Sentinel ldk and sentinel hasp run time environment installer gui for windows
Центр загрузки Sentinel
Утилита для записи лицензий в ключи HASP 4 HASPEdit: HASPEDIT.zip
Драйвер для Windows. Версия 4.116 (интерфейс: консоль): HASP4_driver_cmdline.zip
Драйвер для Windows. Версия 8.15 (интерфейс: GUI): Sentinel_LDK_Run-time_setup
Драйвер для Mас OS. Версия 1.91 (интерфейс: GUI): MacOSX.dmg
Драйвер Sentinel HASP для Linux. Версия 8.15: Sentinel_LDK_Run-time_Installer.tar.gz
Менеджер лицензий для Windows. Версия 8.32: HASP_LM_setup.zip
Менеджер лицензий для Linux. Версия 8.3: hasplm_linux_8.30.tgz
Менеджер лицензий для Mac OS. LM_Setup_Mac.dmg
Утилита Aladdin Monitor. Версия 1.4.2: Monitor_Setup.zip
Утилита DiagnostiX. Версия 1.10: Aladdin_Diagnostix.zip
Драйвер ключа Hardlock под платформы Win32/Win64: cpcpci.zip
Драйверы для ключей Hardlock internal PCI и Hardlock Server internal PCI: pcicard.zip
Драйверы для ключей Hardlock PCMCIA: pcmcia.zip
Утилита для установки HL-Server: hlsw32_inst.zip
Утилита для установки комплекса программ Hardlock Bistro. Версия 2.5: bistro32_inst.zip
Утилита DiagnostiX. Версия 1.10: Aladdin_Diagnostix.zip
Драйвер Sentinel HASP для Windows. Версия 8.15 (интерфейс: GUI): Sentinel_LDK_Run-time_setup.zip
Драйвер Sentinel HASP для Windows. Версия 8.15 (интерфейс: консоль): Sentinel_LDK_Run-time_cmd_line.zip
Драйвер для MAC OS. Версия 8.15 (интерфейс: GUI): Sentinel_LDK_RTE_Installer.dmg
Менеджер лицензий для Windows. Версия 8.32: HASP_LM_setup.zip
Менеджер лицензий для Linux. Версия 8.3: hasplm_linux_8.30.tgz
Менеджер лицензий для Mac OS. Версия 8.3: LM_Setup_Mac.dmg
Утилита Aladdin Monitor. Версия 1.4.2: Monitor_Setup.zip
Утилита DiagnostiX. Версия 1.10: Aladdin_Diagnostix.zip
Комплект разработчика Sentinel LDK 8.0 (04.06.2020): Sentinel-LDK_SDK.zip
Обновление: LDK 8.0.4 (устанавливается поверх LDK 8.0)
Внимание, комплект разработчика Sentinel HASP 5.12 является устаревшем. Рекомендуем вам использовать его только для перехода на Sentinel LDK c более старых версий.
