Difference between revisions of "Taskbar for Windows"

Revision as of 22:14, 20 November 2018

Overview

The Taskbar utility is a Microsoft Windows executable that either can be activated through the start/programs menu or resides in the users Taskbar and allows a user to generate a Single Channel image for authentication, or to request a dual channel security string to be sent or show the user which security string to use when multiple security strings are sent by SMS or email. It is particularly useful where the image cannot be embedded into the access device, such as SSH, FTP or IPSEC VPN clients. For Apple iOS see Taskbar for iOS.

Versions

• Version 1.6 is the latest version available. It has support for TLS 1.1 and 1.2, so should be used with Swivel appliance version 3 and later, although it will still work with version 2 appliances and non-appliance installations, subject to the correct Protocol versions being enabled.
  • Version 1.6.1 Restores the ability to import settings from a file on installation.
  • Version 1.6.2 Ensures that the image is always visible, if the screen the image was previously shown on has been detached. It also has an additional settings tab, showing configuration items that were previously only modifiable by editing the registry directly.
  • Version 1.6.3 fixes a few bugs in the new configuration items.
  • Version 1.6.4 works properly with security images other than TURing.
  • Version 1.6.5 is identical to 1.6.4, except that the icon has been changed, and all binary files have been digitally signed (update: version 1.6.5.2 has been signed with SHA256 and SHA1).
  • Version 1.6.6 fixes a bug where the image is not shown initially if started from the command line with the "show" option.

• Version 1.5 is the last version that supports PositiveID. However, it only supports SSL v3 and TLS 1.0, so should only be used with version 2 appliances, or software-only Swivel installations that do not require the latest TLS versions.

PositiveID Support

The Windows taskbar can also be used to fingerprint the device through which an authentication is being made, turning the laptop, desktop, server into a token which must be used for authentication, for further information see the PositiveID How to Guide.

NOTE: PositiveID is no longer supported by Swivel, and versions 1.6 onward of the taskbar client have no PositiveID functionality.

Installer

The Taskbar utility is deployed as an .msi and can be deployed by SMS.

Prerequisites

Swivel 3.x

Swivel Taskbar Client software:

Version 1.6 requires Windows PC with Microsoft.Net Framework 4.5 or later. Version 1.6 has so far been tested on Windows 10 and Windows 7, against both version 2 and version 3 appliances. Version 1.6.5 has been digitally signed and it is the name of the file. Despite that the latest version you'll download is version 1.6.6.1.

Version 1.6 32-bit version is a rebuild of the above for 32-bit operating systems.

Version 1.5 requires Windows PC with Microsoft.Net Framework version 3.5 or later. Version 1.5 of the client has been successfully tested with Windows XP, 7, 8 and 8.1. However, see Known Issues regarding version 8.x.

Architecture

The Taskbar Client requests the Swivel image from the Swivel server. The Swivel server must be accessible from the Client, this is usually configured through Network Address Translation. A proxy can also be used, the Swivel virtual or hardware appliance has a proxy port built in usually https://<IP Address>:8443/proxy

Swivel Server Configuration

Enabling Session creation with username

To allow the Single Channel image to be used with the Taskbar, session request by username needs to be enabled. Go to the ‘Single Channel’ Admin page and set ‘Allow Session creation with Username:’ to YES.

To test your configuration you can use the following URL using a valid username:

Virtual or hardware appliance

https://Swivel_server_IP:8443/proxy/SCImage?username=testuser

Software install

http://Swivel_server_IP:8080/pinsafe/SCImage?username=testuser

Taskbar Installation

Starting the Taskbar Setup Wizard

NOTE: version 1.6 has a new installer. The screen shots below show both 1.5 and 1.6.

On the client where the Taskbar is to be installed run setup.exe or PINsafeTaskbarSetup.msi. this will start the Taskbar Setup Wizard. Read the licence agreement (version 1.6 only) and tick the check box to accept it. Click Next to continue.

Version 1.6

Version 1.5

Select Installation Folder

On version 1.5 only, select the installation folder and who will use the installation, then click Next to continue. Version 1.6 does not currently offer the option to select the installation location - it will automatically install in [ProgramFiles]\Swivel Secure\Swivel Taskbar.

Confirm Setup Details and Install

Verify that installation of the taskbar should begin by clicking on Next.

When complete the Setup Wizard will verify it has completed, click Close to finish the Setup Wizard.

Version 1.6

Version 1.5

Installing the Taskbar Client with Preconfigured Settings

The installer will automatically import settings from a file named SwivelSettings.xml located in the same directory as the installer .msi file. This file should have been exported from the same version of the client, so if you are upgrading to a new version, it is recommended that you install on one machine, update and export the settings from there, and then use the exported settings for all future installations that use the same settings.

Taskbar Configuration

The Taskbar configuration can be selected by right clicking on the Taskbar and then server settings. The main page for versions 1.5 and 1.6 are slightly different.

