openvas-administrator 1.3.2 (2013-11-08)

This is the second maintenance release of the OpenVAS Administrator 1.3, the
local and remote administrative tool for the Open Vulnerability Assessment
System release 6 (OpenVAS-6).

This is a security release addressing a very serious security bug and it is highly
recommended to update any installation of OpenVAS Administrator 1.3 with this
release.

A software bug in OpenVAS Administrator allowed an attacker to bypass the OAP
authentication procedure. The attack vector was remotely available in case
OpenVAS Administrator was listening on a public network interface. In case of
successful attack, the attacker was able to create and modify users and could
use the gained privileges to take control over an OpenVAS installation if the
Scanner and/or Manager instances controlled by this Administrator instance were
also listening on public network interfaces.

Many thanks to everyone who has contributed to this release:
Matthew Mundell.

Main changes since 1.3.1:
* Security fix for handling the authentication state in OAP.


openvas-administrator 1.3.1 (2013-10-25)

This is the first maintenance release of the OpenVAS Administrator 1.3, the
local and remote administrative tool for the Open Vulnerability Assessment
System release 6 (OpenVAS-6).

The release fixes command line parameter names for convenience.

Many thanks to everyone who has contributed to this release:
Matthew Mundell, Michael Wiegand and Jan-Oliver Wagner.

Main changes since 1.3.0:
* Change short name for "--sync-script" back to "-s" to restore established
  behaviour.
* Change short name for "--scap-script" from "-s" to "-A".
* Minor cleanups and build improvements.


openvas-administrator 1.3.0 (2013-04-15)

This is the first release of the OpenVAS Administrator 1.3, the local and remote
administrative tool for the Open Vulnerability Assessment System release 6
(OpenVAS-6).

OpenVAS Administrator 1.3 introduces support for specifying a password policy
for user password and for synchronisation scripts for SCAP and CERT data.

Many thanks to everyone who has contributed to this release:
Hani Benhabiles, Werner Koch, Matthew Mundell, Timo Pollmeier, Jan-Oliver
Wagner and Michael Wiegand.

Main changes since 1.2.x:
* Increase GnuTLS dependency version from 2.2 to 2.8.
* Install pwpolicy.conf to ensure there is always one password policy.
* New feature: Opportunity to specify a password policy.
* Extended OAP to manage SCAP synchronisation script
  (commands DESCRIBE_SCAP and SYNC_SCAP).
* Added command line option "--scap-script".
* Extended OAP to manage CERT synchronisation script
  (commands DESCRIBE_CERT and SYNC_CERT).
* Added command line option "--cert-script".
* Some small fixes and code maintenance.
* Improved build system to allow out-of-source build.

And additionally changes compared to last release candidate 1.3+rc1:
* A linker warning has been addressed.
* GnuTLS compatibility in been improved.


openvas-administrator 1.3+rc1 (2013-03-18)

This is the first release candidate version of the OpenVAS Administrator release
1.3, the local and remote administrative tool for the Open Vulnerability
Assessment System release 6 (OpenVAS-6).

The release increases the GnuTLS dependency version and removes the test
framework for the time being.

Many thanks to everyone who has contributed to this release:
Matthew Mundell, Jan-Oliver Wagner.

Main changes since 1.3+beta1:
* Increase GnuTLS dependency version from 2.2 to 2.8.
* Remove the test framework.
* Install pwpolicy.conf to ensure there is always one password policy.


openvas-administrator 1.3+beta1 (2013-02-22)

This is the first beta version of the OpenVAS Administrator release 1.3,
the local and remote administrative tool for the Open Vulnerability
Assessment System release 6 (OpenVAS-6).

The release adds support for specifying a password policy and improves
support for additional synchronization scripts.

Many thanks to everyone who has contributed to this release:
Hani Benhabiles, Werner Koch, Timo Pollmeier, Matthew Mundell, Jan-Oliver
Wagner and Michael Wiegand.

Main changes since 1.2.1:
* New feature: Opportunity to specify a password policy.
* Extended OAP to manage SCAP synchronisation script
  (commands DESCRIBE_SCAP and SYNC_SCAP).
* Added command line option "--scap-script".
* Extended OAP to manage CERT synchronisation script
  (commands DESCRIBE_CERT and SYNC_CERT).
* Added command line option "--cert-script".
* Some small fixes and code maintenance.
* Improved build system to allow out-of-source build.


openvas-administrator 1.2.1 (2012-08-02)

This is the first maintenance release of the OpenVAS Administrator 1.2, the
local and remote administrative tool for the Open Vulnerability Assessment
System release 5 (OpenVAS-5).

