Cybersecurity Risk

What is Cybersecurity Risk?

Continuing from the example of losing the photos stored in a computer from my last post, we know that we are concerned about losing these precious photos. There is a chance that these photos would be lost. This "chance" is cybersecurity risk.

To be precise, it is the chance that something will cause an impact to a thing. In cybersecurity, usually in a negative sense, a chance that something will cause an negative consequence to the system or data.

Let me dissect the term cybersecurity risk a little deeper. For there to be a cybersecurity risk, you must have the following conditions:

• There must be an Event that could occur due to a cause or several causes. This event must also be pertaining to something that you are concerned about.
  
  i.e. losing photo files.

• There must be a Likelihood that the event could occur. If there is no way that it could occur, then it is not a concern, right?
  
  i.e. MTBF.
  
  
• There must be a Cause for the event to occur. It is important not to mix up the cause and the event. Photo files are lost because of hardware malfunction, not the other way round. There could be multiple causes for an event to occur.
  
  i.e. hardware malfunction.
  
  
• There must be a Consequence (or Outcome) when the event occur. This highlight why one should be concerned about the risk. Usually, we should quantify it with some value. If we are too vague on the consequence, the reader may not feel the gravity of the risk.
  
  i.e. 1000 photos are lost.
  

There is no risk, if any of these conditions do not exist. 

To push the idea deeper, other than hardware failure, there are other scenarios where the photos could be lost: someone or something accidentally or purposefully render the files inaccessible either by deletion, corruption or kidnapping (no kidding!) the files. Therefore, it is usual that there could be many different events that end up with same or similar consequence.  

Let's go on to the different type of risk definitions.

What is Inherent (Current) Risk?

This is security risk level given the current situation or scenario. Depending on where you read, it may mean either 'in the absence of controls' or 'current situation with existing controls in place'. In reality, it is more practical to see the risk with existing controls rather than the more academic (purist) way.

For example, say you password protect the photo files to prevent others from being able to access it without your permission, one risk that one can think of is usage of weak password that could allow someone to guess it in a very short time.

What is Secondary Risk?

This is security risk that appears as a result of treating a security risk.

For example, say you use a password manager to help you set a strong password to the photo files. One risk that the author can think of is a weakness in the password manager allowing someone to steal the password stored in it. This risk exist because you treated a security risk, in this case, the risk of a weak password, with a password manager.

What is Residual Risk?

Residual risk is the risk remaining after treating the risk. (ISO/IEC 27001:2018 Information Security Management)

For example, after using password manager to set a strong password to the photo files and then safeguarding the password, one can think that there could be a risk of forgetting the password to the password manager. Haha...

Till then. I will find time to write more.

Cybersecurity

What is Cybersecurity?

Security (for Information and Communication Technology, or aka ICT) is concerned about ensuring the protection of computer systems (IT, OT, IoT, etc) in such a way that the functions of the system is not impeded. It should protect the system against both accidental and malicious attacks, whether these are natural or man-made in origin.

Security should be comprehensive enough to protect the system from both digital and physical attacks. We shouldn't focus on protecting from digital attacks and forget about the physical portion. For example, you have a lot of precious photos in your computer. You have anti-virus, up-to-date patches, and switch off the network connection when not in use. You think you are safe. Have you catered for hardware failure or accidental coffee spills?

Like how we maintain our health, there is no way to guarantee a system to be 100% safe after improving security for the systems. We can eat very healthily, exercise regularly, and sleep well, but we all know for sure, this don't guarantee we won't fall sick. Likewise, we can apply the most sophisticated or even the most expensive security implementations to protect the system, we can never be sure the system is 100%. We can only try to minimise the chance of an attack or a breach from occurring, and if it ever occurs, we try to minimise the consequence of an attack or a breach.

So cyber security is security for cyber.:P Whether cyber or not, i believe security should apply across the whole ICT, save for some differences in mitigating treatment for some areas.

What are the aspect of security are we concerned about?

There are many different models available that can be used for security. CIA is one popular model, taught in almost all security courses and schools.

C - Confidentiality, which is concerned about allowing access to the system or data only to authorised party.

I - Integrity, which is concerned about allowing modification to the system or data only to authorised party.

A - Availability, which is concerned about guaranteeing the reliable access to the information only by authorised party.

