Trojan warning on Shibboleth Windows installation

[Cantor, Scott]

On 1/31/12 5:52 PM, "Jason Lee" <asktheitguy at gmail.com> wrote:

>When we are installing the latest Shibboleth SP (2.4.3) on our Windows
>Server 2008, we revived a warning message from local NOD32 Antivirus
>saying it contains a variant of Win32/Agent.DNQAVIY Trojan. We ignored it
>and proceed to completion, but was hit by another warning message from
>NOD32 saying \shibboleth-sp\bin\debug\txfmout.exe is probably a variant
>of Win32/Agent.DNQAVIY Trojan blah blah, so we had to uninstall it; then
>we tried version 2.4.2 on which NOD doesn't give us any warning this
>time. However we have other severs in the same cluster running SP 2.4.3
>(we installed them a month ago and no Antivirus warning what-so-ever).

Well, I don't know what to tell you, but I can't reproduce that (I've
tried on several occasions at different times). I have no evidence that
it's anything but a false positive. We plan to take steps in future
releases to clean room the builds, but I don't think it's going to stop
this.

>So, would it be OK to have machines in same cluster (behind load balance
>but no sticky sessions) running slight different version of Shibboleth
>SPs? Also does any other Shibboleth&NOD32 users suffer the same Trojan
>warning problem?

Check the security advisories and then strongly reconsider running 2.4.2.
If you can't trust the software, don't run it or build it yourself. But
don't run a hackable version instead.

To answer the question, non-sticky sessions implies a shared shibd. That
is not supported and will not work reliably if you mix versions. I make no
comment about any specific mix of versions. It may or may not work, and I
won't do any investigating to determine whether it will. Non-shared
deployments with mixed versions are not supported, but are mostly likely
to work.

-- Scott