The release fixes build issues for newer systems and fixes a segfault bug.

Many thanks to everyone who has contributed to this release:
Michael Wiegand.

Main changes since 1.2.0:
* Improve build system to work with newer glib and gcc versions.
* Prevent segfault when sync script does not end properly.


openvas-administrator 1.2.0 (2012-03-26)

This is the first release of the OpenVAS Administrator 1.2, the local and remote
administrative tool for the Open Vulnerability Assessment System release 5
(OpenVAS-5).

The release features adds simple per-user ldap authentication and
the "Observer" role.

Many thanks to everyone who has contributed to this release:
Stephan Kleine, Matthew Mundell, Jan-Oliver Wagner and Michael Wiegand.
Felix Wolfsteller.

Main changes since 1.1.x:
* New: Support of per-user LDAP authentication 
* New: Role "Observer".
* Changed: Handling of the SIGHUP signal has been made consistent with the
  other OpenVAS modules. This means that openvas-administrator will no
  longer exit upon receiving a SIGHUP.
* Changed: OAP: The GET_VERSION command is now allowed before AUTHENTICATE to be
  consistent with OMP.
* OAP protocol version now 1.1

And additionally changes compared to last release candidate 1.2+rc1:

* Some bug fixes for the per-user ldap authentication.
* Clean up CMake infrastructure and ensure that compilation with modern
  gccs works.


openvas-administrator 1.2+rc1 (2012-03-15)

This is the first release candidate of the openvas-administrator 1.2 module for the Open
Vulnerability Assessment System (OpenVAS). It will be part of the upcoming
"OpenVAS-5".

This release adds handling of per-user LDAP authentication and updates
OAP version to 1.1.

Many thanks to everyone who has contributed to this release:
Felix Wolfsteller.

Main changes since 1.2+beta1:
* Added support of per-user LDAP authentication 
* OAP protocol version now 1.1


openvas-administrator 1.2+beta1 (2011-10-12)

This is the first beta release of the openvas-administrator 1.2 module for the Open
Vulnerability Assessment System (OpenVAS). It will be part of the upcoming
"OpenVAS 5".

It features support for task observer and makes signal handling and the protocol
handshake more consistent with other OpenVAS modules.

Many thanks to everyone who has contributed to this release:
Stephan Kleine, Matthew Mundell and Michael Wiegand.

Main changes since 1.1.1:
* Handling of the SIGHUP signal has been made consistent with the other OpenVAS
  modules. This means that openvas-administrator will no longer exit upon
  receiving a SIGHUP.
* OAP: The GET_VERSION command is now allowed before AUTHENTICATE to be
  consistent with OMP.
* Support for task observers has been added.


openvas-administrator 1.1.1 (2011-02-21)

This is the second release of the OpenVAS Administrator 1.1, the local and remote
administrative tool for the Open Vulnerability Assessment System release 4
(OpenVAS-4).

The release features improvements to build environment and logging
infrastructure. It also ensures stricter validation of the name of new users and
changes the parameter for the user name to --username/-u to be consistent with
other OpenVAS modules; the old --name/-n parameter will continue to work until
the next major release.

Many thanks to everyone who has contributed to this release:
Matthew Mundell and Michael Wiegand.

Main changes since 1.1.0:
* The build environment has been consolidated.
* The logging behaviour when started with --verbose has been improved.
* The parameter name for the user name has been changed to --username/-u.
* User name validation has been added.


openvas-administrator 1.1.0 (2011-02-04)

This is the first release of the OpenVAS Administrator 1.1, the local and remote
administrative tool for the Open Vulnerability Assessment System release 4
(OpenVAS-4).

The release features several improvements to the build process, improved
documentation and better handling of password authentication.

Many thanks to everyone who has contributed to this release:
Stephan Kleine, Matthew Mundell, Jan-Oliver Wagner and Michael Wiegand.