CIA is a basic model but we can extend it to include the following, or more:

Authenticity - verifying the identity of the entity that wants to interact with the system or data.

Authorisation - specifying the permission for accessing the system or data. Usually it is preceded by authentication, especially in software defined parameter framework.

Non-repudiation - providing assurance that the sender of information is provided with proof of delivery and the recipient is provided with the proof of sender's identity, so neither can later deny having processed the information.

In other words, when we want to improve security, we think of what are the concerns on these security aspects and how they can affect the security of the systems. We then think of solution to address the concerns. I will find time to write about how to find, evaluate, and address these concerns.

So, what's your view on cybersecurity?

Internal Error in VMware player

Encountered error opening up the VMs in VMware player 6.0.x with "Error while powering on: Internal error"

It turns out that the "VMware Authorization Service" service must be enabled. You may need administrator rights if you are running as a normal user. This problem will happen even if the service is already set as "automatic".

Once the service is started up, the error will go away.

How to prevent MS IIS Content Location Internal IP Address Leak

With reference to http://support.microsoft.com/kb/834141, we would want to fix the issue of IP address being revealed in the content-location field in the TCP header on MS IIS 6.0.

Confirmation that you are affected
- telnet to the web service
- perform "GET / HTTP/1.0"
- press twice.

If you see "Content-Location: http:///Default.htm", you are affected.


To rectify this issue,
- right click on the Website, click on Properties button for logging.
- take note of the Site ID inside Log file name in this "Extended Logging Properties" window. i.e. W3SVC39\exyymmdd.log means your Site ID is 39
- Set the web server to use Host name instead of Host IP. Fire up the command prompt and navigate to C:\Inetpub\AdminScripts\, run the command "csript adsutil.vbs set w3svc//UserHostName true"
- run command "we".

You can then verify by using the telnet test again. Good luck!

How to disable browsable web directory

There is increasingly more cons than pros in allowing browsing access to the web servers' web directories. The black hats could use this to crawl for information or even use this as the gateway to launch an attack.

Here's how to disable web directory browsing on MS IIS. Tested on IIS 6.

- Open up IIS
- select the web site, right click on it and select properties.
- uncheck "Directory Browsing".
- restart web service.

And you are done with configuration. :)

How to enable or require SMB signing for Windows Server

Recently, discovered that some servers are having SMB vulnerabilities, in this case, file sharing on SMB not requiring signing or signing is not enabled.

How do we secure the communications? Here's how.

If you are on Windows NT4.0, Windows 2K and Windows 2k3, go to registry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters
- For SMB signing Required, set Registry key RequireSecuritySignature=1
- For SMB signing Enabled (if server agrees), set Registry key EnableSecuritySignature=1 and RequireSecuritySignature=0
- For SMB signing Disabled (if server agrees), set Registry key EnableSecuritySignature=0 and RequireSecuritySignature=0

If you on Windows 98, go to registry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkStation\Parameters
- For SMB signing Required, set Registry key RequireSecuritySignature=1
- For SMB signing Enabled (if client agrees), set Registry key EnableSecuritySignature=1 and RequireSecuritySignature=0
- For SMB signing Disabled (if client agrees), set Registry key EnableSecuritySignature=0 and RequireSecuritySignature=0

Do note that all registry keys should be of type DWORD.

If you want to set through GPO, set through Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

If you are on Windows 2K8 and 2K12, you should be on SMB2. Configuration is slightly easier. you can go to registry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters
- For SMB2 signing Required, set Registry key RequireSecuritySignature=1
- For SMB2 signing Not required, set Registry key RequireSecuritySignature=0

If you are on Windows Vista and XP or 7, you should be on SMB2. Configuration is slightly easier. you can go to registry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkStation\Parameters
- For SMB2 signing Required, set Registry key RequireSecuritySignature=1
- For SMB2 signing Not required, set Registry key RequireSecuritySignature=0

Replacing SSL certificate for HPSMH

This is for replacing the SSL certificate used in HP SMH aka "System Management Homepage", especially after a few round of SSL issues coming from openssl to SSLv3.

