password change dialog if they don’t have permission to change their password
• Modified HTTP/S cache-control mechanism for user file downloads to ensure no user file caching
• Added sort-by-group to the User Manager’s users list
• Do not attempt to shutdown a client-disconnected socket if the connection terminates abnormally
• Updated OpenSSL library to address the recent OpenSSL TLS heartbeat vulnerability referenced by CVE-2014-0160

Version 6.0.7 Official release notes — 3/11/2014

• Fixed a non-public security vulnerability that could allow authenticated users to gain access to unathorized files on the server machine through the HTTP/S web client
• Fixed an HTTP/S web client session timeout during long file uploads
• Fixed a bug that could result in a server crash when FTPS connections timed-out
• Cloned user accounts no longer copy last login times from cloned account
• Significantly increased the HTTP/S buffer size for sending files
• Increased the default socket send/receive size and made it configurable

Version 6.0.6.1 Official release notes — 2/1/2014

• Fixed several memory leaks

Version 6.0.6.0 Official release notes — 1/7/2014

• Updated to OpenSSL 1.0.1f
• Workaround for mobile Safari video upload bug in web client

Version 6.0.5.0 Official release notes — 11/27/2013

• Added a parent directory event variable for file transfer events
• Event Manager rules sorting added to Rules page
• Event Manager condition selection now populates the editing boxes
• Event Manager Add/Edit event button on the Rules page now selects the highlighted event on the Edit page
• Logging package update
• Minor bug fixes

Version 6.0.4.3 Official release notes — 10/30/2013

• Fixed a bug could result in a UI crash when approving an account with email notification enabled
• Fixed a bug in event regular expression evaluation that could result in a match for invalid regular expressions

Version 6.0.4.2 Official release notes — 10/10/2013

• Fixed a bug that could allow an SFTP file transfer ended event to be sent before the file handle closed
• SMTP STARTTLS fix for some servers that require a new EHLO after the connection is upgraded to encryption
• Account requests now include the request date
• Fixed a bug that could result in the synchronization manager not recognizing unique license keys on other machines

Version 6.0.4.1 Official release notes — 9/17/2013

• Fix for Active Directory names with special characters
• Fix for MLST FTP command for directory listings
• Improved FTP RETR error message for when a file does not exist, cannot be accessed, or is actually a directory

Version 6.0.4.0 Official release notes — 9/16/2013

• Added a Public Share page to the User Manager to allow revoking and monitoring user public shares
• Added an option to specify which SMTP server public file sharing should use
• Added an option to always use the SMTP server authentication email address for all public sharing emails
• Automatically reset max connections and re-enable listeners when an expired trial is licensed
• Report Manager can now handle queries on just a date from or date to. Previously could only handle date range, or no date.
• Added password last changed date to the Login report in the Report Manager
• Fixed a problem with filenames with spaces getting truncated in Firefox when using the download button in the web client
• Statistics reports and public file sharing emails now report byte sizes in more human readable formats

Version 6.0.3.2 Official release notes — 8/12/2013

• Added AES CTR ciphers for SSH2
• Added an option to change the root system logger level from the UI
• Added an option on the policy page to force always using the UPN name for AD user home directory names
• Event system performance improvements
• Fixed an event variable email substitution bug that resulted in email to names and emails not being scanned for variables

Version 6.0.3.1 Official release notes — 7/25/2013

• Changes to allow AD authentication against read-only domain controllers for perimeter network deployments
• Fixed a bug that resulted in displaying only the first 25 AD or LDAP accounts in the GUI, even when Show All Accounts was checked
• Fixed a bug in the HTTP/S web client that would result in javascript errors when a user had no virtual directories assigned to their account

Version 6.0.3.0 Official release notes — 7/19/2013

• Added a new backup server synchronization manager
• Added auto-complete for AD user and Cerberus group selection in the web admin AD and LDAP pages
• Added ability to create AD group to Cerberus group mappings in the web admin AD page
• Updated the event manager with a dedicated button and dialog for adding new rules
• Added a backup server synchronized event rule
• Added “does not contain” as an operation for rule filters
• Updated web administration with limited event rule editing
• Added online help links to almost all dialogs
• New fault tolerance features for ensuring XML configuration files will never be left in a partially written state because of an application failure
• Fixed a bug that resulted in failed public key authentication in some instances when a user was a member of a group that used public key authentication
• Minor UI bug fixes and improvements

Version 6.0.2.1 Official release notes — 6/26/2013

• Added auto-create directory paths with %USER% variable option in the Policy page
• Added an “is a directory” variable to file rename, move, and delete events
• Compatibility improvements to the SOAP API DeleteGroup call
• Improved context help in dialogs
• Improved AD user search for when AD authentication domain specified is in another forest than the server
• Fixed a bug where SSL became uninitalized when a new license was applied, or the server was restarted from the file menu

Version 6.0.2.0 Official release notes — 6/12/2013

• Added address book for HTTP/S web client users
• Added public folder sharing through the HTTP/S web client
• Public file sharing emails can now have multiple recipients
• Optimzed HTTP/s web client by reducing script and image files
• Fixed zip archives do not properly handle file names with non-ASCII characters
• Added log threshold to Syslog logger
• Enhancements to MDTM path checking to more accurately detect getting or setting mode
• Enhancements to email notification
• Event manager usability improvements
• Changed the default SOAP/HTTP web administration port to 10001 for new installations
• Ensure most recent settings are saved to disk before a backup
• Additional database setup error detection
• Enhancements to SFTP rename/move to allow renames/moves across volumes, handle very large file paths, and to support overwrite renames

Version 6.0.1.0 Official release notes — 5/06/2013

• Added full UPN support for AD authentication
• Added password changing for LDAP users
• Added an account disable option for users that haven’t logged in within a certain number of days
• Added a %USER% variable that can be used in virtual directory names and paths for users and groups
• Added an option to automatically create directories when approving a new account request
• Improved logic for detecting whether the data connection was gracefully closed at the end of an FTP STOR command
• Added a timer to ensure HTTP/S sessions are cleaned up and closed when they timeout
• Added support for the X-Frame-Options DENY header for HTTP/S web client page responses
• Added an advanced option to allow setting the temporary folder used for HTTP/S web client uploads
• Added an advanced option to specify the default share time (in hours) for publicly shared files
• Added an option to allow user to specify a password for publicly shared files
• Added two events for when a public file is shared, and when a public file is downloaded
• Added bytes transferred information to the log for files uploaded and downloaded
• Added tracking information to see when a public file is downloaded
• Fixed a bug that could result in an error for valid LDAP search filters
• Fixed an HTTP/S web client upload bug for uploading to non-ASCII directory paths
• Newly created Microsoft databases will now store Unicode text properly for statistics and reporting

