Showing posts with label security. Show all posts
Showing posts with label security. Show all posts

Tuesday, June 11, 2019

Java SSL server and client

https://www.baeldung.com/java-ssl-handshake-failures

this article is inspiring but it contains several errors/omissions.

The actually working code with detailed keytool commands is here https://github.com/vernetto/ssltests



Ultimate resource to learn SSL handshake is https://tls.ulfheim.net/

Posted by vernetto at 10:14 PM 0 comments
Labels: , ,

Monday, April 1, 2019

WebLogic Security documentation

https://docs.oracle.com/middleware/12213/wls/INTRO/security.htm#INTRO232



https://docs.oracle.com/cd/E19798-01/821-1841/girbe/index.html JACC "Java Authorization Contract for Containers"

https://docs.oracle.com/javase/8/docs/api/java/security/Permission.html java.security.Permission

https://docs.oracle.com/javase/8/docs/api/java/lang/SecurityManager.html java.lang.SecurityManager





Java Authentication Service Provider Interface for Containers (JASPIC)




Training Material:

https://www.udemy.com/how-to-secure-oracle-weblogic-12c/


https://www.udemy.com/oracle-weblogic-12c-for-administrators/

Old book https://www.amazon.com/Securing-Weblogic-Server-Luca-Masini/dp/1849687781





Posted by vernetto at 4:34 AM 0 comments
Labels: , , ,

Thursday, November 15, 2018

Nexus Repository Security explained

https://help.sonatype.com/learning/repository-manager-3/security-essentials

RBAC (roles, privileges)

https://help.sonatype.com/learning/repository-manager-3/security-model---users%2C-roles%2C-and-privileges



Posted by vernetto at 4:18 PM 0 comments
Labels: ,

Saturday, May 12, 2018

JBoss and LdapDomain

check this https://developer.jboss.org/thread/274715?_sscc=t


in standalone.xml you should have:

<security-domain name="LdapDomain" cache-type="default">
 <authentication>
  <login-module code="LdapExtended" flag="required">
   <module-option name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory"/>
   <module-option name="java.naming.provider.url" value="ldap://localhost:10389"/>
   <module-option name="java.naming.security.authentication" value="simple"/>
   <module-option name="bindDN" value="uid=admin,ou=system"/>
   <module-option name="bindCredential" value="secret"/>
   <module-option name="baseCtxDN" value="ou=People,dc=example,dc=com"/>
   <module-option name="baseFilter" value="(uid={0})"/>
   <module-option name="rolesCtxDN" value="ou=Roles,dc=example,dc=com"/>
   <module-option name="roleFilter" value="(member={1})"/>
   <module-option name="roleAttributeID" value="cn"/>
   <module-option name="searchScope" value="ONELEVEL_SCOPE"/>
   <module-option name="allowEmptyPasswords" value="true"/>
  </login-module>
 </authentication>
</security-domain>



How to secure your web.xml: http://www.javamonamour.org/2012/06/tomcat-web-application-security-in-20.html


<security-constraint>
 <web-resource-collection>
  <web-resource-name>HtmlAuth</web-resource-name>
  <description>application security constraints
  </description>
  <url-pattern>/*</url-pattern>
  <http-method>GET</http-method>
  <http-method>POST</http-method>
  <http-method>PUT</http-method>
  <http-method>DELETE</http-method>
 </web-resource-collection>
 <auth-constraint>
  <role-name>Manager</role-name>
 </auth-constraint>
</security-constraint>
<login-config>
 <auth-method>BASIC</auth-method>
 <realm-name>Sample Realm</realm-name>
</login-config>
<security-role>
 <role-name>Manager</role-name>
</security-role>

jboss-web.xml :


<jboss-web>
<security-domain>java:/jaas/LdapDomain</security-domain>
</jboss-web>


In order to use FORM login, instead of BASIC:

<login-config>
    <auth-method>FORM</auth-method>
    <realm-name>OsbReports Application</realm-name>
    <form-login-config>
      <form-login-page>/login.jsp</form-login-page>
      <form-error-page>/error.jsp</form-error-page>
    </form-login-config>
  </login-config>

with login.jsp :

<form method="POST" action="j_security_check">
<input type="text" name="j_username">
<input type="password" name="j_password">
</form>


See also




https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.1/html/how_to_configure_identity_management/legacy_security_subsystem#configure_a_security_domain_to_use_ldap

https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.0/html-single/login_module_reference/index#ldapextended_login_module




All JBoss login modules: https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.1/html-single/login_module_reference/

JBOSS LDAP Examples https://developer.jboss.org/wiki/LDAPSecurityRealmExamples , shows how to use username-filter and advanced-filter to query onsAMAccountName and memberOf )





Posted by vernetto at 8:24 PM 0 comments
Labels: , ,

Friday, April 27, 2018

Wildfly FORM based authentication with DB realm

https://dzone.com/articles/jdbc-realm-and-form-based-0

https://github.com/myfear/SimpleJDBCRealmWildFly


CREATE TABLE Users(username VARCHAR(255) PRIMARY KEY, passwd VARCHAR(255));

CREATE TABLE UserRoles(username VARCHAR(255), role VARCHAR(32));

the jar file is in:
D:\apps\wildfly12\modules\system\layers\base\org\picketbox\main\picketbox-5.0.2.Final.jar


java -classpath modules/system/layers/base/org/picketbox/main/picketbox-5.0.2.Final.jar org.jboss.security.Base64Encoder admin SHA-256
[jGl25bVBBBW96Qi9Te4V37Fnqchz/Eu4qB9vKrRIqRg=]

INSERT INTO users (username, passwd) VALUES ('myfear', 'jGl25bVBBBW96Qi9Te4V37Fnqchz/Eu4qB9vKrRIqRg=');
INSERT INTO userroles (username, role) VALUES ('myfear', 'ADMIN');