The steps are as follows

Step 1
- Logon to HPSMH
- Click from the menu, "Settings" -> "Security" -> "Local Server Certificate"
- Fill up the necessary fields. (Alternative Names should be FQDN)

Step 2
- Logon to the server
- copy the content in req_cr.pem file. (should be in C:\hp\sslshare by default i think)

Step 3
- Register the CSR with your CA to obtain the final X509 certificate (Base 64 encoded in PEM format)

Step 4
- Replace the new certificate over the existing cert.pem (if any).
- Restart HPSMH service.


reference: http://www.admin-enclave.com/en/solutions/windows/47-replace-the-ssl-certificate-for-hp-system-management-homepage-with-a-ca-generated-one.html

How to capture network traffic for analysis in Linux

While working to verify some windows setting, i had to capture the network traffic and confirm that the setting is in place. This steps below may help you as much as it did for me. :)

Capturing the network traffic

We can use our favourite packet capture tool to capture the network traffic between the source and destination hosts. Here, i will demonstrate both using the plain vanilla 'tcpdump' and 'tethereal' tool.

  # tcpdump -vvXX port 445 -w /dir_path/file_name

  # tethereal -p -w /dir_path/file_name port 445

You can see that i'm trying to capture as much data as i can although it may be excessive but it may be worthwhile if you find that you need those data later on.

Once you have the above in placed, you can then fire off the traffic that you want to capture. As in above example, i'm trying to capture SMB traffic.

Trigger the traffic

In this demonstration, i will use 'nmap' to trigger the SMB traffic.

  # nmap --script smb-security-mode.nse 192.168.1.1

You should see the 'tcpdump' output reporting that some traffic are captured.

[root@server ~]# tethereal -p -w /tmp/smb.capture port 445
Capturing on bond0
12

Below is the output for 'tethereal'. Your output should be similar.

[root@server ~]# tcpdump -vvXX port 445 -w /tmp/smb.capture
tcpdump: listening on bond0, link-type EN10MB (Ethernet), capture size 96 bytes
12 packets captured
0 packets received by filter
0 packets dropped by kernel

Display the network traffic for analysis

Now that the traffic has been captured, time to display them.
If you are using 'tcpdump', you may have to use another tool to analyse the network traffic as there is no functionality built in to decode the protocol that you are looking at.


To display using 'tcpdump', try this.

  # tcpdump -vvXX  -r /tmp/smb.capture

Here, you may want to use a free, online tool at [http://sadjad.me/phd/]. This is literally a packet HEX decoder. you need to copy out those HEX for a particular packet into the webpage and click 'decode'. After that, just click on the result to expand and read the information that is decoded.

If you are using 'tethereal', try this instead.

  # tethereal -Vx -r /tmp/smb,capture  | more

Yes, i was trying to find out if the SMB protocol was set to encrypted plus signing enabled + signing required. Here's the essential part of the output.

        Security Mode: 0x0f
            .... ...1 = Mode: USER security mode
            .... ..1. = Password: ENCRYPTED password. Use challenge/response
            .... .1.. = Signatures: Security signatures ENABLED
            .... 1... = Sig Req: Security signatures REQUIRED

Thats all folks!

How to Open Two Excel Files to work on Side by Side

Opening two separate Excel files to work on side by side

Sometimes, we want to have the flexibility to work on excel files side by side, not within the excel application but on 2 separate excel applications.

how do we go about doing that?

[Option A] Configure Excel first

In Excel 2007/2010, click on Office button, then Excel Options, then Advanced Tab
Under General section,  check ‘Ignore other applications that use Dynamic Data Exchange’.
This method forces each Excel file as a separate instance, the memory consumption will be more. If you have memory constrain (maybe less than 512Mb of memory in computer?), may want to use option B.

[NOTE] If you have issues like excel opens but cant display a workbook, you may not use this option. .

[Option B] Open another instance of Excel

Since we want to have each worksheet in separate instances, say one Excel file in Monitor 1 and another in Monitor 2, you can go through the Start Menu ->Programs -> Microsoft Office -> Excel. Alternatively, you can right click on the shortcut and click the "Microsoft Office Excel 2007". This will also open a separate instance of Excel.
Now you can place the 2 workbooks on 2 separate monitors or as you fancy.

[NOTE] In Excel 2013, It appears that you do not need to configure anything and you can have separate instances already. :)

How to find the location of the current file in Office 2007/2010

In office 2007/2010, this is called “Document Location”.