Main changes since 1.0.x:
* The default log level has been reduced to avoid logging sensitive information
  during normal operation.
* If the password for the new user has not been provided as a command line
  parameter, it will be requested interactively.
* OpenVAS Administrator now uses pkg-config to find required libraries.
* OpenVAS Administrator now provides a manual page for the openvasad binary.
* The installation is now compliant with Filesystem Hierarchy Standard (FHS 2.3).


openvas-administrator 1.0.1 (2011-01-17)

This is the first maintenance release for the 1.0 series of the Administrator
module for the Open Vulnerability Assessment System (OpenVAS).

It improves LDAP-based authentication and add self-documentation
feature for the OpenVAS Administration Protocol (OAP) 1.0.

Many thanks to everyone who has contributed to this release:
Matthew Mundell, Michael Wiegand, Jan-Oliver Wagner and Felix Wolfsteller.

Main changes since 1.0.0:
* Fixed behaviour for ldap-based authentication for Admin role.
* Added protocol documentation for OAP (html and rnc format,
  can be build with "make doc").
* Code hardening at compile time is now the default.
* Harmonized output of "--version" with other modules.


openvas-administrator 1.0.0 (2010-12-07)

This release is the 1.0.0 release of the OpenVAS Administrator. It is the
local and remote administrative tool for the Open Vulnerability
Assessment System (OpenVAS).

The mission of OpenVAS Administrator is to provide a unified
access for various administrative tasks such as creating and
configuring scan user accounts.
The Administrator can be used in two ways: As a command line
tool for direct changes on the respective system and as a
remote service. The remote service offers the OpenVAS
Administration Protocol (OAP) which is supported for example
by the web client Greenbone Security Assistant (GSA).
Release 1.0 is compatible with both, OpenVAS 3.1 and OpenVAS 4.

Main changes since 1.0+rc1:
* Handling of invalid commands in console mode has been made more consistent.


openvas-administrator 1.0+rc1 (2010-11-23)

This release is the first release candidate of the upcoming 1.0 release of the
OpenVAS Administrator. It is the central local and remote administrative service.
The remote service offer the OpenVAS Administation Protocol (OAP).
Release 1.1 is part of OpenVAS 4, the next generation of the
Open Vulnerability Assessment System.

Many thanks to everyone who has contributed to this release:
Matthew Mundell, Jan-Oliver Wagner and Michael Wiegand.

Main changes since 0.9.0:
* The build environment has been improved to be more consistent across different
  OpenVAS modules and to stay compatible with different openvas-libraries
  versions.
* Support for logging user creation, deletion and role changes has been added.


openvas-administrator 0.9.0 (2010-04-12)

This is the 13th development release of the openvas-administrator module for
the Open Vulnerability Assessment System (OpenVAS).

Many thanks to everyone who has contributed to this release:
Hartmut Goebel, Stephan Kleine, Matthew Mundell, Michael Wiegand and Felix
Wolfsteller.

Main changes since 0.8.0:
* A large amount of code which was duplicated from openvas-manager has been to
  openvas-libraries.
* The build environment has been further improved.
* Support for providing the authentication configuration via OAP has been added.
* Support for modifying user has been improved, a number of issues and
  inconsistencies has been addressed.
* New command line parameters for determining the feed version and the
  synchronization status and for starting a feed synchronization have been
  added.


openvas-administrator 0.8.0 (2010-04-12)

This is the 12th development release of the openvas-administrator module for
the Open Vulnerability Assessment System (OpenVAS).

Many thanks to everyone who has contributed to this release:
Stephan Kleine, Matthew Mundell and Michael Wiegand.

Main changes since 0.7.0:

* Communication with synchronization scripts launched by openvas-administrator
  has been improved; this should prevent synchronization processes from becoming
  defunct when they are finished.
* A number of build issues discovered by Stephan Kleine has been fixed.
* Support for retrieving the version of an installed NVT collect has been added.


openvas-administrator 0.7.0 (2010-02-05)

This is the 11th development release of the openvas-administrator module for
the Open Vulnerability Assessment System (OpenVAS).

Many thanks to everyone who has contributed to this release:
Christian Kuersteiner and Matthew Mundell.

Main changes since 0.6.0:

* When synchronizing with an NVT feed, the administrator now simply starts the
  synchronization script in the background instead of waiting for it to finish
  before continuing.


openvas-administrator 0.6.0 (2010-01-26)

This is the 10th development release of the openvas-administrator module for
the Open Vulnerability Assessment System (OpenVAS).

Many thanks to everyone who has contributed to this release:
Matthew Mundell.