Драйвер Sentinel HASP для Windows. Версия 8.15 (интерфейс: GUI): Sentinel_LDK_Run-time_setup.zip
Драйвер Sentinel HASP для Windows. Версия 8.15 (интерфейс: консоль): Sentinel_LDK_Run-time_cmd_line.zip
Драйвер Sentinel HASP для Linux. Версия 8.15: Sentinel_LDK_Run-time_linux.zip
Драйвер Sentinel HASP для Mac OS X. Версия 8.15: Sentinel_LDK_RTE_Installer.dmg
Определение причин блокировки Sentinel SL из-за смены оборудования : C2V Decoder
Обновление USB-ключей HASP HL до функциональности HASP SRM с помощью файла V2C: HASP_HL_Firmware_Update_v2c.zip
Обновление USB-ключей HASP HL до функциональности HASP SRM с помощью утилиты Firmware Update: HASP_HL_Firmware_Update.zip
Руководство к Sentinel LDK на русском языке: скачать
«Быстрый старт» к Sentinel LDK на русском языке: скачать
Обзор возможностей Sentinel EMS Web Service API на русском языке: скачать
Подробное видео-руководство по работе с Sentinel LDK на русском языке: смотреть
Драйвер для ключей Sentinel SuperPro, Sentinel UltraPro и SHK для Microsoft Windows. Версия 7.5.7: Sentinel System Driver Installer 7.5.7.zip
Драйвер для ключей Sentinel SuperPro, Sentinel UltraPro и SHK для Linux. Версия 7.5.6: sntl-sud-v7.5.6.tar
Драйвер для ключей Sentinel SuperPro, Sentinel UltraPro и SHK для MacOS. Версия 1.3.1: SKPI131.zip
Утилита диагностики для проверки системы и создания файла отчета (Sentinel Advanced Medic) для Microsoft Windows: SAM131.exe
Утилита для удаления Sentinel System Driver: SSDCleanup_1.2.0.5.zip
Sentinel ® LDK and Sentinel HASP ® Run-time Environment Installer GUI for Windows: Readme
Version 7.103
December 2019
This document provides information regarding the Run-time Environment Installer GUI for Sentinel LDK and Sentinel HASP, including supported operating systems, enhancements, known compatibility issue, and issues resolved. («Sentinel LDK» is the next generation of Sentinel HASP.)
The following topics are discussed:
Operating Systems Supported
>Windows 7 SP1
>Windows 8.1 SP1
>Windows Server 2008 R2 SP1
>Windows Server 2012 R2
>Windows Server 2016
>Windows Server 2019
>Windows 10 IoT Enterprise 2019 LTSC
>Windows 10 Version 1903
NOTE Windows 10 Insider Preview builds are not supported.
The operating system versions listed in this section were tested by Gemalto and verified to be fully compatible with Sentinel LDK. For reasons of compatibility and security, Gemalto recommends that you always keep your operating system up to date with the latest fixes and service packs.
The installer detects the version of the operating system at run-time, before installing the relevant drivers.
Virtual Environments Supported
For a list of the virtual environments supported, see «Supported Platforms for End Users» in the Sentinel LDK Release Notes.
Upgrading the Run-time Environment
When using the Installer GUI to upgrade the Run-time Environment, ensure that:
>No other Run-time Environment Installer is active.
>No other Run-time Environment components are active. Although the installation program terminates applications that are accessing the Run-time, it does not terminate running services. For example, if the Sentinel License Manager is running as a service, you must stop the service before upgrading the Run-time Environment.
Installing the Run-time Environment
>The Installer GUI detects the version of the operating system during Run-time Environment installation, before installing the relevant drivers.
>By default, Windows displays a User Account Control message during driver installation. The user must click Continue to continue the installation. Alternatively, the user can change the default setting from the Control Panel of their operating system.
>A log file of the installation process is written to aksdrvsetup.log in the Windows directory.
For additional information, see the topic “Upgrading Sentinel LDK Run-Time Environment (RTE) Installer” in the Sentinel EMS Configuration Guide.
Allowing Incoming Connections From Public Networks Using Port 1947
The Run-time Environment Installer adds a firewall rule named “Sentinel License Manager” that allowed incoming connections from private networks using port 1947.
You can manually allow access from public networks using this port, but Gemalto highly recommends against this.
If you do plan to allow incoming connections from public networks using port 1947, create a rule with a different name in order to prevent future RTE upgrades from removing this access.
Issues Related to Device Guard and Code Integrity Policies
The traditional method until now to protect against malicious application under Windows has been to trust the applications unless they were blocked by an antivirus or other security solution. Device Guard, available in Windows 10 Enterprise, implements a mode of operation in which the operating system trusts only applications that are authorized by your enterprise. You designate these trusted applications by creating code integrity policies.
You can maintain a whitelist of software that is allowed to run (a configurable code integrity policy), rather than trying to stay ahead of attackers by maintaining a constantly-updated list of «signatures» of software that should be blocked. This approach uses the trust-nothing model well known in mobile device operating systems.
Only code that is verified by Code Integrity, usually through the digital signature that you have identified as being from a trusted signer, is allowed to run. This allows full control over allowed code in both kernel and user mode.