Taskbar Main Settings

Version 1.6

Version 1.5

Username: The username to be used for authentication. Leave blank to use the username that the user is currently logged in with. Use ? to ask the username when an authentication request is made.

Connection type: How the connection is to be made to the Swivel server, options are Direct, IIS Filter, ISA Filter, Proxied. IIS and ISA options can be used when Swivel has an integration with these products.

Server: The Swivel server hostname or IP address, this is usually a NAT behind which the Swivel server resides

Port: The port used for connecting to the Swivel server, for the virtual or hardware appliance this is 8443

Path: The install name of the swivel instance, often pinsafe, for the virtual or hardware appliance this is proxy

Remove Domain from username: This option allows the domain name to be stripped from the request sent to the Swivel server

SSL enabled: To use SSL ensure a tick is in this box, for the virtual or hardware appliance this should be on by default

Permit self-signed certificates: Tick this box if self signed certificates are to be used, for the virtual or hardware appliance this is should be ticked by default

Use TLS (Version 1.5) The TLS option helps overcome issues relating to TLS. This only relates to TLS 1.0.

In version 1.6, instead of a simple checkbox for TLS, there is a pop-up dialog allowing you to select which protocols to use:

Taskbar Servers options

Version 1.6

Version 1.5

Servers: The order in which servers are contacted for authentication, this can be changed by using the Up and Down buttons, servers can also be Removed and Added

Add Server: Additional Swivel servers can be added here

Export: The Taskbar utility settings can be exported

Import: The Taskbar utility settings can be imported

Proxy Server: in version 1.6, this option was moved to the Advanced tab. See below for details.

Taskbar Program options explained

This allows a program to be run when a Swivel Taskbar action is requested. Options for running the program are;

• Do not run a program
• Run only if TURing not visible
• Run only if program not active
• Run every time

Program to Run: Path to the program

Working Directory: Directory or folder in which program resides

Arguments: Additional options that can be applied to the program when it is run

Taskbar Advanced options

This tab is only available in version 1.6

Proxy Server: Settings can be added for a local proxy server for the local Windows PC to access the internet, options are Automatic, None or Specify to enter the details.

Show Image Border: If this option is unchecked, the TURing image is shown with no border, and cannot be moved.

Scaling: The image can be increased or decreased in size, from 1/4 to 4 times original scale (25% to 400%).

Transport Selection

The Taskbar from version 1.4 can be used to generate Dual Channel SMS messages or the security String index telling the user which security string to use where multiple security strings are sent in an SMS or email message. To select these options right click on the Taskbar utility and select Get String Index to find which security string to use, or Request Security String to receive a new Security String by SMS or email, a Confirmed image will appear to acknowledge the request. For more information on the Security String Index see Multiple Security Strings How To Guide

Security String Index telling user which security string to use

Security String request confirmed image

Enabling PositiveID Authentication on the Taskbar

NOTE: This option is no longer available from version 1.6 onwards.

Right click on the Swivel Taskbar and click on the line Use PositiveID, ensure a tick appears next to the menu item. For further information on PositiveID see the PositiveID How to Guide

Uninstalling the Taskbar

Use the Windows Program Management tools to uninstall the software.

The following program will remove registry settings Taskbar Cleaner Program

The settings for the Taskbar application are stored in the registry under \\HKEY_CURRENT_USER\Software\Swivel Secure\SwivelTaskbar. The uninstall program removes the SwivelTaskbar key, and if no other entries are found, also the Swivel Secure key.

Since the entries are under HKEY_CURRENT_USER, if multiple users have run the application on the same machine, each one will need to run the application as themselves.

Known Issues

'No Image is generated and The underlying connection was closed: An unexpected error occurred on a send.

TLS protocol extension called Server Name Indication (SNI) is an optional TLS extension protocol and must be supported on both client and server for it to be operational. Windows Vista, Window 7 and 2008 server onwards support the protocol. It may be possible to add the server hostname to the list of recognised hosts on the front end firewall. This issue is resolved in version 1.4.2 onwards of the Taskbar.

Compatibility with Windows 8

Version 1.5 of the taskbar client is compatible with Windows 8. However, there is a known issue with multiple users on the same computer. Even if you install the application for all users, every new user needs to run the installation script the first time they use it, which requires administrator intervention. This issue is being investigated.

This does not appear to be a problem with version 1.6 on Windows 10. Version 1.6 uses a new installer, and seems to install for all users successfully.

Taskbar Problems

No Image is generated

Ensure settings are correct, particularly IP, port, SSL, and self signed certificates

Is a 'Single Channel Session' message generated on the Swivel server logs for the user

can the user generate a session in the users web browser using: https://<IP>:8443/proxy/SCImage?username=test for a virtual or hardware appliance or http://<IP>:8080/pinsafe/SCImage?username=test for a software install.

Also check here Turing Image absent

The server committed a protocol violation. Section=ResponseStatusLine

This error can be generated when Swivel is running https, but SSL is not enabled the Taskbar, ensure the SSL Settings is enabled with a tick