Version 6.0.0.3 Official release notes — 3/27/2013

• Added a note field for IP access items in the IP Manager
• Added username to all FTP/S and SSH SFTP client command log messages to match HTTP/S auditing
• Improved CSV importing, including support for CSVs exported from third party servers
• Improved auto-updater to allow more selective auto-updating
• Cleaner web administration pages and additional error checking
• Added ability to change several new settings through web administration
• Added a local file and directory selector for file path settings in web administration
• Fixed an issue where the FTP MLST command would fail on files on a network share
• Fixed a bug related to how auto-blocking works with whitelist mode

Version 6.0.0.2 Official release notes — 3/11/2013

• Fixed telephone number wasn’t included with account request notification
• Fixed email server selection for account approval in the web client was ignored
• Fixed setting for modifying hidden directory attribute on virtual directories would not save
• Added HTTP POST event target configuration capability to web admin
• Added public sharing as a permission option for virtual directories in the web admin
• Fixed inconsistent virtual directory permission selection behavior in the web admin
• Improvements to adding and removing LDAP and AD configurations in the web admin
• Fixed “Password Never Expires” setting ignored when adding new accounts
• CSV import now supports setting max logins, max upload filesize, and initial directory for a new user account

Version 6.0.0.1 Official release notes — 3/03/2013

• Numerous bug fixes
• Update the SOAP API

Version 6.0 Official release notes — 2/20/2013

• Upgraded FIPS OpenSSL to 1.0.1 with TLS 1.1 and TLS 1.2 support
• Added advanced statistics collection and a new Report Manager
• Added public file sharing to the web client
• Updated web client upload control
• Users and groups can now have whitelist IP ranges
• AD groups can now be mapped to Cerberus groups for assigning virtual directories
• Configurable timeout support for HTTP/S web client sessions
• Zip and unzip file operation actions for event actions
• HTTP POST operation event action to allow posting event information to a URL
• More variables for events
• Added variable substitution to event email recipient name and email address fields
• Added ability to customize email subjects on event emails, including variable substitution in subjects
• Added ability to set disable after time for users and groups through web administration
• Updated, easier to use AD and LDAP admin pages
• Access to advanced security settings from the Settings page
• Access AD and LDAP user attributes like name and email address for events

Version 5.0.10 Official release notes — 6/09/2014

• Updated OpenSSL to 0.9.8za
• Version 5.0 is end-of-life and will see no further updates

Version 5.0.9 Official release notes — 5/27/2014

• Fixed information disclosure for SSH logins. Analysis of failed login result could allow attacker to determine if an account exists or not. Thanks to Steve Embling, a Pentura Security Researcher, for discovering and reporting this vulnerability.
• Fixed a possible crash with FTPS connections on abnormal connection disconnect

Version 5.0.8.0 Official release notes — 3/11/2014

• Fixed a non-public security vulnerability for authenticated users
• User accounts weren’t disabled when their disable-after-date elapsed and the user was a member of a group, but the disable-after-date setting was overridden

Version 5.0.7.0 Official release notes — 2/07/2013

• Updated OpenSSL to 0.9.8y

Version 5.0.6.1 Official release notes — 1/25/2013

• Fixed an AD and LDAP virtual directory bug introduced in 5.0.6

Version 5.0.6.0 Official release notes — 12/11/2012

• Fixed a web admin XSS vulnerability (CVE-2012-6339)
• Minor updates and improvements

Version 5.0.5.1 Official release notes — 11/15/2012

• Improved auto-blocking for HTTP/S web client bots
• Optimized temporary file creation for file uploads ensures cancelled upload temporary files are deleted
• Various system-wide performance improvements
• Added email approve/disaprove notification to the we admin account request manager
• Fixed a minor bug that would not let an admin add a directory to a newly created account through the web admin

Version 5.0.5.0 Official release notes — 9/25/2012

• Fixed a CSRF vulnerability (US-CERT VU#989684) in the web admin
• Web client users can now replace existing files on upload if they have the correct permissions
• High DPI display improvements for the GUI
• No longer allow multiple logged in users to run the Cerberus Console at the same time

Version 5.0.4.3 Official release notes — 9/7/2012

• Fixed a problem with Office documents not opening directly from the web client in some versions of IE
• Minor changes and updates to the web client
• Optimization for authenticating against very large LDAP databases

Version 5.0.4.2 Official release notes — 8/13/2012

• Added LDAP authentication configuration to web administration
• Added option to require password change on next login
• Updated HTTP/S web client
• Fixed the CSR generator to accept wildcard common names

Version 5.0.4.1 Official release notes — 7/12/2012

• Simultaneous login count was not getting decremented on logout for AD accounts
• Added ability to change passwords for AD accounts
• Improvements to the Getting Started Wizard
• Improved the LDAP account listing in the LDAP page of the User Manager

Version 5.0.4.0 Official release notes — 6/15/2012

• DES cipher availability is now disabled by default for all SSH connections
• Added a MIME mapping dialog to change HTTP/S file MIME mappings
• Added reCAPTCHA option to the HTTP/S login page
• Modified the CSR generator to work with Verisign
• Made comparison on file extension caseless to determine MIME type
• Added support for the check-file-name SSH2 SFTP integrity/hash extension command
• Added support for the vendor-id SSH2 SFTP extension command
• Improvements to web administration (AJAX interface selection)

Version 5.0.3.1 Official release notes — 5/12/2012

• Minor UI bug fixes and improvements
• Added email notification option for approving or declining account requests
• UI updates to better support Windows 8 and Server 2012
• Added a MIME type mappings file to allow user customization of MIME types for the web client
• Updated OpenSSL to latest version
• Can now use a DNS-style domain name for AD authentication on Windows 2003 server and lower OS
• More flexible domain controller auto-selection for Windows 2003 server and lower
• Group IP whitelists are now applied to AD and LDAP users

Version 5.0.3.0 Official release notes — 4/20/2012

• Added an option to create impersonated AD user before creating the initial home directory to ensure the AD user has owner rights on the home directory
• HTTP/S range support for partial content retrieval and file resume
• Updated the web client
• Updated controls for Users page of the User Manager
• Added ability to restrict IPs by user account or group
• Added maximum upload file size quota for user accounts
• Added event rule for disable-after-date events
• Fixed a bug where some symbols in URLs were not properly escaped
• Fixed events bug where server operations actions were not saved properly to file
• Fixed a bug where SSH clients attempting to open unsupported channels are not told of the failure

Version 5.0.2.0 Official release notes — 3/16/2012

• Web client directory browser re-write for major performance improvements by performing paging, sorting, and filtering on the server
• Removed file and directory display limits from the web client directory browser
• New, dynamic user and group updates through the web client
• Enable or disable allowing user updating through the web client
• Enhanced certificate conversion now separates and includes CA certificates when converting a binary certificate bundle to PEM format
• Rolled back a change to FTP PORT socket binding introduced in 5.0.1.1