Main changes since 0.5.0:

* When creating a user, now scan hosts to be denied or
  allowed for this user can be specified.
* A user editor has been added and allows to change
  the host restrictions and the password
  (OAP command MODIFY_USER)
* OAP command CLIENT_GET_USERS now also provides the
  host restriction information.
* The log protocol filters entries where potentially
  a password may appear, so that passwords do not end
  up in a log file.
* uuid's are generated for each user.
* New package build dependency to uuid library.


openvas-administrator 0.5.0 (2010-01-19)

This is the ninth development release of the openvas-administrator module for
the Open Vulnerability Assessment System (OpenVAS).

Many thanks to everyone who has contributed to this release:
Matthew Mundell, Michael Wiegand and Felix Wolfsteller.

Main changes since 0.4.0:

* Make it possible to sort the list of users.
* Setting retrieval has been improved.
* Feed synchronization has been improved.
* Added support for modifying settings.


openvas-administrator 0.4.0 (2009-12-21)

This is the eigth development release of the openvas-administrator module for
the Open Vulnerability Assessment System (OpenVAS).

Many thanks to everyone who has contributed to this release:
Matthew Mundell, Jan-Oliver Wagner, Michael Wiegand and Felix Wolfsteller.

Main changes since 0.3.0:

* A bug which cause defunct administrator processes to remain after feed
  synchronization has been fixed.
* Initial support for retrieving settings von configuration files has been
  added.


openvas-administrator 0.3.0 (2009-12-08)

This is the seventh development release of the openvas-administrator module for
the Open Vulnerability Assessment System (OpenVAS).

Many thanks to everyone who has contributed to this release:
Matthew Mundell, Michael Wiegand and Felix Wolfsteller.

Main changes since 0.2.2:

* Pidfile handling has been made more robust.
* A number of possible resource leaks have been identified and fixed.
* The configuration and build process has been improved.
* Support for NVT feed synchronization has been added.


openvas-administrator 0.2.2 (2009-10-26)

This is the sixth developement release of the openvas-administrator module for
the Open Vulnerability Assessment System (OpenVAS).

Many thanks to everyone who has contributed to this release:
Matthew Mundell, Michael Wiegand and Jan-Oliver Wagner.

Main changes since 0.2.1:

* Users can no longer delete themselves.
* Pidfile management has been factored out.


openvas-administrator 0.2.1 (2009-10-19)

This is the fifth developement release of the openvas-administrator module for
the Open Vulnerability Assessment System (OpenVAS).

Many thanks to everyone who has contributed to this release:
Michael Wiegand and Jan-Oliver Wagner.

Main changes since 0.2.0:

* Command line options have been updated to resolve conflicting short options.


openvas-administrator 0.2.0 (2009-09-29)

This is the fourth developement release of the openvas-administrator module for
the Open Vulnerability Assessment System (OpenVAS).

Many thanks to everyone who has contributed to this release:
Mattew Mundell, Felix Wolfsteller and Jan-Oliver Wagner.

Main changes since 0.1.3:

* Turned into a daemon, offering a initial version of
  the OAP (OpenVAS Administration Protcol)


openvas-administrator 0.1.3 (2009-09-16)

This is the third maintenance release of the openvas-administrator module for
the Open Vulnerability Assessment System (OpenVAS). This module was formerly
known as openvas-config-manager.

This release brings a number of small improvements to the command line interface.

openvas-config-manager 0.1.2 (2009-07-14)

This is the second maintenance release of the openvas-config-manager module for
the Open Vulnerability Assessment System (OpenVAS).

It adds improved Debian packaging support and now ensure that the user
directory is created if it does not exist already when creating new users.

openvas-config-manager 0.1.1 (2009-06-18)

This is the first maintenance release of the openvas-config-manager module for the
Open Vulnerability Assessment System (OpenVAS).

It fixes issues discovered after the 0.1.0 release, adds a source code
documentation infrastructure and packaging files for Debian.

openvas-config-manager 0.1.0 (2009-05-06)

This is the first public release of the openvas-config-manager module for the
Open Vulnerability Assessment System (OpenVAS).

The OpenVAS Configuration Manager is intended simplify local and remote
administration of an OpenVAS server. This initial release contains functionality
for user management (adding and removing users, setting user rules). For
example, a new user can be added using the following command:

# openvascd -c add_user -n username -p password

More informationg about the command line arguments can be obtained using:

# openvascd --help


Please note that this module is still in an early development stage and not
intended for production use.