Code integrity contains two primary components:
>kernel mode code integrity (KMCI)
>user mode code integrity (UMCI)
This section describes issues that arise and the workarounds when machines at the end user site are enabled with Device Guard, and the code integrity policy set to “enforce” mode.
NOTE The procedures described in this document should be performed by an IT professional who is familiar with Device Guard and code integrity policies.
Issue 1: Windows blocks the installation of the Run-time Environment
During installation of the Run-time Environment on your computer, Windows displays a message similar to this: «Your organization used Device Guard to block this app. Contact your support person for more info.»
Solution:
To install the Run-time Environment on a machine where Device Guard is enabled in enforce mode (which make use of PcaCertificate level code signing check), ensure that DigiCert is listed/added in the Signers list of the policy file.
Import the DigiCert Intermediate certificate to the trusted list of Intermediate Certification Authorities(ICA) store on the golden computer before creating code integrity policy.
A Digicert Intermediate certificate is available from https://aboutssl.org/digicert-trusted-root-authority-certificates/#intermediates. Under Intermediate Certificates, locate and download the DigiCert EV Code Signing CA (SHA2) certificate. You can also fetch this intermediate certificate from your trusted source.
To add the DigiCert Root Certificate
1.Download the certificate on the golden computer and double-click the certificate file. The Certificate dialog box is displayed.
2.Click Install Certificate. Follow the Certificate Install Wizard to complete the import of this certificate to the ICA store.
3.Run the steps to create a new or updated policy. This will allow Sentinel software to be installed without any issues on a machine where Device Guard is enabled.
Repeat the installation of the Run-time Environment.
Issue 2: Protected application does not operate at the customer site
(LDK-17267) ) When you distribute applications that are protected with SL keys, the customized vendor library (haspvlib_vendorID.*) that are required for these applications are not signed. As a result, Device Guard does not allow the software to operate at the customer site.
Workaround A:
This workaround must be performed at the customer site.
Do the following to add an exception for the customized vendor library file in the code integrity policy:
1.Use Windows PowerShell in elevated mode to create a policy for the exception.
2.Use the Group Policy editor to deploy the policy file.
To create the policy for the exception
1.Open PowerShell in elevated mode.
2.Run the command to create a policy (referred to below as P1) in audit mode.
3.Deploy this policy.
4.Operate the protected application as you would normally.
5.Create another policy (referred to as P2) that captures audit information from the events log.
NOTE Before proceeding with the next step, review policy P2 carefully. This policy contains information about all the binaries that were used in your system while you operated the protected application. Any unwanted application that was executed during this time is logged in the policy. If not removed, any such application will be treated as a trusted binary.
6.Merge policies P1 and P2.
7.Disable audit mode.
8.Deploy the merged policy.
To deploy the policy file
1.Open the Group Policy editor by running GPEdit.msc.
2.Navigate to: Computer Configuration\Administrative Templates\System\Device Guard
3.Select Deploy Code Integrity Policy. Enable this setting by using the path to the relevant policy file created above.
Workaround B (not recommended):
This workaround must be performed at the customer site.
Before deploying the code integrity policy, disable UMCI (user mode code integrity) mode.
To accomplish this, run the following command in Windows PowerShell in elevated mode:
Issue 3: Vendor Tools fail to load
(SM-907) Sentinel LDK Vendor Tools fail to load. An error message is displayed, stating that a DLL, LIB, COM, or EXE file is not designed to run on Windows or that the DLL contains an error.
Workaround A:
Do the following to add a policy for the Sentinel LDK Vendor Tools in the code integrity policy file:
1.Use Windows PowerShell in elevated mode to create a policy for the Vendor Tools.
2.Use the Group Policy editor to deploy the policy file.
To create the policy for the Vendor Tools
1.Open PowerShell in elevated mode.
2.Run the command to create a policy (referred to below as P1) in audit mode.
3.Deploy this policy.