<security-domain name="secureDomain" cache-type="default">
                    <authentication>
                        <login-module code="Database" flag="required">
                            <module-option name="dsJndiName" value="java:jboss/datasources/UserDS"/>
                            <module-option name="principalsQuery" value="select passwd from Users where username=?"/>
                            <module-option name="rolesQuery" value="select role, 'Roles' from UserRoles where username=?"/>
                            <module-option name="hashAlgorithm" value="SHA-256"/>
                            <module-option name="hashEncoding" value="base64"/>
                        </login-module>
                    </authentication>
                </security-domain>



To debug security, make sure you enable logging:

    <profile>
        <subsystem xmlns="urn:jboss:domain:logging:4.0">
            <console-handler name="CONSOLE">
                <level name="ALL"/>
                <formatter>
                    <named-formatter name="COLOR-PATTERN"/>
                </formatter>
            </console-handler>
   
   
   
           <logger category="org.jboss.security" use-parent-handlers="false">
                <level name="TRACE"/>
                <handlers>
                    <handler name="CONSOLE"/>
                </handlers>
            </logger>


you get this:


08:37:33,815 TRACE [org.jboss.security] (MSC service thread 1-7) PBOX00227: removeAppConfig(jboss-web-policy)
08:37:33,815 TRACE [org.jboss.security] (MSC service thread 1-6) PBOX00227: removeAppConfig(jaspitest)
08:37:33,815 TRACE [org.jboss.security] (MSC service thread 1-8) PBOX00337: nextState for action getPolicyConfiguration: open
08:37:33,818 TRACE [org.jboss.security] (MSC service thread 1-8) PBOX00315: delete, contextID: simpeljdbcrealm-1.0-SNAPSHOT.war
08:37:33,818 TRACE [org.jboss.security] (MSC service thread 1-8) PBOX00337: nextState for action delete: deleted
08:37:33,819 TRACE [org.jboss.security] (MSC service thread 1-1) PBOX00337: nextState for action getPolicyConfiguration: open
08:37:33,822 TRACE [org.jboss.security] (MSC service thread 1-1) PBOX00315: delete, contextID: simpeljdbcrealm-1.0-SNAPSHOT.war
08:37:33,823 TRACE [org.jboss.security] (MSC service thread 1-1) PBOX00337: nextState for action delete: deleted
08:37:33,824 TRACE [org.jboss.security] (MSC service thread 1-5) PBOX00337: nextState for action getPolicyConfiguration: open
08:37:33,825 TRACE [org.jboss.security] (MSC service thread 1-5) PBOX00315: delete, contextID: kitchensink.war
08:37:33,825 TRACE [org.jboss.security] (MSC service thread 1-5) PBOX00337: nextState for action delete: deleted
08:37:33,827 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action getPolicyConfiguration: open
08:37:33,827 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00315: delete, contextID: kitchensink.war
08:37:33,828 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action delete: deleted
08:37:33,842 TRACE [org.jboss.security] (ServerService Thread Pool -- 74) PBOX00354: Setting security roles ThreadLocal: null
08:37:33,851 TRACE [org.jboss.security] (ServerService Thread Pool -- 76) PBOX00354: Setting security roles ThreadLocal: null
08:37:33,856 TRACE [org.jboss.security] (ServerService Thread Pool -- 76) PBOX00354: Setting security roles ThreadLocal: null
08:37:33,867 TRACE [org.jboss.security] (MSC service thread 1-2) PBOX00227: removeAppConfig(secureDomain)
08:37:33,869 TRACE [org.jboss.security] (ServerService Thread Pool -- 74) PBOX00354: Setting security roles ThreadLocal: null
08:37:33,908 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00227: removeAppConfig(other)
08:37:33,908 TRACE [org.jboss.security] (MSC service thread 1-1) PBOX00227: removeAppConfig(jboss-ejb-policy)
08:37:47,423 TRACE [org.jboss.security] (MSC service thread 1-6) PBOX00226: addAppConfig(dummy), AuthInfo: AppConfigurationEntry[]:
08:37:52,909 TRACE [org.jboss.security] (MSC service thread 1-4) PBOX00337: nextState for action getPolicyConfiguration: open
08:37:52,909 DEBUG [org.jboss.security] (MSC service thread 1-4) PBOX00307: Constructing JBossPolicyConfiguration with contextID simpeljdbcrealm-1.0-SNAPSHOT.war
08:37:52,911 TRACE [org.jboss.security] (MSC service thread 1-4) PBOX00337: nextState for action getPolicyConfiguration: open
08:37:52,918 TRACE [org.jboss.security] (MSC service thread 1-4) PBOX00314: commit, contextID: simpeljdbcrealm-1.0-SNAPSHOT.war
08:37:52,918 TRACE [org.jboss.security] (MSC service thread 1-4) PBOX00337: nextState for action commit: inService
08:37:53,703 TRACE [org.jboss.security] (MSC service thread 1-1) PBOX00337: nextState for action getPolicyConfiguration: open
08:37:53,703 DEBUG [org.jboss.security] (MSC service thread 1-1) PBOX00307: Constructing JBossPolicyConfiguration with contextID kitchensink.war
08:37:53,712 TRACE [org.jboss.security] (MSC service thread 1-1) PBOX00337: nextState for action getPolicyConfiguration: open
08:37:53,714 TRACE [org.jboss.security] (MSC service thread 1-1) PBOX00310: addToRole, permission: [MemberRegistration,role-ref=**]
08:37:53,716 TRACE [org.jboss.security] (MSC service thread 1-1) PBOX00337: nextState for action addToRole: open
08:37:53,717 TRACE [org.jboss.security] (MSC service thread 1-1) PBOX00314: commit, contextID: kitchensink.war
08:37:53,721 TRACE [org.jboss.security] (MSC service thread 1-1) PBOX00337: nextState for action commit: inService
08:37:58,946 TRACE [org.jboss.security] (ServerService Thread Pool -- 66) PBOX00354: Setting security roles ThreadLocal: null
08:37:58,952 TRACE [org.jboss.security] (ServerService Thread Pool -- 66) PBOX00354: Setting security roles ThreadLocal: null
08:37:58,960 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action getPolicyConfiguration: open
08:37:58,968 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00310: addToRole, permission: ("javax.security.jacc.WebResourcePermission" "/faces/admin/*")
08:37:58,968 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToRole: open
08:37:58,969 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebUserDataPermission" "/faces/admin/*")
08:37:58,976 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:37:58,980 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebUserDataPermission" "/faces/admin/*")
08:37:58,980 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:37:58,986 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebResourcePermission" "/faces/users/*")
08:37:58,986 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:37:58,987 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebResourcePermission" "/faces/users/*")
08:37:58,989 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:37:58,992 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebResourcePermission" "/faces/users/*")
08:37:58,997 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:37:58,998 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebResourcePermission" "/faces/users/*")
08:37:58,999 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:37:58,999 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebUserDataPermission" "/faces/users/*")
08:37:58,999 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:37:59,000 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebUserDataPermission" "/faces/users/*")
08:37:59,000 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:37:59,004 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebResourcePermission" "/:/faces/admin/*:/faces/users/*")
08:37:59,010 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:37:59,011 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebResourcePermission" "/:/faces/admin/*:/faces/users/*")
08:37:59,014 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:37:59,014 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebResourcePermission" "/:/faces/admin/*:/faces/users/*")
08:37:59,020 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:37:59,021 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebUserDataPermission" "/:/faces/admin/*:/faces/users/*")
08:37:59,021 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:37:59,022 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebUserDataPermission" "/:/faces/admin/*:/faces/users/*")
08:37:59,022 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:37:59,027 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00310: addToRole, permission: ("javax.security.jacc.WebRoleRefPermission" "Faces Servlet" "**")
08:37:59,033 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToRole: open
08:37:59,034 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00310: addToRole, permission: ("javax.security.jacc.WebRoleRefPermission" "Faces Servlet" "ADMIN")
08:37:59,036 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToRole: open
08:37:59,046 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00310: addToRole, permission: ("javax.security.jacc.WebRoleRefPermission" "" "**")
08:37:59,047 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToRole: open
08:37:59,049 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00310: addToRole, permission: ("javax.security.jacc.WebRoleRefPermission" "" "ADMIN")
08:37:59,051 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToRole: open
08:37:59,056 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00314: commit, contextID: simpeljdbcrealm-1.0-SNAPSHOT.war
08:37:59,058 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action commit: inService
08:38:00,471 TRACE [org.jboss.security] (ServerService Thread Pool -- 64) PBOX00354: Setting security roles ThreadLocal: null
08:38:01,078 TRACE [org.jboss.security] (ServerService Thread Pool -- 64) PBOX00354: Setting security roles ThreadLocal: null
08:38:01,081 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action getPolicyConfiguration: open
08:38:01,086 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebResourcePermission" "/")
08:38:01,087 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:38:01,088 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebResourcePermission" "/")
08:38:01,088 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:38:01,089 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebResourcePermission" "/")
08:38:01,092 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:38:01,097 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebUserDataPermission" "/")
08:38:01,098 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:38:01,098 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00312: addToUncheckedPolicy, permission: ("javax.security.jacc.WebUserDataPermission" "/")
08:38:01,100 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToUncheckedPolicy: open
08:38:01,101 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00310: addToRole, permission: ("javax.security.jacc.WebRoleRefPermission" "Faces Servlet" "**")
08:38:01,103 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToRole: open
08:38:01,104 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00310: addToRole, permission: ("javax.security.jacc.WebRoleRefPermission" "org.jboss.as.quickstarts.kitchensink.rest.JaxRsActivator" "**")
08:38:01,110 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToRole: open
08:38:01,111 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00310: addToRole, permission: ("javax.security.jacc.WebRoleRefPermission" "" "**")
08:38:01,113 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action addToRole: open
08:38:01,119 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00314: commit, contextID: kitchensink.war
08:38:01,120 TRACE [org.jboss.security] (MSC service thread 1-3) PBOX00337: nextState for action commit: inService