Here’s how to enable it.

1) Click on the pull down menu on the top left of the window box (beside the Microsoft Office, save, undo, redo buttons) then click on “More commands”

2) Look for the “Document Location” and add it.

3) Click ok and you are done. The address is on the top left of the window box.

You can do this for word / excel / ppt.

Enjoy!

Some tips on setting up for Apache 2.2

Here's some of the things i used to set up and harden my Apache, with both performance and security in mind.
This serve as a brain dump and hopefully it help you.

ServerTokens to set from default "Full" to "Prod" so that amount of information shown by Apache is reduced.

ServerSignature to remain as default "Off" to disable version and patch level display

keepAlive to remain as default "On" so that long-lived HTTP sessions will be allowed for multiple requests to be sent over the same TCP connections.

AllowOverride to set from default "All" to "None" to prevent users from setting up .htaccess files which can override default security features.

ScriptAlias is to be commented and to disable the use of cgi-bin. Recommended to use "Directory", "SetHandler" and "Options" instead if required.

To place the "%D" (time taken to serve the request, in microseconds) in Log format. It will be helpful during troubleshooting time.

Only recommend to compile mod_ssl statiscally into Apache core. This is more for performance since nowsaday, we rely more on HTTPS services.

For at least minimum control over the Apache, enable the following modules like "mod_authz_host" for access control, "mod_dir" for directory control and "mod_rewrite" for filtering of rogue web entities.

Restrict what Apache would listen on to provide its services. e.g. Listen .

Use group or distribution email address for "ServerAdmin".

Set a timeout limit ("Timeout") for server to fail a request after waiting for a number of seconds. Default is 300.

Limit the number of requests allowed per connection ("MaxKeepAliveRequests") when KeepAlive is on. Default is 100.

Limit the time a server will wait for subsequent request ("KeepAliveTimeout") before terminating the connection. Default is 15 seconds. This one will affect how much resource Apache will hoard.

Enable "mod_deflate" for better throughput especially in high-volume web services.

# Range is 1 (least compression) to 9 (most compression)

DeflateCompressionLevel 6

    # Netscape 4.x has some problems...

    BrowserMatch ^Mozilla/4 gzip-only-text/html

    # Netscape 4.06-4.08 have some more problems

    BrowserMatch ^Mozilla/4\.0[678] no-gzip

    # Only compress for IE 7, 8 or 9 as there are bugs

    # compressing for IE 6 and older

    BrowserMatch \bMSIE(7|8|9) !no-gzip !gzip-only-text/html

    # Don't compress images and pdf

    SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png|pdf)$ no-gzip dont-vary

    # Make sure proxies don't deliver the wrong content

    Header append Vary User-Agent env=!dont-vary

To enable compression within the "vhost" or "location" for outgoing traffic.

SetOutputFilter DEFLATE

Set TraceEnable to "off"

Configure the SSLCipherSuite to use only the better cipher, e.g SSLCipherSuite ALL:!ADh:!SSLv2:!EXPORT56:!EXPORT40:!RC4:!DES:+HIGH

Also set SSLProtocol all -SSLv2 to disable SSL version 2.

Remove contents in cgi-bin, htdocs, icons, extra and original if not required.

If you want to hide and mask away Apache identity further, update in ap_release.h to the following


#define AP_SERVER_BASEVENDOR “Restricted Server”
#define AP_SERVER_BASEPRODUCT “Secure Web Server”

Remove the welcome page if it exist.

How to capture network traffic using tcpdump on Sourcefire IDS box

In the usual Linux box, we capture network traffic using tcpdump like below

# tcpdump -i eth0

However, in the Sourcefire IDS box, it appears that the network interface are not configured. See below.


eth0      Link encap:Ethernet  HWaddr 01:0A:0B:FB:CD:39
          BROADCAST MULTICAST  MTU:1518  Metric:1
          RX packets:83477 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:614 (16.5 Mb)  TX bytes:0 (0.0 b)
          Memory:f2e20000-f2e40000


After checking on google, you cant dump on ethX. What you need to do is to dump from fpX instead, where eth0 will have the corresponding fp0, eth1 will have fp1 and so on.

Thats it.

Blocking Rogue Scanners in Apache

Backgound

Exploring the use of mod_rewrite in Apache to block vulnerability scanners, scripties, exploit scanners and other black hats. Was wondering if the following is enough, hope that someone whose got experience in this can give some comments. :)

The Codes

#
# Hardened Apache Mod_Rewrite Security Rule
#
RewriteEngine on

#
# Known Web vulnerabilty Scanners
#
RewriteCond %{HTTP_USER_AGENT} ^.*(syhunt|sqlmap|WhatWeb|Netsparker|w3af|Nstalker|acunetix|qualys|nikto|wikto|pikto|pykto).* [NC]
RewriteRule .* - [F]


#
# Random Underground Web Exploit Scanners
#
RewriteCond %{HTTP_USER_AGENT} ^.*(04\/XP|2search|3653Client|ActMon|adfsgecoiwnf|adlib|AdTools|Agentcc|AHTTPConnection|al|Aldi|Alerter|API\sGuide\stest\sprogram|Arrow\sSearch|asd|AskInstallChecker|Async\sHTTP\sAgent|Atomic\_Email\_Hunter|AutoHotkey|AutoIt|Avzhan\sDDoS\sBot|BGroom|Binget\sPHP\sLibrary|BlackSun\BOT\/0\.1|Brontok|Browser\sPal|Brutus\sAET|BysooTB|Casino|changhuatong|CholTBAgent|cibabam|ClickAdsByIE|CodeguruBrowser|core\-project|CPUSH\_HOMEPAGE|CPUSH\_UPDATER|ctwopop|darkness|DataCha0s|Delphi|DigExt|DMFR|Downloader1|DriveCleaner\sUpdater|Duckling|dwplayer|eAnthMngr|ed2k\sedonkey2000\sruntime\sdetection|EI|EmailSiphon|ErrCode|ErrorFix|ewBrandTest|EzReward|Feat2\sUpdater|Flag|Flame|Flipopia|FPRecover|FPUpdater|FSD|FSW|GabPath|gbot|Godzilla|Google\sbot|GPInstaller|GPRecover|GPUpdater|Hardcore\sSoftware|http\sprotocol|HTTP\sWininet|HTTPCSDCENTER|iamx|iebar|IEP|IEToolbar|iexp\-get|iMeshBar|INet\s\-\sWin32\.Virus\.Jusabli\.A|InfoBot|Install\sStub|Installer|IST|istsvc|javasw\s\-\sTrojan\.Banload|Known\sSkunkx\sDDOS\sBot|Lizard|Lotto|MacProtector|Macrovision\_DM\_2\.4\.15|malware|MBVDFRESCT|mdms|me0hoi|meterpreter|MGS\-Internal\-Web\-Manager|Mirar\_KeywordContentHijacker|Morfeus|Morfeus\sScanner|Moxilla|Mozilla\/\/4\.0|Mozzila|MSDN\sSurfBear|msndown|Museon|My\sAgent|MyApp|MyBrowser|MyLove|MYURL|MyWay|MyWebSearchSearchAssistance|Navhelper|Need2Find|NOKIAN95\/WEB|NSIS\_DOWNLOAD|NSIS\_Inetc|NSIS\_INETLOAD|NSISDL|OCInstaller|OCRecover|Oncues|Opera\/8\.89\s\-\sP2P\-Worm\.Win32\.Palevo\.ddm|Opera\/9\.80\sPesto\/2\.2\.15|OSSProxy|Our\_Agent|Pass|Pcast\sLive|PcPcUpdater|pcsafe|PinballCorp\-BSAI\/VER\_STR\_COMMA|PoisonIvy\sRAT|poller|Popup\sStopper|PrivacyInfoUpdate|ProxyDown|psi|PyCurl|qixi|QvodDown|RAbcLib|random|RAV1|RCleanT|REKOM|Remote\s\-\sWin32\/Babmote\.A|Revolution\sWin32|RookIE|SAcc|SAH\sAgent|ScrapeBox|Se2011|Search\sToolbar|SelectRebates|Setup\sFactory|sgrunt|Shareaza|shprrprt\-cs\-|SimpleClient|smrtshpr\-cs|snprtzdialno|spam\_bot|SpamBlockerUtility|Spedia|SpeedRunner|SpyDawn|Spy\-Locked|SpywareStrike|SQTR\_VERIFY|STORMDDOS\s\-\sBackdoor\.Win32\.Inject\.ctt|String\s\(AskPartnerCobranding\)|Strip\-Player|Stubby|StubInstaller|SysCleaner|TCYWinHTTPDownload|Tear\sApplication|TeomaBar|test\_hInternet|Tiny|TM\_SEARCH3|Travel\sUpdate|Trololo|URLBlaze|UtilMind\sHTTPGet|vaccinepc|VB\sWININET|VCTestClient|VERTEXNET|Viper|VMozilla|vyre32|W32\/Fujacks\.htm|WakeSpace|wget\s3\.0|WHCC\/|Win32|Win32\sAmti|Win32\/Ferabsa\.A|WinFix\sMaster|WMUpdate|WSEnrichment|YZF|Zango|Installer|ZC\-Bridge|zeroup|ZmEu|ZOMBIES\_HTTP\_GET).* [NC]
RewriteRule .* - [F]