Version 5.0.1.2 Official release notes — 2/24/2012

• Fixed a bug that prevented changing the default SOAP port
• Fixed a bug that prevented creating new users through the web admin if a password policy was set
• Added the ability to customize the web client login image, page title, default directory list count, and file date local time and timezone display from the UI
• Added a file preview feature to the web client
• Added an event time variable and the ability to filter by time
• Added server event targets delete and disable user or group

Version 5.0.1.1 Official release notes — 2/14/2012

• Fixed an SFTP bug that resulted in an SFTP client timeout while establishing a session
• Added additional fault tolerance if the SOAP port is in use by another process
• Usability improvements to the Event Manager
• Smarter detection of SOAP port and protocol changes by the Cerberus UI
• Enhancements to port binding to require exclusive access to the port
• Improved error messaging for in-use ports in the log

Version 5.0.1.0 Official release notes — 2/7/2012

• Added ability to enter a license key via web administration
• Cleanup and enhancement of the HTTP/S web client
• HTTP/S web client can now delete directories that are not empty
• HTTP/S web client file zip and unzip support added
• Added confirmation dialog before deleting files of directories in the web client
• Web administration enhancements and bug fixes
• The server no longer waits for a client SSH NEWKEYS before sending its own new keys message
• Fixed a bug in the Event Manager that would not allow deletion of an event sink
• Fixed a bug that could result in the group variable not getting set for some HTTP/S file transfer events
• Fixed a User Manager rename bug that resulted in user settings not getting when a user was changed right after getting renamed
• Fixed a group save bug that resulted list permission changes not getting saved
• Fixed an exception bug if TLS/SSL was disabled and an FTPS or HTTPS connection was attempted

Version 5.0.0.7 Official release notes — 1/10/2012

• Fixed a virtual directory bug when adding virtual directories in the User Manager
• Added icons for common file types to HTTP web client

Version 5.0.0.6 Official release notes — 1/5/2012

• Added option to redirect HTTP to HTTPS for HTTP interfaces
• Added support for larger ephemeral keys during SSH key exchange
• ECDH SSH key exchange is now supported regardless of server host key type
• Updated cryptographic library
• Added event variable selection option to the event manager

Version 5.0.0.5 Official release notes — 12/09/2011

• Improved HTTP/1.0 support
• Content-Disposition with filename now set for downloaded files
• Automatic conversion of certificates to PEM format for FIPS mode
• FTPS protocol checking bug fix
• Added option to turn on/off welcome message for HTTP/S connections
• Added option to turn on/off welcome message for SSH SFTP connections
• Added option to disable web account requests for HTTP/S connections
• Added option to stop checking authentication sources if user exists in a source but password was incorrect
• Performance improvements

Version 5.0.0.4 Official release notes — 11/21/2011

• Fixed HTTP protocol bug on x64

Version 5.0.0.3 Official release notes — 11/15/2011

• Improved HTTP caching headers for better web client performance
• Improved HTTP error handling
• Added STARTTLS and TLS/SSL SMTP server support for email notification
• Added ability to permanently whitelist an IP address
• Added event manager support to web administration
• Added DoS protection for HTTP connections
• Fixed a problem with IE sending multiple cookies with the same name
• Fixed an SFTP append bug
• Fixed an HTTP bug that prevented some uploads with AD accounts

Version 5.0.0.2 Official release notes — 11/03/2011

• Fixed bug with AD authentication and HTTP
• Fixed HTTP cookie not always getting set
• Fixed an AD directory mapping bug
• Fixed an HTTP upload bug in some version of IE
• Improved HTTP redirection
• Improved web client error reporting

Version 5.0.0.1 Official release notes — 10/25/2011

• Added web administrator account request approval
• Added web administrator security page
• Added web administrator add/delete listener capability
• Several web administration bug fixes and usability improvements
• IP manager UI bug fix
• Minor bug fixes

Version 5.0.0.0 Official release notes — 10/17/2011

• HTTP and HTTPS client access
• Event support (SMTP notification, launch an external process)
• New Summary page provides health, security and compliance status at a glance
• New password change policy requirement options
• New password expiration policies
• New password storage options: Cryptographically salted MD5, SHA1, SHA256, SHA512
• SSH SFTP password change support
• Added file and directory listing permissions to virtual directories
• Added FTP MODE Z compression support
• SFTP now sends the welcome message as an SSH banner message
• New account request via web HTTP/HTTPS
• Added option to add additional account information like name, email, telephone
• Added support for new FTP HASH command
• Added ability to restrict login by protocol login on a per user and group basis
• Added SSH MAC algorithms hmac-sha2-256, hmac-sha2-256-96, hmac-sha2-512, and hmac-sha2-512-96
• Improved web administration performance and web administration options
• New CSR generation tool

Version 4.0.14.0 Official release notes — 6/09/2014

• Updated OpenSSL to 0.9.8za
• Version 4.0 is end-of-life and will see no further updates

Version 4.0.13.0 Official release notes — 7/26/2012

• Minor bug fixes

Version 4.0.12.0 Official release notes —

• Updated OpenSSL
• Updated Installer

Version 4.0.11.0 Official release notes — 10/30/2011

• Added POST support to several web administration forms

Version 4.0.10.0 Official release notes — 10/04/2011

• Fixed a minor SSL accept bug
• Fixed stats CSS file not getting copied over for reports
• AD and LDAP SFTP users can now authenticate with public keys in addition to passwords

Version 4.0.9.8 Official release notes — 7/25/2011

• Server no longer creates the Global Home/%username% directory for AD users if it does not exist and the user fails login
• Added a file open fix for a buggy SFTP client
• Improved GUI/service communication

Version 4.0.9.7 Official release notes — 6/22/2011

• Added support for SFTP text and append mode

Version 4.0.9.6 Official release notes — 5/19/2011

• Fixed an FTPS bug that could prevent the server from accepting connections

Version 4.0.9.5 Official release notes — 5/17/2011

• Enhanced logging – more descriptive system messages and better syslog level mapping
• Virtual directory roots are no longer deletable through FTP or SFTP commands
• Notification of support agreement ending for licensed users
• UI internal cleanup and optimizations
• Entering a license key now prompts to restart the server
• Allow DSA with SSH in FIPS mode

Version 4.0.9.3 Official release notes — 4/15/2011

• Recompiled with Visual Studio 2010 SP1 and latest SDK
• Improved error checking

Version 4.0.9.2 Official release notes — 4/07/2011

• Removed an SSL shutdown check that could prevent certain buggy clients from disconnecting
• Improved system performance

Version 4.0.9.1 Official release notes — 3/27/2011

• Allow zero length file transfers for FTPS connections
• Ignore permission change requests with SITE CHMOD (meaningless on Windows)
• SFTP permission rules now identical to FTP for deleting existing files
• Better consistency with file operation logging and auditing between different protocols
• Turn on and off specific screen log messages