4.Execute all of the Vendor Tools that you will require at your site and perform all of the functions in these tools that you will require. If you miss any required Vendor Tools or Vendor Tool functions, the required entries will not be added in the new code integrity policy, and these tools or functions will generate an error message when they are eventually used.
5.Create another policy (referred to as P2) that captures audit information from the events log.
NOTE Before proceeding with the next step, review policy P2 carefully. This policy contains information about all the binaries that were used in your system while you operated the Vendor Tools. Any unwanted application that was executed during this time is logged in the policy. If not removed, any such application will be treated as a trusted binary.
6.Merge policies P1 and P2.
7.Disable audit mode.
8.Deploy the merged policy.
To deploy the policy file
1.Open the Group Policy editor by running GPEdit.msc.
2.Navigate to: Computer Configuration\Administrative Templates\System\Device Guard
3.Select Deploy Code Integrity Policy. Enable this setting by using the path to the relevant policy file created above.
Workaround B (not recommended):
Perform this workaround at your development site.
Before deploying the code integrity policy, disable UMCI (user mode code integrity) mode.
To accomplish this, run the following command in Windows PowerShell in elevated mode:
No further actions are required.
Issue 4: Digital signature removed from the RTE Installer
(SM-18780) When a user creates a Run-time Environment Installer using Sentinel EMS, the digital signature is removed from the Installer. As a result, Device Guard blocks the RTE Installer from executing.
If the vendor downloads the installer as an EXE file and signs it, Device Guard allows the installer to run, but the installation fails due to an unsigned DLL file called by haspdinst.exe.
Workaround:
Perform the procedure that follows.
1.Download the Run-time Environment Installer from the following URL in the Gemalto web site:
2.Use the downloaded Installer to install the Run-time Environment.
3.Place a copy of the Vendor library (haspvlib_vendorID.*) in: %CommonProgramFiles(x86)%\Aladdin Shared\HASP\
(On a 32-bit machine, place the Vendor library in: %CommonProgramFiles%\Aladdin Shared\HASP\)
To work with Sentinel EMS, continue with the following additional steps:
4.In a Web browser, enter the following to start Admin Control Center: http://localhost:1947. the Configuring Network Settings page, in the EMS URL field, enter the URL to access the Sentinel EMS Service.
6.Click Submit.
7.Proceed to work with Sentinel EMS as required.
As an alternative, you can use one of the workarounds provided above for issues 2 and 3.
Enhancements and Issues Resolved in This Release
Enhancements in Version 7.103
Admin API now supports the use of HTTPS for communication with a remote Admin License Manager.
A local or remote user can now use the «Sentinel Keys Available» page of Admin Control Center (instead of the RUS utility) to generate a fingerprint.
Note: For Linux or Mac (where Admin Control Center is available), only SL AdminMode fingerprints can be generated.
Issues Resolved in Version 7.103
Certain important security issues were resolved. For more information, see the reference to article KB0020564 in the Gemalto Security Updates page: https://sentinel.gemalto.com/technical-support/security-updates-sm/
Gemalto acknowledges and thanks Vladimir Dashchenko from Kaspersky Lab ICS CERT for responsible disclosure of these vulnerabilities.
Revision History
This section describes enhancements implemented and issues resolved in the last three major releases of Sentinel Run-time Environment.
The revision history for earlier versions of Sentinel Run-time Environment is available at: http://sentinelldk.gemalto.com/Default.htm
Issues Resolved in Version 7.102
Certain important security issues were resolved. For more information, see the reference to article KB0020199 in the Gemalto Security Updates page: https://sentinel.gemalto.com/technical-support/security-updates-sm/
Gemalto acknowledges and thanks Artem Zinenko from Kaspersky Lab ICS CERT for responsible disclosure of these vulnerabilities.
Enhancements in Version 7.101
The Run-time Environment now supports controlling the generation of the License Manager ID files. This is done using the Enable Detaching of Licenses configuration check box in Admin Control Center. When selected, the License Manager generates ID files. When cleared, the License Manager stops generating any new ID files. However, the existing ID files are retained.
