Containerized Deployments

Harmony now supports containerized deployments. You can run Harmony services in Docker containers and orchestrate them with Kubernetes while storing configuration data in a centralized external repository, including Amazon S3, Azure Blob Storage, SMB shares, and Google Cloud Storage. Runtime data is stored in a shared SMB repository. (Enterprise license required.)

Security Hardening Improvements

Harmony 6.0 includes platform-wide security hardening updates that strengthen the platform's security posture and support alignment with current security best practices.

Google Cloud Logging Support

Harmony now integrates with Google Cloud Logging. The new GCP Logging connector sends transfer and event data to Google Cloud Logging, enabling organizations to monitor Harmony activity alongside other infrastructure and application logs within their Google Cloud environment.

When upgrading to Cleo Harmony version 6.0, Cleo recommends the following:

• Back up your configuration using the Export functionality. In the Web UI, go to Administration > System > Export. In the native UI, go to File > Export. Performing an Export will save your data in a format that you can import using the Cleo Harmony Import functionality should the need arise.
• Make sure your system meets the system requirements for Cleo Harmony version 6.0, as it requires greater resources than earlier versions. All new installs must be 64-bit. Visit Cleo Harmony 6.0 System Requirements to view the System Requirements for your product.
• Because this release of Cleo Harmony uses OpenJDK, if you are using the Web UI on a Unix system, you might need to install the latest fontconfig. The command is dependent on the flavor of Unix you are using. For example: 
  • Red Hat: yum install fontconfig
  • Ubuntu: apt-get install -y --no-install-recommends libfontconfig
• Run the Cleo Harmony 6.0 installer to perform an in-place upgrade. Your data and configuration remain intact from the previous version of the Cleo Harmony software.

Further Considerations for Upgrade

• XML configuration files are not backward compatible after upgrading to 6.0. The installer will automatically back up your configuration as part of the upgrade, but Cleo also recommends performing a manual Export beforehand.
• Document DB (transfer/event log) data is not backward compatible after upgrading to 6.0, due to an underlying Elasticsearch version upgrade. Existing document DB log history is re-indexed at first startup after the upgrade.  If you want to retain this history for possible future downgrade, make a copy of the VersaLex core/data/cleo.elasticsearch folder before upgrading.
• The Web Service host and the Local Listener SOAP web service are no longer supported in 6.0. Any hosts or configurations using these will stop functioning after upgrade and must be migrated to a supported alternative before upgrading.
• VLProxy 4.0 is backward compatible with VersaLex versions prior to 6.0, but earlier versions of VLProxy are not compatible with VersaLex 6.0. VLProxy must be upgraded to 4.0 before upgrading Harmony.
• Beginning with Harmony 6.0, Solaris (SunOS) is no longer supported, and no supported JDK is provided for Solaris. Customers currently running on Solaris must migrate to a supported operating system before upgrading to 6.0 or later.
• During an upgrade of a clustered Harmony deployment, nodes that have not yet been upgraded to 6.0 might report errors such as ClusterBlockException[blocked by: [SERVICE_UNAVAILABLE/2/no master];], followed by repeated MasterNotDiscoveredException[null], until either the node is upgraded or the connection times out. This is expected behavior caused by the underlying Elasticsearch version upgrade and resolves once all nodes are upgraded.
• Removed support for SSH Tools key formats. OpenSSH key formats are now the only supported format; any keys still in SSH Tools format must be converted to OpenSSH format before upgrading.

 

Security - Framework

• This update contains security-related improvements. For customer protection, Cleo does not disclose all security update details. For further information, please contact customer support. For critical security updates or if there is a known exploit, Cleo will publish a security bulletin and notify customers.
• Removed support for SSH Tools key formats. OpenSSH key formats have become the de facto standard.

Security - Portal

• This update contains security-related improvements. For customer protection, Cleo does not disclose all security update details. For further information, please contact customer support. For critical security updates or if there is a known exploit, Cleo will publish a security bulletin and notify customers.

Major Enhancements - Framework

• Added capability for Harmony to run as a container within a Kubernetes cluster. Please refer to https://github.com/cleo/harmony-containerization for more information. This capability requires a new enterprise license for Harmony.