Version 4.0.9.0 Official release notes — 3/10/2011

• Added elliptic curve key exchange for SSH SFTP as specified in RFC 5656
• Added support for elliptic curve SSH client keys
• FTPS performance improvements
• No longer sets file size on file creation when SFTP clients request it
• Fixed a bug in the STOU command introduced in version 4.0.8.3

Version 4.0.8.3 Official release notes — 2/23/2011

• Enhanced FTP and FTPS file and directory operation auditing and error reporting
• Added basic FTP STAT command support
• Improved FTP HELP command support
• Fixed self-signed certificate wizard would fail if no email address was specified
• Additional error checking during initial setup wizard

Version 4.0.8.1 Official release notes — 2/17/2011

• Fixed interface status pane was sometimes hidden
• Fixed a remote settings save bug
• New certificate verify dialog
• New Cerberus logo and icon

Version 4.0.8.0 Official release notes — 1/20/2011

• Require verifying security settings before saving and applying new settings
• Fixed a bug that could result in failure to decode file-based OpenSSH public keys
• RFC conformance for active mode data connections established from non-standard FTP ports (L-1 instead of always from port 20)
• RFC comformance for default data port when no PORT or PASV command is issued
• Fixed a bug that could result in service shutdown when terminal services connections are terminated

Version 4.0.7.6 Official release notes — 11/30/2010

• Fixed rare bug that could cause failure to accept connections
• Minor logging improvements
• Added right-click log window copy to clipboard
• Enabling or disabling remote web access not longer requires a service restart
• Updated auto-updater for Windows 2000 machines

Version 4.0.7.5 Official release notes — 11/22/2010

• Improved SFTP channel window size handling

Version 4.0.7.3 Official release notes — 11/15/2010

• Added feature to allow manually specifying interfaces when an interface isn’t detected
• Fixed UI to allow user mapping through the GUI when multiple LDAP servers have the same IP
• Fixed a possible memory leak with LDAP authentication
• Fixed a virtual directory bug for overlapping paths
• Numerout UI improvements
• Performance improvements

Version 4.0.7.2 Official release notes — 11/01/2010

• Added a statistics file error detection and automatic repair feature
• Added logging output, statistics generation, and several IP manager options to web administration
• Added ability to add/modify/delete groups to web administration
• Significant improvements to web administration performance and layout
• Significantly increased the SSH maximum packet size to accommodate clients that use large packets
• Fixed a bug in WAN IP auto detection that could result in excessive processor utilization

Version 4.0.7 Official release notes — 10/19/2010

• Added a DoS option to IP auto blocking to allow blocking connection attempts that do not attempt to login
• LDAP and AD user to group mappings are no longer case sensitive
• LDAP users now honor the disabled flag if it is set on a mapped Cerberus group when authenticating with PK
• LDAP users no longer require the “Use Cerberus Groups and Directories” flag set when mapping LDAP users to groups
• All binaries are now compiled with VS2010 and linked with the v10 CRT

Version 4.0.6 Official release notes — 10/08/2010

• New smaller, smarter and more reliable installer
• New complete server configuration backup and restore feature
• Larger list boxes on the Users and Groups page of the User Manager
• Statistics page generation can now be done while running as a service

Version 4.0.5.5 Official release notes — 10/01/2010

• Added web service block address method
• Fixed an SFTP bug that could result in corrupt file transfers for some Unix SFTP clients
• Updated logging library

Version 4.0.5.4 Official release notes — 9/26/2010

• Added quotes around the path string when installing as a service

Version 4.0.5.3 Official release notes — 9/23/2010

• Additional LDAP error logging
• Disable offering MAC MD5 algorithm for selection in FIPS 140-2 mode for SFTP
• FTP connection denied messages were not being encoded correctly

Version 4.0.5.2 Official release notes — 9/10/2010

• Faster startup time
• Improved public key authentication compatibility for SFTP clients based on OpenSSH
• Support for SFTP real path compose and compatibility improvements with some SFTP clients

Version 4.0.5 Official release notes — 9/02/2010

• Condensed authentication logging
• AD authentication will use the nearest domain controller for AD authentication instead of always using the PDC
• Fixed unable to select “Password” authentication without selecting a public key bug
• Fixed log file color of warning messages and added several suggest fix log file messages for common problems
• SFTP real path command improvements

Version 4.0.4.3 Official release notes — 8/17/2010

• Fixed a bug with Active Directory and LDAP authentication of SFTP users

Version 4.0.4.2 Official release notes — 8/16/2010

• Lowered the SSH initial window size for a channel to work-around buggy SFTP clients
• Better SSH windows size negotiation support for large file transfers

Version 4.0.4.1 Official release notes — 8/12/2010

• Added support for OpenSSH public key format

Version 4.0.4.0 Official release notes — 8/9/2010

• Added Public Key authentication for SFTP
• Cleaned up the Interfaces tab to prevent duplicate ip/port changes and to warn about inconsistent interface/port combinations

Version 4.0.3.3 Official release notes — 7/20/2010

• Fixed a bug with SFTP listings not allowing UNC virtual directories
• Improved compatibility with SFTP clients and very large directory listings
• Improved compatibility with SFTP clients that STAT the root directory

Version 4.0.3.2 Official release notes — 7/19/2010

• Fixed a that could result in the passive port range being reset to the default when upgrading to version 4.0.3
• Fixed a minor bug that would result in directory listings failing when given the path “./”

Version 4.0.3.1 Official release notes — 7/08/2010

• Fixed a bug with some default FTPS interface settings not getting saved correctly
• Added a config setting to require common name and username matches when verifying client certificates

Version 4.0.3.0 Official release notes — 6/30/2010

• Default interface settings can now be set for all types of interfaces
• Newly detected IP addresses can now be configured to auto-bind to multiple types of listeners
• All lists can now be sorted on the LDAP and AD mapping tabs
• Fixed a bug in the web administration GUI that prevented changing download permission on a virtual directory
• Fixed a bug in the SITE PSWD command that would reject passwords with capital letters
• Fixed a bug in the MLSD and MLST commands that caused directory listings to always show hidden files
• Fixed a bug in client certificate authentication
• CA certs are now loaded when present in PKCS12 files
• Added support for Certificate Revocation Lists (CRLS)
• Added support for DSA and Elliptical curve certificates
• Added support for ephemeral RSA and Diffie-Hellman key exchange
• Added DSS key exchange support for SSH SFTP
• The self-signed certificate creation dialog now offers the choice of RSA, DSA, or Elliptical Curve certificates
• Added support for SSH2 public key authentication
• SSL settings can now be changed and applied without restarting the server

Version 4.0.2.2 Official release notes — 6/14/2010

• Display bug fix for SSH connection ID always being zero for the first log message for that connection
• Fixed a bug with temporary IP blocks being released too early
• Whitelist IP mode now honors temporary auto-blocking (if set) instead of permanently removing an IP address
• User interface improvements for the IP Manager (context menu options and header sorting for the IP list)
• Added context menu options for filtering the onscreen log view
• Fixed a bug where max simultaneous connections wasn’t tracked correctly for a user
• Fixed an AD user impersonation bug