By default, the Enable Detaching of Licenses check box is cleared.
Issues Resolved in Version 7.101
Certain important security issues were resolved. For more information, see the reference to article KB0020074 in the Gemalto Security Updates page: https://sentinel.gemalto.com/technical-support/security-updates-sm/
Gemalto acknowledges and thanks the Blizzard Red Team for responsible disclosure of these vulnerabilities.
Enhancements in Version 7.100
| Reference | Description |
|---|---|
| SM-47546 | The Run-time Environment now supports the ability of the Licensing API to check remaining idle time before a protection key login session is terminated. Checking the remaining idle time does not reset the session. |
| SM-50812 | The Run-time Environment now supports improved protection against the misuse of computer restoration software (such as Deep Freeze). |
| SM-7269 SM-54601 | The Run-time Environment now supports protecting applications that run in a Docker container. The scheme VMType4 is supported for clone protection. |
Issues Resolved in Version 7.100
| Reference | Description |
|---|---|
| SM-49346 | Under certain circumstances, the License Manager would generate a false-positive report of a virtual machine because some components of the Deep Freeze product were present on the machine. |
| SM-56397 | |
| SM-57376 | In certain situations, an SL license would disappear after system reboot. |
| SM-56723 | When a machine was restored from sleep mode, a USB sharing violation error would occur if a HASP HL key was plugged into a USB HUB with an independent power supply. |
Issues Resolved in Version 7.92
Certain important security issues were resolved. For more information, see the reference to article KB0018794 in the Gemalto Security Updates page: https://sentinel.gemalto.com/technical-support/security-updates-sm/
Gemalto acknowledges and thanks Artem Zinenko from Kaspersky Lab ICS CERT for responsible disclosure of these vulnerabilities.
As part of the resolution for these issues, Admin Control Center no longer supports importing external language packs (either online or offline). Translated user interface files are included in the RTE installer. The end user now selects the desired language for the interface by clicking the name of the language instead of clicking a country flag image.
Issues Resolved in Version 7.91
| Reference | Description | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| SM-43605 | Sentinel LDK drivers have been repackaged so that significant Windows 10 operating system upgrades will not impact existing SL AdminMode licenses. | |||||||||
| SM-47103 |
| Reference | Description |
|---|---|
| SM-17431 | The License Manager now supports the use of custom clone protection schemes. |
| SM-34308 | |
| SM-27901 | The revision history of all enhancements implemented and issues resolved for earlier versions of the RTE is now available online at: http://sentinelldk.safenet-inc.com/Default.htm |
| SM-30222 SM-30886 | |
| SM-31010 | If the client connected using different IPv6 interfaces, the License Manager would sometimes count the sessions on a machine multiple times. |
Issues Resolved in Version 7.80
If a customer applies a V2C update from a remote machine that has the Vendor library but no license from the same vendor, the error returned was HASP_UPDATE_TOO_NEW, which was confusing. Now the error returned is HASP_KEYID_NOT_FOUND.
The RTE installer adds a firewall rule (named “Sentinel License Manager”) that, in the past, allowed incoming connections from any network, including public networks, using port 1947. Starting with RTE version 7.80, the firewall rule added by the RTE Installer does not allow incoming connections from public networks. If you are upgrading from an earlier version of RTE, the installer replaces the existing rule (that allows connections from public networks) with a rule that blocks such connections.
You can manually allow access using this port from public networks, but Gemalto highly recommends against this.
If you do plan to allow access from public networks using port 1947, create a rule with a different name in order to prevent future RTE upgrades from removing this access.