Major Enhancements - GCPLogging

• Added GCPLogging Connector, allowing log events to be sent to Google Cloud Logging. Refer to the Info tab within the Templates > Generic > Generic GCPLogging host for more details.

Enhancements - Framework

• Added support for licensing VersaLex beyond year 2030.
• Optimized the transfer log database purge SQL statement to reduce CPU usage. Also added a new system setting, "cleo.transferlogdb.purge.skip.dbpayload.tables.check.if.not.enabled". When set to true, this setting excludes database payload tables from the purge SQL statement if the database payload feature was previously enabled but has subsequently been disabled. The system setting can be added to the conf/system.properties file on each VersaLex installation. Use this system property with caution as it can potentially remove payload in the database tables that has not yet been sent or received. 
• Added support for client-owned proxy identifiers in the Proxies REST API. Legacy URL-based default proxy references are automatically migrated to ID-based references.
• Added support for scheduling Autosend actions when LCOPY -DEL is configured under either 1) ExecuteOnSuccessfulSend for PUT actions or 2) ExecuteOnSuccessfulCopy for LCOPY actions. 
• Added the option to ignore referrals when doing LDAP lookups using Active Directory. 
• Modified the behavior of Connector host export to include the System Scheme Name, if specified. When importing the Connector host, if the System Scheme Name is already being used, the imported host will have the name removed. 
• Expanded support for the [Always] marker in the Local Listener Web Browser Service Advanced Response Headers. Append [Always] to the end of any response header to be included in all web server responses, not just web UI responses. For example, "Content-Security-Policy: script-src 'self' [Always]" would result in this header (less the [Always] marker) being returned in an /api response.
• Added a new option under Systems >> Other named "Zero Byte File Threshold (bytes)". This setting defines the file size threshold used when the "Delete Zero Length Files" option is enabled. Files smaller than the specified threshold will be considered zero-length and will be removed. 
• VersaLex now supports parsing an EDI document whose element separator is a 16-bit Unicode character (for example, a superscript character). This is pertinent to EDI content detection and tracking, and the router feature and connector. 
• Added support for selecting PGP keys on the "Encryption Cert" selection screen within the Packaging tab for Connectors.
• Enhanced all api/settings API endpoints with a new includeProtected query parameter. When set to true, the response will include protected configuration settings that are normally excluded. This parameter requires the user to be in the administrator group and is disabled by default.
• Improved performance of connectors when they contain encrypted properties.

Enhancements - GCPBucket

• Improved directory listing performance for the GCPBucket connector.
• Improved transfer performance by updating GCPBucket connector libraries.

Enhancements - IBMMQ

• Added the ability to configure Identity Context values in the IBMMQ connector.
• Added an option to the IBM MQ connector to remove RFH2 headers from messages sent to an IBM MQ server.

Enhancements - OFTP

• Added 'Uppercase Outbound DSN' Advanced Property. If set, OFTP will use an uppercase Dataset Name (DSN) identifier for outbound transfers. By default, VersaLex sends the DSN using the same case as the filename.

Enhancements - Portal

• Improved performance when listing files in Portal when there are a large number of LDAP users configured.

Enhancements - S3

• Added support for Oracle Cloud Storage buckets in the S3 connector through the Alternate Region property. For more information, see the connector Info tab.

Enhancements - SFTPConnector

• Added the capability for multiple proxy configurations to the SFTP connector.

Enhancements - SMBConnector

• Added support for encryption when using the SMBv3 protocol with the SMB connector.

Enhancements - SSH FTP

• Added support for the following SFTP key exchange algorithms on both the server and client: diffie-hellman-group14-sha256, diffie-hellman-group16-sha512, and diffie-hellman-group18-sha512.
• Added new Local Listener Advanced property, SSH FTP Public Key Pattern, that can be used to limit which public key algorithms are offered by the SFTP server. For example, setting the property to [^(?!ssh-rsa$).*] will result in only the rsa-sha2-256 and rsa-sha2-512 algorithms being offered by the server for a configured RSA server key. Note: VLProxy 4.0 is required if using VLProxy.
• Added support for the SSH aes128-gcm@openssh.com and aes256-gcm@openssh.com cipher algorithms.
• SFTP client now discovers which signature algorithms are supported by the server and uses the rsa-sha2-256 key authentication algorithm instead of sha-rsa when supported.

Enhancements - HSP

• Added a new HSP Advanced property, Allow Weak Signing Key, which, when enabled, allows a key less than 2048 bits to be used for HSP signatures.

Bug Fixes - Framework

• Fixed an issue introduced in 5.8.1.11 where a fatal NullPointerException would occur when reading the configured proxies at startup if the Unique File Algorithm system option was set to Random.
• For Harmony containers, fixed issues where host updates would not be synchronized successfully across the other Harmony nodes.
• Fixed an issue where outbound HTTPS connections with Check certificate server name enabled could fail on VersaLex servers without internet access due to a local DNS lookup error. Connections configured to use a forward proxy now work as expected.
• Fixed an issue in the FIPS edition where synchronization connections between VersaLexes would fail if client authentication was enabled in the Local Listener HTTP/s server.
• Fixed an issue where DocumentDB log tracking would result in a memory leak.
• Fixed an issue with containers where both initializing and forcing synchronization were erroneously allowed via the UI and REST API. These actions are no longer available when running as a container as they are inapplicable.
• Extended the fix for user home directories configured with UNC paths containing underscores in the hostname (e.g., \\server_name\share) to all remaining areas.
• Fixed an issue in PGP key export where changing the preferred cipher algorithm (e.g., from TripleDES to AES-256) would result in the exported public key retaining a duplicate self-signature with the old cipher preference.
• Fixed an issue in the Portal and Admin Web UI where a password could be changed without the re-entered password matching the new one.
• Fixed an issue with api/settings/proxies where SOCKS proxy default proxy assignments for FTP, FTPS, HTTP, and HTTPS were not stored correctly.
• Fixed an issue in PGP key export where subkeys were missing their required binding signature when the signature flag was enabled.
• Fixed an issue introduced in 5.8.1.3 where users could not log into VLPortal.
• Fixed an issue introduced in 5.8.1.3 where writing to the database transfer log might be slow if using SQLServer.
• Fixed an issue where, when VersaLex was started with systemd and "Log errors in Syslog file" was enabled, errors and warnings were not logged to the Unix syslog. Note: This requires specific settings in the systemd unit files for VersaLex.
• Fixed transfer logging issues introduced in 5.8.1.4 when using a Postgres database where 1) the filesize value was not being formatted correctly when logging a CHECK command and 2) the start/end native timestamp values only included the date and not the time.
• In the FIPS edition, fixed an issue where encrypted SAML responses would fail to be parsed correctly.
• Fixed an issue where some VersaLex Web UI pages would not function correctly when certain Content-Security-Policy response headers were configured.
• Fixed an issue where the signing algorithm for SAML requests was not being honored.
• Fixed an issue introduced in 5.8.1.3 where very fast transfer times were formatted in scientific notation when constructing SQL statements for transfer logging, resulting in invalid SQL. Transfer times are now always formatted as plain decimal numbers to ensure compatibility with the database.
• Fixed an issue where high CPU usage could occur when an inbound SFTP connection failed before the user logged in and 'FTP Session Timeout' was configured.
• Fixed an issue introduced in 5.8.1.3 where the DocumentDB would not start correctly if the system did not have access to the internet.
• In the FIPS edition, fixed a NullPointerException being thrown at startup.
• Fixed an issue where rapid REST API requests to delete and then re-add a host, mailbox, or action using the same alias could cause synchronized nodes to fail to reflect the re-added resource.
• Fixed an issue where the RelayState would be added twice to the SAML request if a redirect path was specified, causing the SAML request to fail.
• Resolved an issue where SFTP/FTP session timeouts could block new connections if a long file transfer was in progress when the session timed out.
• Fixed an issue with excluding host folders from EDI tracking. Transfers originating from actions within the host folder would be properly excluded, but not unsolicited transfers coming to a host/mailbox within the host folder.
• Fixed an issue where database drivers using SSL would not work correctly with FIPS mode enabled.
• Fixed an issue with the /files API where the content-length header was missing for files larger than 10 KB.
• Fixed an issue where a Local Listener secure port configured with an Ed25519 certificate/private key would cause all incoming SSL/TLS client requests to fail. Also Ed25519 requires that the Local Listener SSL Minimum Protocol Version advanced property be set to at least TLS 1.2.

