Page Comparison

This enhancement allows the transfer of files between users using a quick share link for a given file, which is protected with a password, expiration date, and number of downloads. The links and associated files can be shared with any type of user, including external users as long as the user is provided the password. Each file for which an ad-hoc file transfer link is generated is given a unique ID/token that is used in the associated URL.All used in the associated URL.

All ad-hoc file transfer links are generated and managed through the Web Transfer Client. The user must have local auth and admin??(read/write?). LDAP authentication will be incorporated in future releases.  A local server in UDMG must be created with the local auth protocol attached.

For new ad-hoc file transfer links, the following fields are generated and managed through the Web Transfer Client. The user must have local auth and admin??(read/write?). LDAP authentication will be incorporated in future releases.  A local server in UDMG must be created with the local auth protocol attached.

Best Practices: ?? share the link and password via different methods; store in different locations?

Web Transfer Client

pull in screenshot of page + fields +steps to create –

• Selected File / File Path
• Expiration Date
• Max Downloads
• File Size

For all generated ad-hoc file transfer links, the following actions are available.

required:

• Selected File / File Path
• Expiration Date
• Max Downloads

For all generated ad-hoc file transfer links, the following actions are available:

• Edit: Update/extend the Expiration date
• Revoke: Disable the live link and make it unusable 
• Copy Link to Clipboard: 

Web Transfer Client

1. Open the Web Transfer Client.
2. Select the Environment drop-down and select Adhoc Activity.

Image Added

3. View the list of current ad-hoc file transfers from the landing page. Image Added4. To create a new ad-hoc file transfer link – I have  no option to do this

5. To edit an ad-hoc file transfer link:

1. Select the ad-hoc file transfer record checkbox.
2. Use the Task bar icons to Extend, Revoke, and Copy Link to Clipboard.
   1. Image Added
   2. Note: If the Extend Ad-hoc Transfer field is left empty the link will not have an expiration date
   3. Note: A revoked ad-hoc file transfer link cannot be restored. A new link must be generated for the associated file and parameters. 

UDMG Admin UI

From UDMG Admin UI navigation pane, select Ad-Hoc Activity to view the list of ad-hoc file transfer links generated and associated details. The ad-hoc file transfer links cannot be edited via the UDMG Admin UI. The Ad-Hoc Activity Details include:

• File Name
• Status: Open, Expired, Revoked
• Comment
• Downloads
• Max Downloads
• File Size
• Path
• Urls

New endpoints added: 

• New endpoint:POST /link. The endpoint creates a file link for a given remote path. The remote path will be computed to a local path during the link creation, and that local path will be stored along the link. The expiration date and file password are optional.
  Body:

{
    "username":"user",
    "password":"userpassword",
    "remote_path":"path/to/filename.txt",
    "expiration_date":"2030-01-01T00:00:00Z",
    "file_password":"secret" 
}

Response:

{
    "file_link":"343bb79e-a476-459e-890f-32d34134612a" 
}

• New endpoint:GET /link/{token}?password=secret. The endpoint is used to download a given file link. 
  • Status codes:
    • 404: if the file link is not found
    • 400: if the file link is expired
    • 403: if the password is not correct
    • 404: if the file does not exist in the server
    • 500: if any internal error happens

This enhancement allows the deletion of a file after it is downloaded from SFTP using the MOVE command. The enhancement only applies to send or receive files. The change removes the need for additional configuration and monitoring in UAC and UDMG.

Before this change, the local file could only be deleted in the UDMG Server with the DELETE post-task. The remote file could not be deleted in UDMG and UAC was required for the transfers where remote delete was required. 

• New transfer info flagudmg_xfer_move, can have values true and false (bool). If set to true, the customer will delete the file being sent during the removepipeline step.
  • udmg_xfer_moveflag is checked for accepted values when the transfer is created.
  • udmg_xfer_moveflag is checked for protocol implementation when the pipeline is created. This is only supported for SFTP.
• New pipeline step: remove, between dataandpost tasks.
• Local file is removed after transfer for send rule (PUT).
• Remote file is removed after transfer for receive rule (GET).

Examples:

udmg-client transfer add -f "README.md" -p "TestSftpPartner" -l "user" -r "Rule1"  -w receive -i udmg_xfer_move:true

udmg-client transfer add -f "README.md" -p "TestSftpPartner" -l "user" -r "Rule1S" -w send -i udmg_xfer_move:true

Implemented Error Messages:

• TeInternal: move not supported for this protocol
• TeInternal: failed to remove local file: %s
• TeDataTransfer: Failed to remove remote SFTP file: %s

Improves security with a default NGINX configuration including the recommended security HTTP headers, hiding the server version, and disabling weak TLS ciphers.

Note: When installing UDMG 2.0 a new configuration file is generated with "new" added at end.

• B-19918: Hides NGINX Version
  • Changes improve defenses against specific security vulnerabilities by removing the NGINX server banner information (technical and detailed web server version information in HTTP response header) from displaying on every server response.
• B-19919: Improves Clickjacking Prevention

  • To improve malicious Clickjacking attacks, the following enhancements were implemented:

    • Prevents the browser from loading the page in frame using the X-Frame-Options or Content Security Policy (frame-ancestors) HTTP headers.

    • Prevents session cookies from being included when the page is loaded in a frame using the SameSite cookie attribute.

    • Implements JavaScript code in the page to attempt to prevent it from being loaded in a frame (known as a "frame-buster").

• B-19920: Security Headers
  • The following HTTP response headers were added to provide an additional layer of security to Universal Data Mover Gateway.
    • HTTP response headers: Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Strict-Transport-Security, Permissions-Policy, X-Permitted-Cross-Domain-Policies, X-Frame-Options. X-XSS-Protection

# DEPRECATED Security Headers
    add_header X-XSS-Protection "0";
    add_header X-Frame-Options "SAMEORIGIN";
    # Security Headers
    add_header Content-Security-Policy "frame-ancestors 'self'";
    add_header X-Content-Type-Options nosniff;
    add_header Referrer-Policy "strict-origin";
    add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload';
    add_header Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()";
    add_header X-Permitted-Cross-Domain-Policies none;

• B-19921: Disables Weak TLS Ciphers
  • Changes improve defenses against LUCKY13, a security vulnerability that specifically targets certain implementations of the TLS (Transport Layer Security) and DTLS (Datagram Transport Layer Security) protocols when they use the CBC mode with block ciphers for encryption, by disabling the CBC mode cipher encryption and enabling CTR or GCM cipher mode encryption. 
  • Recommended cipher list from https://ssl-config.mozilla.org
  • Minimum TLS version 1.2

• • they use the CBC mode with block ciphers for encryption, by disabling the CBC mode cipher encryption and enabling CTR or GCM cipher mode encryption. 
  • Recommended cipher list from https://ssl-config.mozilla.org
  • Minimum TLS version 1.2

This enhancement allows the user to quickly view the server status, including server state and information in the Local Servers list for all local servers. The "Status" column was added to the list of local server details.  Before this change, the local server status details were only displayed in the “UDMG Server Status” popup.

Image RemovedImage Added

The color-coded bars show the internal service status: