Cybersecurity

What is Cybersecurity?

Security (for Information and Communication Technology, or aka ICT) is concerned about ensuring the protection of computer systems (IT, OT, IoT, etc) in such a way that the functions of the system is not impeded. It should protect the system against both accidental and malicious attacks, whether these are natural or man-made in origin.

Security should be comprehensive enough to protect the system from both digital and physical attacks. We shouldn't focus on protecting from digital attacks and forget about the physical portion. For example, you have a lot of precious photos in your computer. You have anti-virus, up-to-date patches, and switch off the network connection when not in use. You think you are safe. Have you catered for hardware failure or accidental coffee spills?

Like how we maintain our health, there is no way to guarantee a system to be 100% safe after improving security for the systems. We can eat very healthily, exercise regularly, and sleep well, but we all know for sure, this don't guarantee we won't fall sick. Likewise, we can apply the most sophisticated or even the most expensive security implementations to protect the system, we can never be sure the system is 100%. We can only try to minimise the chance of an attack or a breach from occurring, and if it ever occurs, we try to minimise the consequence of an attack or a breach.

So cyber security is security for cyber.:P Whether cyber or not, i believe security should apply across the whole ICT, save for some differences in mitigating treatment for some areas.

What are the aspect of security are we concerned about?

There are many different models available that can be used for security. CIA is one popular model, taught in almost all security courses and schools.

C - Confidentiality, which is concerned about allowing access to the system or data only to authorised party.

I - Integrity, which is concerned about allowing modification to the system or data only to authorised party.

A - Availability, which is concerned about guaranteeing the reliable access to the information only by authorised party.

CIA is a basic model but we can extend it to include the following, or more:

Authenticity - verifying the identity of the entity that wants to interact with the system or data.

Authorisation - specifying the permission for accessing the system or data. Usually it is preceded by authentication, especially in software defined parameter framework.

Non-repudiation - providing assurance that the sender of information is provided with proof of delivery and the recipient is provided with the proof of sender's identity, so neither can later deny having processed the information.

In other words, when we want to improve security, we think of what are the concerns on these security aspects and how they can affect the security of the systems. We then think of solution to address the concerns. I will find time to write about how to find, evaluate, and address these concerns.

So, what's your view on cybersecurity?

Internal Error in VMware player

Encountered error opening up the VMs in VMware player 6.0.x with "Error while powering on: Internal error"

It turns out that the "VMware Authorization Service" service must be enabled. You may need administrator rights if you are running as a normal user. This problem will happen even if the service is already set as "automatic".

Once the service is started up, the error will go away.

How to prevent MS IIS Content Location Internal IP Address Leak

With reference to http://support.microsoft.com/kb/834141, we would want to fix the issue of IP address being revealed in the content-location field in the TCP header on MS IIS 6.0.

Confirmation that you are affected
- telnet to the web service
- perform "GET / HTTP/1.0"
- press twice.

If you see "Content-Location: http:///Default.htm", you are affected.


To rectify this issue,
- right click on the Website, click on Properties button for logging.
- take note of the Site ID inside Log file name in this "Extended Logging Properties" window. i.e. W3SVC39\exyymmdd.log means your Site ID is 39
- Set the web server to use Host name instead of Host IP. Fire up the command prompt and navigate to C:\Inetpub\AdminScripts\, run the command "csript adsutil.vbs set w3svc//UserHostName true"
- run command "we".

You can then verify by using the telnet test again. Good luck!

How to disable browsable web directory

There is increasingly more cons than pros in allowing browsing access to the web servers' web directories. The black hats could use this to crawl for information or even use this as the gateway to launch an attack.

Here's how to disable web directory browsing on MS IIS. Tested on IIS 6.

- Open up IIS
- select the web site, right click on it and select properties.
- uncheck "Directory Browsing".
- restart web service.

And you are done with configuration. :)

How to enable or require SMB signing for Windows Server

Recently, discovered that some servers are having SMB vulnerabilities, in this case, file sharing on SMB not requiring signing or signing is not enabled.

How do we secure the communications? Here's how.

If you are on Windows NT4.0, Windows 2K and Windows 2k3, go to registry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters
- For SMB signing Required, set Registry key RequireSecuritySignature=1
- For SMB signing Enabled (if server agrees), set Registry key EnableSecuritySignature=1 and RequireSecuritySignature=0
- For SMB signing Disabled (if server agrees), set Registry key EnableSecuritySignature=0 and RequireSecuritySignature=0

If you on Windows 98, go to registry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkStation\Parameters
- For SMB signing Required, set Registry key RequireSecuritySignature=1
- For SMB signing Enabled (if client agrees), set Registry key EnableSecuritySignature=1 and RequireSecuritySignature=0
- For SMB signing Disabled (if client agrees), set Registry key EnableSecuritySignature=0 and RequireSecuritySignature=0

Do note that all registry keys should be of type DWORD.

If you want to set through GPO, set through Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

If you are on Windows 2K8 and 2K12, you should be on SMB2. Configuration is slightly easier. you can go to registry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters
- For SMB2 signing Required, set Registry key RequireSecuritySignature=1
- For SMB2 signing Not required, set Registry key RequireSecuritySignature=0

If you are on Windows Vista and XP or 7, you should be on SMB2. Configuration is slightly easier. you can go to registry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkStation\Parameters
- For SMB2 signing Required, set Registry key RequireSecuritySignature=1
- For SMB2 signing Not required, set Registry key RequireSecuritySignature=0

Replacing SSL certificate for HPSMH

This is for replacing the SSL certificate used in HP SMH aka "System Management Homepage", especially after a few round of SSL issues coming from openssl to SSLv3.

