Sophos connect client 2.1.20.0309 - login fails with password beginning with # hashtag

Hello LHerzog,

This issue is being investigated under NCL-1256 and it fails only when the first character is #. 

Fixed on Sophos Connect 2.2

Let me ask internally if there’s some combination of passwords known to not work but as far as I know it was only # and spaces on the password.

Regards,

Thanks for reporting the NC ID. Isn't this publicy available?

just found this recent KB from Sophos. Created last week:

Sophos: A Guide to Strong Passwords

https://support.sophos.com/support/s/article/KB-000037106?language=en_US&c__displayLanguage=en_US

some highlights linked to Connect Client:

Always check the application to see the minimum and maximum characters that are required, what special characters are allowed and how many numbers or digits must be used. Most programs will outline the password requirements below the password creation window or in the online help. -> no documentation and no help exist

Good passwords: are a phrase and not a single word. For example: Oh my, 1 stubbed my toe!
-> what was it about the space issue?

Hello LHerzog,

This isn’t part of the KIL.

The issue with the use of spaces is fixed on 2.2,in the meant time you could use symbols instead#of.spaces!

Regards,

Have you received an answer about known character combinations causing issues?

I ask because we're having an other live User issue caused by Connect Client beeing unable to handle secure passwords:

if the AD user password contains #? in the password like Abc#?123 it fails to authenticate the user against the firewall.

Hello LHerzog,

I haven't heard back but thank you for the reminder. I will add your comment about the AD user password as well.

Regards,

 emmosophos what's about the unsupported password character list? I can understand that Sophos doesn't want to admit such a blamage. But then please tell us that it's confidential.

In the meantime it just came up today, that \ backslash is unsupported by Connect Client SSL VPN. This hit one of our CEO and I he is not happy with it to be polite.

Hello LHerzog,

Thank for the reminder, I forgot to follow up, I thought I posted about this but the backslash is investigated under NCL-1372 and only affects SSL.

So the ones confirmed are \, #, spaces, and a specific combination of #%, which I wasn’t able to reproduce on the passwords I used for testing.

Regards,

thanks. do you think that we have all now?

#% - I did not mention that - it is #?

@emmonsophos

you know, when will we get the new version of sophos connect ?
... the support case was closed with reference to the new upcoming version and we have now been waiting for 4 months

@emmonsophos

you know, when will we get the new version of sophos connect ?
... the support case was closed with reference to the new upcoming version and we have now been waiting for 4 months

Hello Dirk,

ETA was 2nd week of this month, but it didn't go through.

I asked for a new ETA but I haven't received any reply.

Regards,

This is ridiculous!!! This password issue is known for at least 10 months, see this closed topic: https://community.sophos.com/sophos-xg-firewall/f/discussions/129828/sophos-connect-client-2-1-20-0309---password-with-spaces-in-it-fails-login

So where is the Sophos Connect client 2.2?

Check your firewall. It was releases yesterday. Announcement / Release Notes will be published shortly. 

That was a kind of "just-in-time" solution for me - tested and works.