Version 4.0.2 Official release notes — 6/7/2010

• Disabled status is now taken into consideration for LDAP and AD groups
• Disabled groups now show up faded on LDAP and AD mapping tabs
• Auto blocking now works properly for SFTP connections
• Fixed a handle leak with SFTP connections
• Increased the size of the IP Manager
• Added ability to search for an IP address in the IP Manager
• Added Classless Inter-Domain Routing (CIDR) support for adding IP ranges to the IP Manager
• Added option to change virtual directory paths in the User Manager

Version 4.0.1.1 Official release notes — 5/27/2010

• Fixed an LDAP authentication bug that allowed anonymous binds
• Enhanced the “Check for Updates” dialog

Version 4.0.1 Official release notes — 5/24/2010

• Improved support for SFTP key re-exchange
• Several improvements to the web administration interface
• Added an option to ignore SFTP channel window size violations
• Added an option to disallow setting SFTP encryption to ‘none’
• More forgiving directory parsing code for paths with multiple consecutive slashes in non-virtual directory mode

Version 4.0.0.11 Official release notes — 5/18/2010

• Improved SFTP support, especially for Linux and Unix clients

Version 4.0.0.9 Official release notes — 5/14/2010

• Improved the web administration interface and added new features
• Fixed a bug with using SFTP in FIPS 140-2 mode
• Fixed a bug with failing to recognize IP ranges during IP blocking
• Updated SOAP support

Version 4.0.0.8 Official release notes — 5/8/2010

• Fixed a simple directories bug for SFTP
• Fixed a passive connection bug
• Fixed a bug that could result in problems changing interface ports
• Updated the OpenSSL libraries to the latest version

Version 4.0.0.6 Official release notes — 5/7/2010

• Fixed a bug that could result in problems changing interface ports
• Updated the OpenSSL libraries to the latest version

Version 4.0.0 Official release notes — 5/3/2010

• Added File transfer over SSH (SFTP)
• Added Implicit TLS/SSL FTP (FTPS)
• Added ability Listen for connections on multiple ports for a single IP
• Allow simultaneous FTP, SFTP, and FTPS for a single interface
• Allow Active Directory domain authentication against multiple domains
• Allow LDAP authentication against multiple LDAP servers
• Associate Active Directory users and LDAP users with Cerberus Groups to allow customization for inh3idual Active Directory or LDAP users
• New policy page to allow configuring password length and complexity requirements
• Auto-disable native accounts after too many failed password attempts
• New Authentication chaining control to allow configuring the order that users are checked against authentication services
• Temporary user and group accounts

Version 3.1.4 Official release notes — 2/26/2010

• Version 3.0 is end-of-life and will see no further updates
• Updated configuration files to encrypt some settings
• Added a Verify button to the Security dialog to test certificates and keys
• Service and GUI now sync up immediately when the GUI changes the username or password of the service

Version 3.1.3.1 Official release notes — 2/12/2010

• Fixed a bug that caused anonymous users to see blank directories

Version 3.1.3 Official release notes — 2/10/2010

• Passed Windows 7 compatibility tests from Microsoft
• Fixed Cerberus group settings ignored for require secure control and require secure data

Version 3.1.2 Official release notes — 2/05/2010

• Adjustments to screen drawing code to better deal with screen DPI scaling
• Added additional SSL connection auditing information (cipher used) to the log
• Added capability to select the ciphers used and not used for secure connections
• Fixed a bug where interfaces configured for passive mode DNS or manual IP could switch modes when running as a service

Version 3.1.1 Official release notes — 2/03/2010

• Added a limiter to the user manager when enumerating Active Directory accounts
• Improved error checking for some commands
• Added support for SITE UTIME command (both formats)
• Made sure to properly shutdown TLS/SSL connections for idle connection time outs
• Added support for client command OPTS UTF8 OFF to turn off default UTF8 mode

Version 3.1.0.5 Official release notes — 1/26/2010

• Added an alternate IP address detection method for rare cases where an IP interface can’t be detected
• Fixed a problem with the service always using the default passive port range

Version 3.1.0.4 Official release notes — 12/17/2009

• Fixed a bug that could cause connections to disconnect immediately after making a connection
• Enhanced the listing commands with more UNIX-style options
• Fixed listing commands with wildcards for network shares

Version 3.1.0.3 Official release notes — 12/16/2009

• Reorganized the Active Directory and LDAP authentication configuration pages
• Added the option to pick a group to associate with an Active Directory user
• Active Directory user home directories can now be located on non-anonymous shares
• Added the option to select a “Global Home Directory” for LDAP users or a “Global Home Directory/%username%” just like for Active Directory users
• Better error checking and reporting for when there are problems accessing virtual directories
• Miscellaneous performance improvements

Version 3.1 Official release notes — 11/22/2009

• Renaming a group now updates users that include that group
• The GUI can now be accessed when running as a service
• Large performance improvements when running in service mode

Version 3.0.8 Official release notes — 10/15/2009

• Fixed a bug that could cause the server to crash
• Made all SOAP calls require login credentials
• System-wide performance improvements

Version 3.0.7.1 Official release notes — 10/06/2009

• Fixed a bug that could allow an attacker to crash the server

Version 3.0.7 release notes — 10/05/2009

• Fixed a bug that could allow multiple instances of Cerberus to run when running as a service
• Vista and higher will no longer get interactive service messages when running as a service
• Performance improvements

Version 3.0.6 release notes — 09/28/2009

• Added loopback address detection for IPv6 addresses
• Added support for clients that quote the filename passed for XCRC, XSHA1, XSHA256, XSHA512, and XMD5 commands

Version 3.0.5 release notes — 09/20/2009

• Fixed a bug that could prevent HTTPS SOAP connections
• Added the ability to use PKCS12 formatted certificates for the secure SOAP and built-in web server
• Major improvements to the web-based user manager
• XML reading and writing performance improvements
• Minor system-wide performance improvements

Version 3.0.4 release notes — 09/12/2009

• Miscellaneous system-wide performance improvements
• Additional system logging and error checking
• Added a log filter to the logging tab
• Added a the capability to require secure control and data connections on a per user and per group basis
• Minor UI improvements
• Fixed a bug that resulted in not being able to select network shares or mapped drives from the dialog box for user directories
• Made the SOAP API version 1.2 compliant

Version 3.0.3 release notes — 08/25/2009

• Fixed a bug that resulted in interface activate settings not getting saved
• Added right-click menus to connections and transfers tabs

Version 3.0.2 release notes — 08/16/2009

• Fixed a bug that refused anonymous logins with empty passwords
• Fixed a bug that sometimes prevented interface settings from being applied at startup
• Fixed a crash bug
• APPE can now append to files greater than 4GB in size
• Added over a dozen new web service calls
• Updated the help file