Issues Resolved in Version 7.65
| Reference | Description |
|---|---|
| SM-21408 | The Admin Control Center help system was missing information regarding the new “Idle Timeout of Session” configuration parameter. |
| SM-23320 | A possible security issue related to License Manager failure due to stack overflow on deep XML data (reported by Kaspersky) has been resolved. |
| SM-23402 | |
| SM-23813 | A possible security issue that was reported by Kaspersky has been resolved. |
Enhancements in Version 7.63
| Reference | Description |
|---|---|
| SM-13443 | When a Sentinel HL (HASP configuration) key or HASP HL key is attached to a Windows machine, the Run-time Environment is no longer installed automatically by Windows Update. It is now the software vendor’s responsibility to ensure that the Run-time Environment is installed when required. |
| SM-13505 | |
| SM-19483 | Admin Control Center now recognizes the new V2CP format to update protection keys. This supports planned enhancements in Sentinel LDK v.7.8. |
Issues Resolved in Version 7.63
| Reference | Description |
|---|---|
| SM-15922 | Admin Control Center no longer requires the Generate Report) displays information on «Recent Clients» and «Recent Users». Each entry contained a time stamp but not a date stamp. The report has been corrected to display both a time stamp and a date stamp for each entry. |
When building a Run-Time Environment installer using Wix, an error message similar to the following was generated:
Invalid product version ‘7.53.1.66350’ in package HASP_Setup.msi’. When included in a bundle, all product version fields in an MSI package must be less than 65536.
This error no longer occurs.
Under certain circumstances, Sentinel LDK License Manager Service would crash. The exception code would map to STATUS_STACK_OVERFLOW in __chkstk API.
Known Issues
Workaround: Refresh Admin Control Center.
After Windows 7 is upgraded to Windows 8, the user is not able to use existing SL licenses or to install new SL licenses.
Workaround: After you upgrade from Windows 7 to Windows 8, reinstall the Run-time Environment.
When installing the RTE on a machine where Fabula Tech USB over Network is installed, installation of the RTE hangs.
Workaround: Disconnect the HL key before running the RTE installer.
Sentinel LDK Vendor Tools fail to load under Windows 10 when Device Guard is enabled and the Code Integrity policy is set to «enforce». An error message is displayed regarding a certain DLL, stating that the DLL is not designed to run on Windows or that the DLL contains an error. For more information, see Issues Related to Device Guard and Code Integrity Policies.
Given the following circumstances at a customer site:
1.One machine has Run-time Environment version 7.51.
2.A second machine has a version of Run-time Environment that is earlier than 7.51.
3.The customer performs rehost of a license repeatedly between the two machines.
4.An update is applied to the license on either of these machines.
A rehost operation sometimes fails with the message HASP_REHOST_ALREADY_APPLIED.
Workaround: Obtain a new SL license from the software vendor for the protected application on the target machine. Before attempting any additional rehost procedure, install the latest Run-time Environment on both machines.
The License Manager fails to load vlibs under Windows 10 when Device Guard is enabled and the Code Integrity policy is set to “enforce”. For more information, see Issues Related to Device Guard and Code Integrity Policies.
With some new USB chipsets, it is possible that the API hasp_update() call, used to update the firmware of Sentinel HL keys to version 3.25, will generate the HASP_BROKEN_SESSION return code, even if the firmware is correctly updated. (This issue does not occur with Sentinel HL Driverless keys with firmware version 4.x.)
Workaround: Install the latest Run-time Environment. The automatic firmware update feature of the License Manager will automatically update the firmware of the key the first time that the key is connected, without the need to call hasp_update().
Sentinel Licensing API: On a computer with the Nvidia chip set GeForce 7025/nForce 630a, and where the CPU is AMD Athlon 64 X2, the hasp_read and hasp_encrypt functions may fail with error 39, HASP_BROKEN_SESSION. This problem only exists with HASP HL keys with Firmware version 3.25.
Workaround 1: On the computer described above, when error 39 is returned, call the hasp_read or hasp_encrypt function again. It is not necessary to call hasp_login again.
Workaround 2: Use Sentinel HL keys with Firmware version 4.2x.
Sentinel LDK communicates via TCP and UDP on port 1947. This port is IANA-registered exclusively for this purpose. At the end user site, the firewall must be configured so that communication via this port is not blocked.
© Gemalto 2019. All rights reserved. Gemalto, the Gemalto logo, are trademarks and service marks of Gemalto and are registered in certain countries.