08:39:10,718 TRACE [org.jboss.security] (default task-1) PBOX00354: Setting security roles ThreadLocal: null
08:39:10,964 TRACE [org.jboss.security] (default task-1) PBOX00354: Setting security roles ThreadLocal: null
08:39:13,160 TRACE [org.jboss.security] (default task-1) PBOX00354: Setting security roles ThreadLocal: null
08:39:13,260 TRACE [org.jboss.security] (default task-2) PBOX00354: Setting security roles ThreadLocal: null
08:39:13,261 TRACE [org.jboss.security] (default task-3) PBOX00354: Setting security roles ThreadLocal: null
08:39:13,284 TRACE [org.jboss.security] (default task-4) PBOX00354: Setting security roles ThreadLocal: null
08:39:13,331 TRACE [org.jboss.security] (default task-1) PBOX00354: Setting security roles ThreadLocal: null
08:39:13,375 TRACE [org.jboss.security] (default task-5) PBOX00354: Setting security roles ThreadLocal: null
08:39:17,603 TRACE [org.jboss.security] (default task-5) PBOX00200: Begin isValid, principal: org.wildfly.extension.undertow.security.AccountImpl$AccountPrincipal@c0d93cdc, cache entry: null
08:39:17,605 TRACE [org.jboss.security] (default task-5) PBOX00209: defaultLogin, principal: org.wildfly.extension.undertow.security.AccountImpl$AccountPrincipal@c0d93cdc
08:39:17,616 TRACE [org.jboss.security] (default task-5) PBOX00221: Begin getAppConfigurationEntry(secureDomain), size: 6
08:39:17,618 TRACE [org.jboss.security] (default task-5) PBOX00224: End getAppConfigurationEntry(secureDomain), AuthInfo: AppConfigurationEntry[]:
LoginModule Class: org.jboss.security.auth.spi.DatabaseServerLoginModule
08:39:17,629 TRACE [org.jboss.security] (default task-5) PBOX00236: Begin initialize method
08:39:17,636 DEBUG [org.jboss.security] (default task-5) PBOX00281: Password hashing activated, algorithm: SHA-256, encoding: base64, charset: null, callback: null, storeCallBack: null
08:39:17,638 TRACE [org.jboss.security] (default task-5) PBOX00262: Module options [dsJndiName: java:jboss/datasources/DOICHDS, principalsQuery: select passwd from Users where username=?, rolesQuery: select role, 'Roles' from UserRoles where username=?, suspendResume: true]
08:39:17,648 TRACE [org.jboss.security] (default task-5) PBOX00240: Begin login method
08:39:17,670 TRACE [org.jboss.security] (default task-5) PBOX00263: Executing query select passwd from Users where username=? with username myfear
08:39:17,724 TRACE [org.jboss.security] (default task-5) PBOX00241: End login method, isValid: true
08:39:17,725 TRACE [org.jboss.security] (default task-5) PBOX00242: Begin commit method, overall result: true
08:39:17,728 TRACE [org.jboss.security] (default task-5) PBOX00263: Executing query select role, 'Roles' from UserRoles where username=? with username myfear
08:39:17,735 TRACE [org.jboss.security] (default task-5) PBOX00263: Executing query select role, 'Roles' from UserRoles where username=? with username myfear
08:39:17,776 TRACE [org.jboss.security] (default task-5) PBOX00210: defaultLogin, login context: javax.security.auth.login.LoginContext@59f877d, subject: Subject(745690868).principals=org.jboss.security.SimplePrincipal@1437571176(myfear)org.jboss.security.SimpleGroup@1704402987(Roles(members:ADMIN))org.jboss.security.SimpleGroup@1704402987(CallerPrincipal(members:myfear))
08:39:17,777 TRACE [org.jboss.security] (default task-5) PBOX00207: updateCache, input subject: Subject(745690868).principals=org.jboss.security.SimplePrincipal@1437571176(myfear)org.jboss.security.SimpleGroup@1704402987(Roles(members:ADMIN))org.jboss.security.SimpleGroup@1704402987(CallerPrincipal(members:myfear)), cached subject: Subject(882771324).principals=org.jboss.security.SimplePrincipal@1437571176(myfear)org.jboss.security.SimpleGroup@1704402987(Roles(members:ADMIN))org.jboss.security.SimpleGroup@1704402987(CallerPrincipal(members:myfear))
08:39:17,780 TRACE [org.jboss.security] (default task-5) PBOX00208: Inserted cache info: org.jboss.security.authentication.JBossCachedAuthenticationManager$DomainInfo@4b02ffcf
08:39:17,785 TRACE [org.jboss.security] (default task-5) PBOX00201: End isValid, result = true
08:39:17,798 TRACE [org.jboss.security] (default task-5) PBOX00354: Setting security roles ThreadLocal: null
08:39:17,814 TRACE [org.jboss.security] (default task-5) PBOX00200: Begin isValid, principal: org.wildfly.extension.undertow.security.AccountImpl$AccountPrincipal@c0d93cdc, cache entry: org.jboss.security.authentication.JBossCachedAuthenticationManager$DomainInfo@4b02ffcf
08:39:17,814 TRACE [org.jboss.security] (default task-5) PBOX00204: Begin validateCache, domainInfo: org.jboss.security.authentication.JBossCachedAuthenticationManager$DomainInfo@4b02ffcf, credential class: class [C
08:39:17,815 TRACE [org.jboss.security] (default task-5) PBOX00205: End validateCache, result = true
08:39:17,817 TRACE [org.jboss.security] (default task-5) PBOX00201: End isValid, result = true
08:39:17,832 TRACE [org.jboss.security] (default task-5) PBOX00354: Setting security roles ThreadLocal: null
08:39:17,906 TRACE [org.jboss.security] (default task-5) PBOX00200: Begin isValid, principal: org.wildfly.extension.undertow.security.AccountImpl$AccountPrincipal@c0d93cdc, cache entry: org.jboss.security.authentication.JBossCachedAuthenticationManager$DomainInfo@4b02ffcf
08:39:17,906 TRACE [org.jboss.security] (default task-5) PBOX00204: Begin validateCache, domainInfo: org.jboss.security.authentication.JBossCachedAuthenticationManager$DomainInfo@4b02ffcf, credential class: class [C
08:39:17,910 TRACE [org.jboss.security] (default task-5) PBOX00205: End validateCache, result = true
08:39:17,916 TRACE [org.jboss.security] (default task-5) PBOX00201: End isValid, result = true
08:39:17,920 TRACE [org.jboss.security] (default task-5) PBOX00354: Setting security roles ThreadLocal: null