Version 3.0.1 release notes — 07/31/2009

• Fixed General tab of IP Manager not displaying on Windows 2000 Server
• Fixed IP block time not getting updated for connections
• Fixed authentication so that the group setting for “Is Anonymous” and “Is Disabled” was considered for a user that was part of the group
• Updated the help file

Version 3.0 release notes — 07/21/2009

• Added LDAP authentication support
• Added support for client commands XSHA256, XSHA512, ALLOC
• Speed improvements to the login process
• Completely rewritten web administration capability (Work in progress)
• Linked against the FIPS 140-2 validated OpenSSL cryptographic module
• Added FIPS 140-2 mode
• Added support for the CCC, MFMT, and MFCT commands
• Continued improved UTF-8 support and bug fixes
• EPSV command support
• International character set support (Unicode)
• Added support for the CSID and RMDA extension commands
• Added support for the MLST and MLSD extension commands
• Added groups support
• Converted the users and settings files to XML – No more dependency on the Windows Registry
• Added a new auto-update system for upgrading Cerberus
• Added support for the CLNT command (client name)
• Added support for the XCRC command
• Added support for the XSHA1 command
• Added support for the SITE ZONE command
• Added an option to bind to the localhost address
• Complete rewrite of the underlying GUI framework
• Updated to the latest versions of log4cxx, gsoap, and the OpenSSL libraries
• Updated the look and feel of the GUI controls, new toolbar buttons, converted many icons to Vista quality
• Added a moving chart to the statistics pane to show upload and download bandwidth used over time
• Moved all configuration and user files from the Program Files group to the appropriate Application Data directory
• Improved Vista compatibility
• No more startup delay while detecting the WAN IP address
• Improved the key strength and options for generating self-signed certificates
• Native, 64-bit version

Version 2.50 release notes — 05/04/2009

• Fixed a bug in the response to the SIZE command when responding to directory SIZE requests

Version 2.49 release notes — 10/02/2008

• Fixed an incompatibility with some FTP clients when using secure connections
• Fixed a bug that sometimes resulted in the server service shutting down when a user logged out
• Updated the log4cxx and OpenSSL packages to the latest versions
• Cerberus now binds to the C-Runtime libraries dynamically

Version 2.48 release notes — 6/26/2008

• The RETR command now correctly returns an error code when a path is a directory instead of a file – This should resolve Firefox incompatibilities
• Updated the log4cxx and OpenSSL packages to the latest versions

Version 2.47 release notes — 2/10/2008

• Fixed a bug that resulted in no response being sent back for an unsupported MODE
• Added an option to disable/enable detection of IPv6 addresses
• Fixed a toolbar display issue
• The columns in the main tab window now auto-resize when the applications size changes

Version 2.46 release notes — 11/7/2007

• Fixed a bug that prevented blocking a connected user from the GUI
• Fixed a bug that caused the MDTM command to fail when setting a date/time and the file path contains spaces
• Fixed a bug that resulted in a failure code being returned when a directory LIST or NLST filter returned no matching files
• Fixed an XSS vulnerability in the web interface

Version 2.45 release notes — 4/27/2007

• Fixed a bug that prevented blocking a connected user from the GUI
• Fixed a dynamic DNS bug that resulted in the wrong external IP being used when multiple interfaces are resolving from different DNS addresses
• Fixed a bug in the IP blocker dialog that sometimes failed to properly delete an IP address

Version 2.44 release notes — 3/27/2007

• Fixed a display bug in the generate statistics function
• Fixed a dynamic DNS bug
• Fixed a bug in the IP block list that prevented IP addresses from being deleted
• Fixed a bug in the IP block manager that resulted in corrupt block list upgrades from version 2.42 and below
• Fixed a bug in that sometimes resulted in failed active data connections
• Upgraded the IP block list file format to XML

Version 2.43 Official notes — 3/19/2007

• Preliminary IPv6 Support
• Resolved installation issues on Windows 2000
• Added an option to always use the local address for passive commands when the connection is on the same LAN

Version 2.42 Official notes — 2/27/2007

• Resolved a bug that could result in a crash when generating a statistics file
• Resolved a bug resulting in a connection never terminating when a remote client’s connection is broken during an upload to the server
• Compiled against the most recent version of OpenSSL

Version 2.41 Official notes — 2/21/2007

• Updated the logging system to use the latest version of log4cxx
• Fixed a bug that resulted in the log file failing to be updated when running as a service
• Updated gSOAP support and fixed a realm authentication bug
• Added support for the EPRT and EPSV commands
• Compiled against the most recent version of OpenSSL

Version 2.4 Official notes — 9/09/2006

• Fixed a GDI resource leak
• Fixed an bug that caused an error message to be displayed when a user initiated a file backup
• Compiled against the most recent version of OpenSSL

Version 2.4 BETA 3 notes — 5/18/2006

• Added a confirmation dialog for deleting user and virtual directories
• Added a users file backup and backup restore capability
• Compiled against the latest OpenSSL release (0.98b)

Version 2.4 BETA 2 notes — 5/7/2006

• Changed the FEAT command response to more closely match the FTP RFC
• Added SSLv3/TLSv1 support
• Added option to require SSL/TLS control and data protection
• Added option to require NT users to be part of a security group before uthorizing access
• Miscellaneous minor bug fixes and UI improvements

Version 2.4 BETA 1 notes — 11/20/2005

• Fixed a DDoS bug
• Added explicit TLS/SSL support
• Fixed an incompatibility with Firefox that resulted in directory contents sometimes not being shown in Firefox
• Improved web services support
• New file logging system based on log4cxx (work in progress)

Version 2.32 notes — 7/7/2005

• Fixed an IP manager GUI bug
• Added data validation to several IP manager fields
• Fixed a bug that sometimes caused the server to crash when closing

Version 2.31 notes — 6/15/2005

• Fixed Getting Started Wizard bug
• Improved the login notification messages
• Fixed several dialog inconsistencies
• Added descriptions to several menu items

Version 2.3 notes — 6/12/2005

• Fixed a bug that resulted in virtual directories mapped directly to drives sometimes not displaying without checking the “Show Hidden Folders” property
• Added the SITE CHMOD command to allow for limited file property changes
• Fixed a minor GUI resource leak
• Improved the progress bar look
• Progress bars no longer require 1% of the transfer to complete before appearing
• Added tooltip help to many of the dialog controls
• Added several new root directory options for NT authenticated users
• Added color coding for different types of log messages
• Added a desktop popup notification window for new connections
• Corrected a minor bug that resulted in “log” being appended to whatever directory was selected as the log file directory for XML logging
• Dialogs now tab correctly
• New look to the Server, IP, and User manager
• New Hi-color icons for the toolbar and dialog boxes
• Improved WAN auto-detection with shorter timeout
• Users can now launch the initial setup screen from the main menu
• Numerous minor bug fixes and UI improvements