#
# Denial-of-Service Tool
#
RewriteCond %{HTTP_USER_AGENT} ^.*(ApacheBench).* [NC]
RewriteCond %{HTTP_USER_AGENT} ^.*(WWW\-Mechanize|revolt|Crawl|Mail\.Ru|Walker|sbide|findlinks|spide|Ace\sExplorer|winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner).*  [NC]
RewriteRule .* - [F]

RewriteLogLevel 2
RewriteLog logs/rewrite.log

More Questions

What if the scanners change their user-agent strings? Should i change the way to block these scanners instead? e.g. access string?


I get 403 in the access log files but inside rewrite.log, it just say which rule is invoked but didn't record the user-agent string detected. Is there a way to increase verbosity without going too high in the RewriteLogLevel?

Apache on Windows cant start because of SSLSessionCache error

Received a call that a new setup of Apache could not start up no matter how she tweak the configurations.

She is on MS Windows Server 64bit, Apache 2.2.24 64 bit, etc, etc..

Event log:















Another event log that points the exact problem.


















As i administer a large set of servers that are of different flavours, first i did a comparison between the UNIX httpd.conf and this Windows one. Noticed that there is this chuck "(x86)" is in the windows configuration file.

Microsoft used this (x86) string to differentiate between 64bit and 32bit programs and Apache is unable to interpret it.

In the UNIX world, we can usually use escaping to workaround but i'm not sure if this can work in windows world as setting to 8.3 format using \~1 or \~2 does not work 100% of the time.

In the end, just advise her to point the path to another path that does not have any parenthesis. The Apache work like a charm.

Job done!

How to list the top 5 largest directories

# du -sk /opt/* | sort +0nr | head -5
25456556        /opt/data
12634192        /opt/read
5483564 /opt/download
196104  /opt/scripts
132964  /opt/freeware

tip.. if you want to include the hidden files and directories, try this.

# du -sk .[a-z]* * | sort +0nr | head -5

How to un-mount a volume forcefully

If you ever want to unmount a volume forcefully when the system does not allow, you need to find out who is holding on to the resource, terminate it and then unmount. This is very important to prevent data loss.

Who is holding on to the volume

# lsof | grep "/opt/download"


# fuser -cu /opt/data/System.log

Now terminate them

# kill -9

The PID will be determined from the fuser or lsof command above.

Now unmount the volume peacefully

# umount /opt/download

If you disregard who's active and want to unmount right away,

  # fuser -km /opt/download

In case, you want to unmount a NFS volume that is unreachable, try this.

# umount -f /opt/download

Done...

How to retrieve the list of failed logins in AIX

short and sharp.

# /usr/sbin/acct/fwtmp < /etc/security/failedlogin  | more

How to modify permission for queue on MS MQ

Recently, a request was made to modify the permission on a queue on MS MQ. Has been administering IBM Websphere MQ so this one is new to me.

Failed attempt

Open up Computer Management console, navigated to the queues under services and application, right click to the security properties and started tweaking.


Ops. System says "Access to Message Queuing System is denied" that essential mean i do not have the rights. Probably administrator account was not used to create the queues? So how?

Found the solution!

Turn out that i just need to click "Advanced" from the security tab, then go to the owner tab, take over control using administrator account, apply and ok. Going back to assign permission to the queue now is OK.