Posted by vernetto at 8:07 AM 0 comments
Labels: ,

Sunday, November 19, 2017

Quantum Security in KPN (AllDay DevOps 2017, Jaya Baloo)



jump to minute 11.50 where Jaya starts speaking.

You don't have to understand everything, but it's good to have a glimpse of the future

https://www.nature.com/news/quantum-spookiness-passes-toughest-test-yet-1.18255 here is the 2015 article about the Entanglement mentioned at 24:39

Here an explanation of the Quantum Entanglement https://en.wikipedia.org/wiki/Quantum_entanglement and Einstein's position. I think that saying that Einstein "HATED" the Q.E. is a bit excessive, he simply believed it was not possible and qualified as "spukhafte Fernwirkung" . I get allergic whenever someone tries to ridicule Einstein.

Here more about Einstein "spooky" story https://en.wikipedia.org/wiki/Bohr%E2%80%93Einstein_debates and here https://en.wikipedia.org/wiki/Qubit something more about the Qubit

Maybe you want to try some of IDQuantique products already https://www.idquantique.com/

This is also a good presentation of the brilliant Jaya, given to a totally passive and indifferent audience ("we don't really care if the NSA spies on us, all we care is make good money and have fun on the weekend")





Posted by vernetto at 9:59 AM 0 comments
Labels: ,

Wednesday, October 18, 2017

OWASP Dependency Check maven plugin

https://blog.lanyonm.org/articles/2015/12/22/continuous-security-owasp-java-vulnerability-check.html


https://jeremylong.github.io/DependencyCheck/dependency-check-maven/index.html


https://www.owasp.org/index.php/OWASP_Dependency_Check


https://nvd.nist.gov/vuln/data-feeds


just run

mvn dependency-check:check

and you get a great report with all the vulnerabilities in your dependencies.... fantastic! Even a Jenkins plugin is available, so you don't need to modify all your poms.


To install it as Jenkins Plugin, install these plugins:

http://updates.jenkins-ci.org/latest/dependency-check-jenkins-plugin.hpi
https://updates.jenkins.io/latest/token-macro.hpi
https://updates.jenkins.io/latest/analysis-core.hpi
https://updates.jenkins.io/latest/dashboard-view.hpi
https://updates.jenkins.io/latest/maven-plugin.hpi
http://updates.jenkins-ci.org/latest/apache-httpcomponents-client-4-api.hpi
http://updates.jenkins-ci.org/latest/javadoc.hpi
http://updates.jenkins-ci.org/latest/jsch.hpi


Interesting post on how to configure a separate jenkins task just to update the NIST repos in a common folder https://medium.com/@PrakhashS/checking-vulnerabilities-in-3rd-party-dependencies-using-owasp-dependency-check-plugin-in-jenkins-bedfe8de6ba8 to avoid checking for updates at every build.

A similar post goes here https://blog.dominikschadow.de/2015/07/using-owasp-dependency-check-as-jenkins-plugin/


A good test is to run it against the WebGoat https://github.com/WebGoat/WebGoat but the repo is heavy and you need a good internet connection


Here https://jeremylong.github.io/DependencyCheck/general/dependency-check.pdf a presentation of the plugin by Jeremy Long (OWASP)





Posted by vernetto at 3:10 PM 0 comments
Labels: ,

Saturday, June 10, 2017

WebLogic: avoiding anonymous user calls

Servlet or JSP initialization


weblogic.xml 

<servlet-descriptor>
       <servlet-name>MyServletName</servlet-name>
       <init-as-principal-name>MySERVLET.INIT.USER</init-as-principal-name>
   </servlet-descriptor>

Where MyServletName needs to be replaced with the name of your Servlet, as declared in the web.xml file.

ServletContextListener


config.xml 
  <app-deployment>
    <name>myapp</name>
    <target>webInitServer</target>
    <source-path>./deploy/presear</source-path>
    <deployment-principal-name>MY.DEPLOYMENT.PRINCIPAL</deployment-principal-name>
    <security-dd-model>Advanced</security-dd-model>
    <staging-mode>nostage</staging-mode>
  </app-deployment>


EJB create method


weblogic-ejb-jar.xml 
<?xml version="1.0" encoding="UTF-8"?>
<weblogic-ejb-jar xmlns="http://www.bea.com/ns/weblogic/90" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.bea.com/ns/weblogic/90 http://www.bea.com/ns/weblogic/910/weblogic-ejb-jar.xsd">
  <weblogic-enterprise-bean>
    <ejb-name>MyEJB</ejb-name>
    <stateless-session-descriptor>
      <business-interface-jndi-name-map>
        <business-remote>acme.ejb.test.MyEJB</business-remote>
        <jndi-name>pippo</jndi-name>
      </business-interface-jndi-name-map>
      <pool>
        <max-beans-in-free-pool>5</max-beans-in-free-pool>
        <initial-beans-in-free-pool>1</initial-beans-in-free-pool>
      </pool>
       <stateless-bean-is-clusterable>True</stateless-bean-is-clusterable>
      </stateless-clustering>
    </stateless-session-descriptor>
    <create-as-principal-name>MY.EJB.CREATE.PRINCIPAL</create-as-principal-name>
</weblogic-ejb-jar>


EJB timer


ejb-jar.xml 

<?xml version="1.0" encoding="UTF-8"?>
<ejb-jar id="ejb-jar" 
 xmlns="http://java.sun.com/xml/ns/javaee" version="3.0"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/ejb-jar_3_0.xsd">
  <enterprise-beans>
    <session>
      <ejb-name>CDRTimer</ejb-name>
      <ejb-class>acme.ejb.timer.test.CDRTimerBean</ejb-class>
      <session-type>Stateless</session-type>
      <security-identity>
        <run-as>
          <role-name>TimerExecutor</role-name>
        </run-as>
      </security-identity>
    </session>
  </enterprise-beans>
  <assembly-descriptor>
    <security-role>
      <description></description>
      <role-name>TimerExecutor</role-name>
    </security-role>
  </assembly-descriptor>
  <ejb-client-jar>CDRTimerEJBclientjar.jar</ejb-client-jar>
</ejb-jar>

weblogic-ejb-jar.xml 

  <run-as-role-assignment>
    <role-name>TimerExecutor</role-name>
    <run-as-principal-name>CDRTIMER.RUN.PRINCIPAL.NAME</run-as-principal-name>
  </run-as-role-assignment>






Posted by vernetto at 4:34 PM 0 comments
Labels: ,

Sunday, November 27, 2016

Security: how to retrieve a certificate from a keystore

See here https://docs.oracle.com/cd/E19509-01/820-3503/ggfen/index.html how to create a keystore with a (self signed) certificate.