Version 2.23 BETA notes — 2/05/2005

• Replacing an existing file using rename now requires delete permission
• Added number of connections and current transfer rates as tooltip bubbles on the notification icon
• Corrected a bug that allowed users to continue to attempt to login after they had been auto blocked if the connection remained open
• Replaced a few icons with enhanced Hi-color icons
• Added current transfer rate indicators to the status bar
• Corrected a bug that sometimes showed the date in the wrong format during a “LIST” operation
• Corrected a few bugs that could result in incorrect transfer rates being displayed during a file transfer. Updated the transfer rates to reflect current transfer rate as opposed to average transfer rate.
• User and group information should now be displayed for directory items listed during a wildcard “LIST”
• Added configurable denied welcome message for when the server is set to not accept logins
• The taskbar notification icon now changes when the server has at least one user connected
• Cerberus can now detect and add itself to the Windows Firewall exclusion list
• MDTM time can now be configured to set the modification time and access time on a file

Version 2.22 Official notes — 9/23/2004

• Fixed a timeout bug in the “Optimized file transfer” mode
• Cancelling a connection now properly terminates users who are transferring files
• The correct tooltips are now displayed for the Connections and Transfers tabs
• The Transfers tab now displays the bytes transferred out of total
• The Speed value on the Transfers tab now has 2 decimal places of precision
• Added right-click menu option to terminate a connection from the Transfers tab
• Fixed a bug that resulted in connection IDs being displayed in the wrong base format
• Fixed a bug in the IP Manager that could result in corrupt IP blocking file when only a single address was entered to block

Version 2.21 Official notes — 9/02/2004

• Fixed a bug in the “Use Optimized Transfer mode” setting that resulted in corrupted files being transferred
• Installer now changes default send and receive buffer size to 64KB

Version 2.2 Official notes — 8/30/2004

• Added the SITE PSWD command to allow users to change their own passwords
• Fixed a bug that could result in a file transfer error causing a 100% CPU utilization spike
• Send and receive buffer settings now more directly affect file transfer speeds – Note: Has no impact when using “optimized file sending” mode
• Anonymous passwords are now logged
• Icon colors are now full color under all versions of Windows
• New higher color Cerberus icon
• Fixed “group name too long” directory listing bug
• Long directory listings now correctly display the year when the file is a year or older.
• New WAN IP Auto-detection feature

Version 2.2 BETA 3 notes — 6/06/2004

• Added NT user and active directory authentication
• User and group information is now displayed for files and directories during a long file listing (NT4, 2000, XP, 2003 only).
• The “X” (Close) button now works in sub windows
• Miscellaneous user interface fixes
• Updated Help file

Version 2.2 BETA 2 notes — 5/10/2004

• Corrected a Virtual Directory rename problem in the User Manager
• Added a safeguard check to prevent renaming of Virtual Directories with forward or backslashes

Version 2.2 BETA 1 notes — 5/10/2004

• Changed the directory listing commands to accept and interpret common UNIX “ls” flags within LIST and NLIST commands
• Added a simple directory mode in addition to the standard virtual directory mode
• Greatly improved support for wildcards within LIST and NLIST commands
• Greatly improved support for the common MGET; ftp implementation thanks to better wildcards support
• Pressing enter or esc after renaming an item in the User manager no longer closes the dialog box
• Added support for Windows XP themes
• Changed the look of many of the program icons
• Added Web Services interface to many common FTP server tasks
• Added a new simple virtual directory mode (see the help file for more details)
• Added support for UNC paths as virtual directories
• Users in the User manager are now sorted in alphabetical order

Version 2.16 Official release notes — 3/25/2004

• Fixed a bug that could result in an interface failing initialization in NT4
• Added an option to disable the startup tip that appears when starting the server

Version 2.15 Official release notes — 2/06/2004

• Fixed a major bug in the ‘Use different IP for PASV’ option.

Version 2.15 BETA release notes — 1/25/2004

• Added a default interface to the interface configuration screen. The user-defined settings from the default interface are now applied to new interfaces automatically.
• Added an automatic IP-blocker. Administrators can now configure filters to automatically block IP addresses (temporarily or permanently) that fail authentication after a certain number of attempts.
• Added a new network checklist screen to the Getting Started Wizard. The new wizard will point out possible problems in the network configuration that may cause problems with an FTP Server.
• Added an auto-detect IP address feature. The server can now automatically detect and activate new interfaces, as well as clean up and deactivate interfaces that have been released.
• Added a line limit option to the onscreen logger.
• Corrected a bug with the “Deny FXP Transfers” option.
• Changed the look of the taskbar icon

Version 2.11 release notes — 12/21/2003

• Changed the permissions structure so that uploaded files cannot overwrite existing files unless the user has delete permission
• The MDTM command can now be used to set the date/time on an uploaded file
• Enhanced file send operations by allowing the OS to cache files
• Added an option under the “Advanced” tab of the server manager that instructs the server to use the “TransmitFile” API call to send files. Not available on Windows 98.

Version 2.11 BETA 2 release notes — 11/11/2003

• Added automatic import of previous Cerberus settings(except interfaces)
• Fixed a buffer overflow vulnerability
• Added experimental support for the OPTS and LANG commands
• Fixed a bug the caused a “550 Invalid Path” error message whenever a CWD to the root (“/”) was issued
• Resolved a bug that caused settings changes to be lost on restart when Cerberus was installed as a service
• Corrected some cosmetic flaws in the GUI’s server manager
• Fixed a bug that turned off command logging when connection logging was turned off

Version 2.11 BETA release notes — 10/29/2003

• Adjusted the dialog button positioning so that the buttons wouldn’t get clipped on XP
• The login process has been changed so that incorrect usernames will now be prompted for passwords. This is a security enhancement.
• Fixed a UI bug that could cause the Getting Started Wizard to keep showing up after a reboot
• Added an option under the “Advanced” tab of the server manager to deny FXP transfers.
• Added an option under the “Advanced” tab of the server manager to deny PORT commands on the reserved ports (Ports below 1025).
• Passwords are not longer stored in the user file. Passwords are now SHA-1 encrypted, and then only the password message digest is stored.
• Default programs are now invoked, instead of always Internet Explorer, for external links. Ex: mailto, Cerberus homepage web link, statistics file display.
• The interface limit of 5 has been removed. Cerberus can now listen on an unlimited number of interfaces.
• The list command has been changed to display the contents of directories passed as parameters
• Updated help file
• Numerous minor bug fixes and performance enhancements

Version 2.1 Release notes — 3/18/2003

• Added support for P@SW command to allow certain SMC Barricade routers to work with passive mode
• Added support for MDTM command
• Added additional support for FEAT command
• Improved support for running as a service
• Added option to display file times in local or UTC format
• Greatly reduced flicker on screen resizing
• Added “Getting Started” wizard to the GUI
• Improved support for IE, Netscape, and Opera FTP clients
• Improved communication performance between the GUI and the server
• Fixed bug which caused the PORT command to sometimes fail on NT4
• Better error checking to provide additional fault-tolerance
• Several minor bug fixes