Bug Fixes - AS2

• Fixed an issue where attempts to send an AS2 async MDN to a server that responds with a redirect would cause the sending thread to be hung.
• Fixed an issue where some SSL clients, while closing the connection, would send a "user canceled" which would cause VersaLex to consider the transfer as a failure.

Bug Fixes - AzureBlob

• Fixed an AzureBlob connector issue that would throw an exception when used with FIPS mode enabled.
• Fixed an AzureBlob connector issue introduced in 5.8.1.3 that caused the RENAME command to fail.

Bug Fixes - GCPBucket

• Added support for the GCPBucket connector to locate files within subdirectories.
• Fixed an issue in the GCPBucket connector where parentheses in file paths were incorrectly converted to their escaped Unicode equivalents. File paths with parentheses are now preserved correctly.

Bug Fixes - HTTP

• Fixed an issue that caused HTTP file transfers larger than 2GB to fail with an exception.
• Fixed an issue where non-ASCII characters in filenames were not being handled properly in the HTTP /server upload and download page.

Bug Fixes - IBMMQ

• Fixed an issue in the IBM MQ connector where simultaneous actions could cause connection leaks to the IBM MQ server.
• Fixed an issue where updating the SSLKeyStore or SSLTrustStore for the IBM MQ connector via the REST API would fail.
• Fixed an issue where concurrent IBMMQ connector actions could interfere with each other causing connection failures.

Bug Fixes - Portal

• Fixed an issue where signing for a SAML response would fail if the signing certificate used contains line breaks in its encoded form. The signing process now ignores line breaks in the certificate encoding.
• Fixed an issue where the relay state in a SAML response would be forced to lowercase causing routing issues.
• Fixed an issue where users who logged into Portal through SSO and then navigated to WebAdmin would be redirected to the WebAdmin login page instead of the Portal login page upon logging off.
• Fixed an issue where /Portal/mixedModeLogin was accessible even when 'Allow non-SAML login for Cleo Portal Users' was disabled.

Bug Fixes - RNIF

• Fixed an issue where a disabled RNIF host/mailbox was not rejecting incoming requests.

Bug Fixes - S3

• Fixed an issue with the S3 connector where an exception when uploading the last part of a file would be logged but the transfer would still be considered successful.

Bug Fixes - SSH FTP

• Fixed an SFTP client issue in the FIPS edition where the curve25519-sha256@libssh.org key exchange algorithm would fail if the server public key signature algorithm was either ECDSA or Ed25519.
• Fixed an issue where PGP decryption failures on incoming SSHFTP transfers would result in a memory leak.
• Fixed an issue where SSH FTP user home directories configured with UNC paths containing underscores in the hostname would fail validation, causing an error to be returned. Modified hostname validation to allow underscores in UNC path hostnames.
• In FIPS mode, fixed an issue when exporting an OpenSSH public or private key. Export would throw an error and fail for user certificates with ECDSA and Ed25519 private keys.
• Fixed an SFTP issue where repeated "The message id 3x is not the same as the message implementation id 3x" exceptions would begin to occur and then continue until the product was restarted.

Bug Fixes - SharePoint

• Fixed an issue where LCOPY commands would fail for filenames with wildcard characters in SharePoint connector URIs.
• Fixed an issue with the SharePoint connector where file transfers would fail when the source file was provided via a URI action. Files are now buffered to a local temp file first so that the correct file size can be determined before uploading to SharePoint.

Bug Fixes - VLNav

• Fixed an issue where users authenticated through SAML were not found in the VLNav connector.

Bug Fixes - ebMS

• Fixed an issue introduced in 5.8.1.9 where inbound ebXML payloads could fail when a multipart message did not include a trailing CRLF after the closing MIME boundary, resulting in a "Header not found; premature EOF" error.
• Fixed an issue where an inbound ebXML message was rejected with a "Content-Id not referenced in eb:Manifest" error when the trading partner declared the xlink namespace prefix on the SOAP Body instead of the SOAP Envelope.
• Fixed an issue where generating an ebXML error/fault response could fail with a "Namespace for prefix 'eb' has not been declared" error.