Code is here: http://www.java2s.com/Code/Java/Security/RetrievingaCertificatefromaKeyStore.htm

https://docs.oracle.com/javase/7/docs/api/java/security/KeyStore.html

https://docs.oracle.com/javase/7/docs/api/java/security/cert/Certificate.html

http://grepcode.com/file/repository.grepcode.com/java/root/jdk/openjdk/6-b14/sun/security/x509/X509CertImpl.java



Posted by vernetto at 8:55 AM 0 comments
Labels:

Saturday, October 29, 2016

Cryptography: recommended Wikipedia readings

https://en.wikipedia.org/wiki/Public_key_certificate

https://en.wikipedia.org/wiki/RSA_(cryptosystem)

https://en.wikipedia.org/wiki/Digital_signature

https://en.wikipedia.org/wiki/Certificate_authority

https://en.wikipedia.org/wiki/Intermediate_Certificate_Authority

https://en.wikipedia.org/wiki/Self-signed_certificate

https://en.wikipedia.org/wiki/Transport_Layer_Security

https://en.wikipedia.org/wiki/Message_authentication_code

https://en.wikipedia.org/wiki/Domain-validated_certificate



I have started reading "The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography" by Simon Singh but I was somehow disappointed... see this comment from another reader.



Posted by vernetto at 7:15 PM 0 comments
Labels:

Network security training by MIT

I was looking for some video training on WebLogic security and found mostly very poor, boring, slow videos presented by trainers who say "I mean" in every sentence and take themselves very seriously.

Then I stumbled upon this great series on Network Security https://ocw.mit.edu/courses/electrical-engineering-and-computer-science/6-858-computer-systems-security-fall-2014/video-lectures/ with definitely a more professional approach. I have watched lesson 14 on "https and ssl" by Nickolai Zeldovich and it's quite good - well at least you don't fall asleep while watching it.

Other recommended videos:

basics on SSL/TLS



BlackHat USA 2011: SSL And The Future Of Authenticity









Posted by vernetto at 2:12 PM 0 comments
Labels:

Saturday, August 13, 2016

Security: how to sign a message

How to SIGN a message: http://www.java2s.com/Code/Java/Security/SignatureTest.htm

Classes involved:

https://docs.oracle.com/javase/7/docs/api/java/security/KeyPairGenerator.html

https://docs.oracle.com/javase/7/docs/api/java/security/SecureRandom.html
https://docs.oracle.com/javase/7/docs/api/java/security/KeyPair.html
https://docs.oracle.com/javase/7/docs/api/java/security/PublicKey.html
https://docs.oracle.com/javase/7/docs/api/java/security/PrivateKey.html
https://docs.oracle.com/javase/7/docs/api/java/security/Signature.html
Code is available also here in Eclipse workspace:
https://github.com/vernetto/JavaMonAmour/tree/master/workspace

Posted by vernetto at 4:14 PM 0 comments
Labels:

Monday, July 25, 2016

TLS v1.2 support in Java 6

According to Oracle Doc:
JDK 6 release supports TLS v1. See:
http://docs.oracle.com/javase/6/docs/technotes/guides/security/SunProviders.html#SunJSSEProvider
JDK 6 supports TLS 1.1 as well since JDK 6u111.
http://www.oracle.com/technetwork/java/javase/overview-156328.html#R160_111
JDK 7 release supports TLS v1, TLS v1.1 and TLS v1.2. See:
https://docs.oracle.com/javase/7/docs/technotes/guides/security/SunProviders.html#SunJSSEProvider

In fact, TLS 1.2 is available in Java 6: "TLS v1.2 is now a TLS protocol option with the release of JDK 6u121" or maybe even in 6u115 b32 (copy and paste issue?)
http://www.oracle.com/technetwork/java/javase/overview-156328.html
enabled with -Djdk.tls.client.protocols="TLSv1.2"

To test if you have TLSv1.2 support: 
public class TLSTest  {
        public static void main(String[] args) throws Exception {
                System.out.println("before TLSv1.1");
                SSLContext ctx = SSLContext.getInstance("TLSv1.1");
                System.out.println("before TLSv1.2");
                ctx = SSLContext.getInstance("TLSv1.2");
                System.out.println("after");
        }

}

and run with
java -Djdk.tls.client.protocols="TLSv1.1,TLSv1.2" TLSTest

if you get "Exception in thread "main" java.security.NoSuchAlgorithmException: TLSv1.2 SSLContext not available" then you are screwed.


Posted by vernetto at 4:26 PM 0 comments
Labels: ,

which Cipher Suites your JVM supports

"SunJSSE supports a large number of ciphersuites" http://docs.oracle.com/javase/6/docs/technotes/guides/security/SunProviders.html#SunJSSEProvider
1) WLS 11g (WLS 10.3.6) uses JSSE and runs on Java SE 6
2) JSSE java 6  http://docs.oracle.com/javase/6/docs/technotes/guides/security/SunProviders.html#SunJSSEProvider
3) WLS 10.3.6 ciphers: http://docs.oracle.com/cd/E28280_01/web.1111/e13707/ssl.htm#BABBDACC

The classification of the different bits (TLS_DHE_RSA_WITH_AES_128_CBC_SHA) is as follows:
TLS vs SSL
RSA vs ECDH vs ECDHE vs DHE vs KRB5
ECDSA vs RSA
RC4 vs 3DES vs DES vs AES
EDE vs CBC
SHA vs MD5