Version 2.02 Release notes — 1/07/2003

• Official release
• Added PASV port range option to the ‘Advanced’ Server Configuration

Version 2.02 BETA Release notes — 12/22/2002

• Resolved a bug that allowed multiple versions of Cerberus to be started if Cerberus was running as a service, and a Terminal Services client started another version.
• Fixed a bug that could, on rare occasions, cause the server to continuously attempt to terminate a connection that had already been terminated
• Added an option to log server replys
• Rewrote underlying socket communications to improve performance
• Several minor bug fixes and performance improvements

Version 2.01 Release notes — 10/17/2002

• Enhanced error detection and recovery
• Corrected a bug which prevented networked drives from being displayed to clients
• Changed the appearance of the Status Pane
• Changed some of the toolbar icons to Hi-color icons
• Added several commands to the ‘right-click’ menu of the User Manager
• Added the option to ‘Clone’ (use as a base template) a user
• Checked, and corrected where necessary, all string and buffer manipulations routines to make sure they were “buffer-overflow proof”
• The uninstall program now removes Cerberus from the NT Service list

Version 2.0 Official Release notes — 10/07/2002

• Corrected a bug that could result in an uploaded file being corrupt when overwriting and existing file of the same name
• Added the ability to control how many times an account can be logged into simultaneously

Version 2.0 BETA 4 Release notes — 9/21/2002

• Corrected a bug which could prevent Cerberus from starting up on Windows 95 and 98
• Fixed a bug in the registry access routines which could cause Cerberus to crash

Version 2.0 BETA 3 Release notes — 9/20/2002

• Corrected the “The descriptor is not a socket” bug

Version 2.0 BETA 2 Release notes — 9/16/2002

• New User Manager
• Several GUI changes and improvements

Version 2.0 BETA 1 Release notes — 8/11/2002

• Completely new core. No more MFC!
• Can now be installed as a Native NT Service
• Data Connections established through the PORT command now correctly binds to local port 20 (RfC959). Should help with firewalls
• Corrected a bug that occasionally caused uploaded files to be closed before the last few kilobytes were written
• The User Manager has been revamped again. Automatically saves changes, instead of constantly asking for permission
• Ability to control whether or not to display hidden files and directories
• New toolbar icons
• Added a context menu to the connections page
• Ability to manually add interfaces
• Support for files greater than 4GB
• Too many security and bug fixes to list

Version 1.71 Release notes — 2/07/2002

• Only one copy of Cerberus can start at a time
• The User Manager has been made more user friendly
• Settings and user lists now save automatically when Windows is shutting down
• Rewrote the directory parsing routines for greater reliability

Version 1.7 Release notes — 12/16/2001

• Fixed the “Invalid Path” error that showed up when a file or directory with more than one period was used in a command
• Directories added to a user’s virtual root can now have different permissions
• The user manager has been redesigned to be more user friendly
• Fixed a bug that caused processor utilization to sometimes spike when a file was downloaded.
• Command progress indication. The user page will tell whether a command is in progress or complete. For file downloads, the percentage left to download will be displayed
• Fixed a bug that could cause the server to crash if a message greater than 4KB was specified in either the welcome, goodbye, or max connection edit boxes.
• Fixed a bug that could cause the server to crash if the server wasn’t restarted after a message was changed.
• Several other bug fixes

Version 1.6 Beta Release notes — 8/29/2001

• Fixed a major security bug that allowed unrestricted access to the server machine by using periods in the change directory path
• Modified the directory retrieval commands to more closely model Unix behavior. Should fix the problems encountered using the mget * command and several other security problems
• Complete rewrite of the underlying directory parsing functions.
• Lots of other minor fixes and improvements

Version 1.5 Release notes — 5/21/2001

• Added a new virtual root directory file structure
• Added support for the APPEnd command
• The server now remembers whether an interface is disabled or enabled
• Enhanced the fault tolerance for clients that send incorrect or unsupported commands by ensuring a reply code is always sent
• Added this help file.
• Corrected a bug in the IP Manager that caused all IP addresses placed inside to be blocked regardless of whether the deny or allow button was selected.
• CWD command now fails if anything other than a valid directory is passed
• Activated the “Allow Login” feature for particular interfaces
• Server now handles X-versions(experimental) of commands
• Maximum connection settings are now enforced
• Streamlined a lot of the underlying code

Version 1.22 Release notes — 5/08/2001

• Fixed a security problem that always uses c: as the root directory for anonymous logins.
• Replaced the imbedded directory control in User Manager with a more stable one.
• Rewrote the command parsing routines to provide greater fault tolerance for incorrectly formatted, or garbage strings on the control connection.

Version 1.2 Release notes — 5/03/2001

• Changed OS returned from SITE command. Should improve FTP auto-detect.
• Fixed a security hole that allowed people to execute certain commands without being logged in
• Removed the hard-coded paths. International versions of Windows should work now.
• Some stability improvements

Version 1.1 Release notes — 4/25/2001

• Fixed the CWD command to fail when the remote directory requested doesn’t exist
• Added support for the CDUP command
• Added additional log messages for file transfers
• Major code rewrites to improve overall performance
• New statistic generator
• Added additional error checking during remote path resolution
• Some GUI changes/improvements
• Fixed a major bug that caused PASV file uploads to fail
• Several other minor bug fixes
• Modified the directory structure sent with the LIST command to mirror UNIX exactly
• Increased compatibility with popular FTP clients
• Partial support for the ABORt command

Version 1.05 Release notes — 4/16/2001

• Added support for the SIZE and REST commands. The server can now restart failed file transfers from the point of failure
• Fixed a MAJOR security issue that caused upload/download permissions to not be checked for users.
• Added the creation of the ‘log’ directory so that the AutoLog option wouldn’t error when attempting to open the log file.
• Corrected the “incorrect user file version” bug that appears when you restart the server (note: delete the old user and block files).
• Corrected a bug in the STOU command that caused the wrong procedure to be called.
• Optimized the file transfer code and added improved error detection.
• Thanks to everyone who has submitted bug reports.

Version 1.03 Release notes — 4/14/2001

• Corrected a bug introduced in the last version that resulted in the wrong OS being detected (currently harmless, but annoying).

Version 1.02 Release notes — 4/13/2001

• Added an IP Manager to control connection attempts.
• Added an option to automatically record a log file while the server is running.
• More event tracking added to the log.
• Enhanced error detection and recovery.

Version 1.01 Release notes — 4/5/2001

• Added menu options to the taskbar icon.
• You can now hide or show the Cerberus manager window from the taskbar.
• Added an option to hide the server manager window at startup.
• Added my email address to the about dialog for tech support.
• Activated the ability to save a copy of the log screen to file.

Version 1.0 Release notes — 3/14/2001

• Initial Release