Done. :D

Default password in Websphere Application Server plug-in for Apache expiry

If you are using the key store installed by default on your web server for the Websphere Application Server plug-in and that you have never  changed the key store's password, you will hit the following problem.

[root@server ]# gsk7capicmd_64 -keydb -expiry -db ./plugin-key.kdb -pw WebAS
Validity:  Thursday, 26 April 2012 23:20:31 PM SGT

Do note that default password for the key DB is "WebAS".

To resolve this issue, you can just change the password without setting the expiry date.

Here's the steps that i used. (only CLI since i don't usually access UI.)

Get your LD library path

[root@server ]# export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/IBM/WebSphere/Plugins/gsk7/gsk7_64/lib64/

Check that the Key DB really expired

 [root@server ]# gsk7capicmd_64 -keydb -expiry -db ./plugin-key.kdb -pw WebAS
Validity:  Thursday, 26 April 2012 23:20:31 PM SGT

Let's change the password. Take note that you must stash the key for the password to be saved.

[root@server ]# gsk7capicmd_64 -keydb -changepw -pw WebAS -new_pw WebAS2 -stash -db plugin-key.kdb

If you really fancy, change the password back. (But i don't recommend this as this pose a big security risk!)

[root@server ]# gsk7capicmd_64 -keydb -changepw -pw WebAS2 -new_pw WebAS -stash -db plugin-key.kdb

Let's verify.

[root@server ]# gsk7capicmd_64 -keydb -expiry -db ./plugin-key.kdb -pw WebAS
Validity:  0


We are now done with the password change.

IBM Reference: http://www-01.ibm.com/support/docview.wss?uid=swg21579757

AIX su restriction using sugroup

In AIX, we can restrict who can access a particular user account using the SUGROUP parameter.

Background

Using the below example to explain.

We have normal user account ‘user1’.

We are going to create the admin account for ‘user1’, this account is ‘admin1’.

We do not want to allow any NON-admin to access ‘admin1’, hence we use SUGROUP to restrict. Here, I used ‘admingrp’ group since all admin are in this group.

Not to worry if another DBA access ‘admin1’ since /var/log/authlog would show who used that account. Below example log showed someone using root accessing ‘user2’ account before using ‘admin1’.

devserver:/:>tail -2 /var/log/authlog

Feb 14 10:12:11 devserver auth|security:notice su: from root to user2 at /dev/pts/0

Feb 14 10:12:15 devserver auth|security:notice su: from user2 to admin1 at /dev/pts/0

Parameters and Procedure

The account creation via smitty in its entirety. Further notes

-          Requirement is ‘admin1’ should be member of the group ‘appgrp’ is in so that he can access files in appgrp.

-          Also ‘admin1’ needs to be member of staff group to access ‘user1’ files.

-          Since this is a privilege account, we set the following

o   No remote login (SSH, telnet, etc)

o   No local login (physical, console)

o   Shorter account expiry

-          SU GROUP set to ‘admingrp’

 If you want to user command line, which I don’t really recommend unless you script.

devserver:/:>mkuser "id=11705" "pgrp=appgrp" "groups=appgrp,staff" "home=/home/admin1" "shell=/usr/bin/bash" "gecos=name name name" "login=false" "su=true" "rlogin=false" "admin=false" "sugroups=admingrp" "maxage=5" admin1

devserver:/:>passwd admin1

devserver:/:>pwdadm -c admin1

Result

Remote login will fail.

me@server [~]

~$ssh admin1@devserver

admin1@devserver's password:

Received disconnect from 10.10.50.10: 2: Remote login for account admin1 is not allowed.

Access to root will fail.

devserver:/:>su -user1

$ su - admin1

admin1's Password:

-bash-3.2$ su -

root's Password:

You are not allowed to su to this account.

Cannot su to "root" : Account is not accessible.

Non admin will not be able to access this account.

me@devserver [~]

~$su - admin1

admin1's Password:

You are not allowed to su to this account.

Cannot su to "admin1" : Account is not accessible.

Another admin can access this account.

devserver:/:>su - user2

$ su - admin1

admin1's Password:

-bash-3.2$ id

uid=11705(admin1) gid=101(appgrp) groups=1(staff)