Set "-Dssl.debug=true -Djavax.net.debug=ssl -Dweblogic.log.StdoutSeverity=Debug" then search for the statement
SSLEngine.setEnabledCipherSuites
to see which Ciphers are actually ENABLED (not only supported).
See also http://stackoverflow.com/questions/10487962/java-cipher-suites
There is a property https.cipherSuites , and a SSLSocket.setEnabledCipherSuites()/SSLEngine.setEnabledCipherSuites() method.
See also MOS document "How to Verify the Sun JSSE Cipher Suites Available to WebLogic Server (11g/12c) (Doc ID 2052237.1)"
suggesting to enable these flags 
 -Dweblogic.debug.DebugSecuritySSL=true
 -Djavax.net.SSL=true
 -Djava.debug=SSL
 -Djavax.net.debug=all
 -Dssl.debug=true
 -Dweblogic.StdoutDebugEnabled=true
 -Dweblogic.log.LogSeverity=Debug
 -Dweblogic.log.LoggerSeverity=Debug


Posted by vernetto at 12:23 PM 0 comments
Labels: , ,

Saturday, July 16, 2016

Learning Java Security and JCA

Excellent working examples here http://www.java2s.com/Code/Java/Security/CatalogSecurity.htm

JCA Tutorial http://docs.oracle.com/javase/7/docs/technotes/guides/security/crypto/CryptoSpec.html



Debugging http://docs.oracle.com/javase/7/docs/technotes/guides/security/jsse/ReadDebug.html

Read the content of the D:\Program Files\Java\jdk1.8.0_31\jre\lib\security\java.security file, it's very educational.
important properties:
-Djava.security.properties=


Read more:
https://en.wikipedia.org/wiki/X.509
https://en.wikipedia.org/wiki/Certification_path_validation_algorithm
https://en.wikipedia.org/wiki/Root_certificate
https://en.wikipedia.org/wiki/Public_key_certificate
https://en.wikipedia.org/wiki/Certificate_authority



Posted by vernetto at 11:47 PM 0 comments
Labels: ,

Sunday, June 5, 2016

BEA-090171 and BEA-090169

in WebLogic there are 2 messages helping us identify the identity and trust store used :
BEA-090171 Loading the identity certificate and private key stored under the alias client ....

BEA-090169 Loading trusted certificates from the JKS file store

This flag is useful to trace: -Dweblogic.security.SSL.verbose=true -Djavax.net.debug=all
Check also the "ssl" element in config.xml: 
    <ssl>
      <use-java>true</use-java>
      <enabled>true</enabled>
      <ciphersuite>TLS_RSA_WITH_AES_256_CBC_SHA</ciphersuite>
      <ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA</ciphersuite>
      <ciphersuite>TLS_RSA_WITH_RC4_128_SHA</ciphersuite>
      <ciphersuite>TLS_RSA_WITH_3DES_EDE_CBC_SHA</ciphersuite>
      <hostname-verifier>com.pierre.HostNameVerifier</hostname-verifier>
      <hostname-verification-ignored>false</hostname-verification-ignored>
      <export-key-lifespan>500</export-key-lifespan>
      <client-certificate-enforced>true</client-certificate-enforced>
      <listen-port>33641</listen-port>
      <two-way-ssl-enabled>true</two-way-ssl-enabled>
      <server-private-key-alias>some.certificate.alias</server-private-key-alias>
      <server-private-key-pass-phrase-encrypted>{AES}blablabla=</server-private-key-pass-phrase-encrypted>
      <ssl-rejection-logging-enabled>true</ssl-rejection-logging-enabled>
      <inbound-certificate-validation>BuiltinSSLValidationAndCertPathValidators</inbound-certificate-validation>
      <outbound-certificate-validation>BuiltinSSLValidationOnly</outbound-certificate-validation>
      <jsse-enabled>true</jsse-enabled>
    </ssl>


SSLMBean.ServerPrivateKeyAlias https://docs.oracle.com/cd/E13222_01/wls/docs100/schemaref/security/http.www.bea.com.ns.weblogic.920.domain/types/ssltype.server-private-key-alias.html



Posted by vernetto at 10:38 AM 0 comments
Labels: ,

Friday, February 19, 2016

weblogic.security.subject.SubjectManager.getSubjectManager hangs when using wrong JDK

Trying to connect from Eclipse to a WLS, Java client for EJB, using 2 way SSL and t3s, we get a stuck thread on this: 

"main" #1 prio=5 os_prio=0 tid=0x000000000263f000 nid=0x12900 in Object.wait() [0x0000000002a6d000]
   java.lang.Thread.State: WAITING (on object monitor)
 at java.lang.Object.wait(Native Method)
 - waiting on <0x00000000d8d00d00> (a java.lang.Object)
 at java.lang.Object.wait(Object.java:502)
 at weblogic.security.subject.SubjectManager.getSubjectManager(SubjectManager.java:277)
 - locked <0x00000000d8d00d00> (a java.lang.Object)
 at weblogic.security.subject.SubjectManager$GetKernelIdentityAction.run(SubjectManager.java:440)
 at weblogic.security.service.SecurityManager.getKernelIdentity(SecurityManager.java:164)
 at weblogic.security.service.GetKernelIdentityAction.run(GetKernelIdentityAction.java:25)
 at java.security.AccessController.doPrivileged(Native Method)
 at weblogic.jndi.WLSJNDIEnvironmentImpl.(WLSJNDIEnvironmentImpl.java:57)
 at java.lang.Class.forName0(Native Method)
 at java.lang.Class.forName(Class.java:264)
 at weblogic.jndi.internal.JNDIEnvironment.getJNDIEnvironment(JNDIEnvironment.java:37)
 at weblogic.jndi.Environment.(Environment.java:92)

...

The issue was solved changing JDK


Posted by vernetto at 6:34 PM 6 comments
Labels: ,

Monday, May 11, 2015

java.security.cert.CertificateException: no trust anchor defined

Or also "Trust anchor for certification path not found "


If you see a "java.security.cert.CertificateException: no trust anchor defined", most likely it means that someone has messed up the Certificate, for instance replacing a trusted CA certificate with a Self-Signed certificate.

you can use "openssl s_client -debug -connect yourhost:yourport" and check for the dreaded "verify error:num=18:self signed certificate"

In case you use an Oracle Wallet to hold certificates, you can do a

orapki wallet display -wallet /path/to/wallet -summary

http://docs.oracle.com/cd/B28359_01/network.111/b28530/asoappf.htm#i636653


Here https://medium.com/@kibotu/handling-custom-ssl-certificates-on-android-and-fixing-sslhandshakeexception-65ffb9dc612e some troubleshooting is suggested

#this to display the server's certificates
openssl s_client -connect myserver.com:443 -showcerts


#to save server cert to pem format
openssl s_client -connect google.com:443 -showcerts < /dev/null 2> /dev/null | openssl x509 -outform PEM > googlecert.pem

The JVM trusted CA certs are in $JAVA_HOME/jre/lib/security/cacerts

To add an entry in cacerts:

keytool -import -trustcacerts -keystore cacerts -storepass changeit -alias googleca -import -file googlecert.pem

To examine the content of cacerts , use https://keystore-explorer.org/


To dump all your trustedCA()

import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509TrustManager;
import java.security.KeyStore;
import java.security.cert.X509Certificate;
import java.util.Arrays;


public class TM {
    public static void main(String[] args) throws Exception {
        TrustManagerFactory factory = TrustManagerFactory.getInstance("X509");
        factory.init((KeyStore) null);
        TrustManager[] tms = factory.getTrustManagers();
        X509TrustManager tm = (X509TrustManager) tms[0];
        X509Certificate[] ai = tm.getAcceptedIssuers();
        Arrays.stream(ai).forEach(item -> System.out.println(item.toString()));
    }
}



Here https://nakov.com/blog/2009/07/16/disable-certificate-validation-in-java-ssl-connections/ a dirty trick to trust all certificates:


import java.io.InputStreamReader;
import java.io.Reader;
import java.net.URL;
import java.net.URLConnection;
 
import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSession;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import java.security.cert.X509Certificate;
 
public class Example {
    public static void main(String[] args) throws Exception {
        // Create a trust manager that does not validate certificate chains
        TrustManager[] trustAllCerts = new TrustManager[] {new X509TrustManager() {
                public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                    return null;
                }
                public void checkClientTrusted(X509Certificate[] certs, String authType) {
                }
                public void checkServerTrusted(X509Certificate[] certs, String authType) {
                }
            }
        };
 
        // Install the all-trusting trust manager
        SSLContext sc = SSLContext.getInstance("SSL");
        sc.init(null, trustAllCerts, new java.security.SecureRandom());
        HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
 
        // Create all-trusting host name verifier
        HostnameVerifier allHostsValid = new HostnameVerifier() {
            public boolean verify(String hostname, SSLSession session) {
                return true;
            }
        };
 
        // Install the all-trusting host verifier
        HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid);
 
        URL url = new URL("https://www.nakov.com:2083/");
        URLConnection con = url.openConnection();
        Reader reader = new InputStreamReader(con.getInputStream());
        while (true) {
            int ch = reader.read();
            if (ch==-1) {
                break;
            }
            System.out.print((char)ch);
        }
    }
}



Posted by vernetto at 5:21 PM 0 comments
Labels: , , , , ,

Tuesday, July 22, 2014

Revocation information for the security certificate for this site is not available.

one of our workstations was getting regularly this popup "Revocation information for the security certificate for this site is not available. Do you want to proceed?". It's a Windows 7 machine.

Clicking on "view certificate" it was showing one of our certificates. Opening the certificate we discovered that there is a Certificate Revocation List

They tried "Start, then Control Panel, then Internet Options, then Clear SSSL State", they also checked that the date/time was correct.

This article http://www.brighthub.com/internet/security-privacy/articles/82291.aspx is a sort of universal source of truth for this issue.

Then we discovered simply that the CRL URL was not accessible from that workstation, because the proxy was blocking it. Granting access to that URL solved the issue.



Posted by vernetto at 10:30 AM 0 comments
Labels: , ,

Friday, July 11, 2014

WebLogic supported Cyphers

The list of the possible strong cyphers not that long: 

AES256-GCM-SHA384      TLSv1.2 Kx=RSA      Au=RSA  Enc=AESGCM(256) Mac=AEAD

AES256-SHA256                TLSv1.2 Kx=RSA     Au=RSA  Enc=AES(256)  Mac=SHA256

AES128-GCM-SHA256      TLSv1.2 Kx=RSA      Au=RSA  Enc=AESGCM(128) Mac=AEAD

AES128-SHA256                TLSv1.2 Kx=RSA     Au=RSA  Enc=AES(128)  Mac=SHA256

AES256-SHA                       SSLv3 Kx=RSA       Au=RSA  Enc=AES(256)  Mac=SHA1

DES-CBC3-SHA                  SSLv3 Kx=RSA      Au=RSA  Enc=3DES(168) Mac=SHA1

AES128-SHA                       SSLv3 Kx=RSA      Au=RSA  Enc=AES(128)  Mac=SHA1


and they are all supported by most popular Content Delivery appliances.

According to Oracle doc, WebLogic supports SSL3 and TLS1, you can restrict the protocols with the 2 properties weblogic.security.SSL.protocolVersion and weblogic.security.SSL.minimumProtocolVersion (funnily it seems that the property value is spelled slightly differently in the 2 properties)

Interestingly it seems that support for TLS version > 1.0 is available only with Java 7.

So if you run on Java 6 the only option available is using SSL3.

WebLogic these days supports only the "JSSE-based SSL implementation", and the Cypher Suites are listed here for Java 6 and Java 7

Posted by vernetto at 1:07 PM 0 comments
Labels: , , ,
Subscribe to: Posts (Atom)