The steps are as follows

Step 1
- Logon to HPSMH
- Click from the menu, "Settings" -> "Security" -> "Local Server Certificate"
- Fill up the necessary fields. (Alternative Names should be FQDN)

Step 2
- Logon to the server
- copy the content in req_cr.pem file. (should be in C:\hp\sslshare by default i think)

Step 3
- Register the CSR with your CA to obtain the final X509 certificate (Base 64 encoded in PEM format)

Step 4
- Replace the new certificate over the existing cert.pem (if any).
- Restart HPSMH service.


reference: http://www.admin-enclave.com/en/solutions/windows/47-replace-the-ssl-certificate-for-hp-system-management-homepage-with-a-ca-generated-one.html

How to capture network traffic for analysis in Linux

While working to verify some windows setting, i had to capture the network traffic and confirm that the setting is in place. This steps below may help you as much as it did for me. :)

Capturing the network traffic

We can use our favourite packet capture tool to capture the network traffic between the source and destination hosts. Here, i will demonstrate both using the plain vanilla 'tcpdump' and 'tethereal' tool.

  # tcpdump -vvXX port 445 -w /dir_path/file_name

  # tethereal -p -w /dir_path/file_name port 445

You can see that i'm trying to capture as much data as i can although it may be excessive but it may be worthwhile if you find that you need those data later on.

Once you have the above in placed, you can then fire off the traffic that you want to capture. As in above example, i'm trying to capture SMB traffic.

Trigger the traffic

In this demonstration, i will use 'nmap' to trigger the SMB traffic.

  # nmap --script smb-security-mode.nse 192.168.1.1

You should see the 'tcpdump' output reporting that some traffic are captured.

[root@server ~]# tethereal -p -w /tmp/smb.capture port 445
Capturing on bond0
12

Below is the output for 'tethereal'. Your output should be similar.

[root@server ~]# tcpdump -vvXX port 445 -w /tmp/smb.capture
tcpdump: listening on bond0, link-type EN10MB (Ethernet), capture size 96 bytes
12 packets captured
0 packets received by filter
0 packets dropped by kernel

Display the network traffic for analysis

Now that the traffic has been captured, time to display them.
If you are using 'tcpdump', you may have to use another tool to analyse the network traffic as there is no functionality built in to decode the protocol that you are looking at.


To display using 'tcpdump', try this.

  # tcpdump -vvXX  -r /tmp/smb.capture

Here, you may want to use a free, online tool at [http://sadjad.me/phd/]. This is literally a packet HEX decoder. you need to copy out those HEX for a particular packet into the webpage and click 'decode'. After that, just click on the result to expand and read the information that is decoded.

If you are using 'tethereal', try this instead.

  # tethereal -Vx -r /tmp/smb,capture  | more

Yes, i was trying to find out if the SMB protocol was set to encrypted plus signing enabled + signing required. Here's the essential part of the output.

        Security Mode: 0x0f
            .... ...1 = Mode: USER security mode
            .... ..1. = Password: ENCRYPTED password. Use challenge/response
            .... .1.. = Signatures: Security signatures ENABLED
            .... 1... = Sig Req: Security signatures REQUIRED

Thats all folks!

How to Open Two Excel Files to work on Side by Side

Opening two separate Excel files to work on side by side

Sometimes, we want to have the flexibility to work on excel files side by side, not within the excel application but on 2 separate excel applications.

how do we go about doing that?

[Option A] Configure Excel first

In Excel 2007/2010, click on Office button, then Excel Options, then Advanced Tab
Under General section,  check ‘Ignore other applications that use Dynamic Data Exchange’.
This method forces each Excel file as a separate instance, the memory consumption will be more. If you have memory constrain (maybe less than 512Mb of memory in computer?), may want to use option B.

[NOTE] If you have issues like excel opens but cant display a workbook, you may not use this option. .

[Option B] Open another instance of Excel

Since we want to have each worksheet in separate instances, say one Excel file in Monitor 1 and another in Monitor 2, you can go through the Start Menu ->Programs -> Microsoft Office -> Excel. Alternatively, you can right click on the shortcut and click the "Microsoft Office Excel 2007". This will also open a separate instance of Excel.
Now you can place the 2 workbooks on 2 separate monitors or as you fancy.

[NOTE] In Excel 2013, It appears that you do not need to configure anything and you can have separate instances already. :)

How to find the location of the current file in Office 2007/2010

In office 2007/2010, this is called “Document Location”.

Here’s how to enable it.

1) Click on the pull down menu on the top left of the window box (beside the Microsoft Office, save, undo, redo buttons) then click on “More commands”

2) Look for the “Document Location” and add it.

3) Click ok and you are done. The address is on the top left of the window box.

You can do this for word / excel / ppt.

Enjoy!

Some tips on setting up for Apache 2.2

Here's some of the things i used to set up and harden my Apache, with both performance and security in mind.
This serve as a brain dump and hopefully it help you.

ServerTokens to set from default "Full" to "Prod" so that amount of information shown by Apache is reduced.

ServerSignature to remain as default "Off" to disable version and patch level display

keepAlive to remain as default "On" so that long-lived HTTP sessions will be allowed for multiple requests to be sent over the same TCP connections.

AllowOverride to set from default "All" to "None" to prevent users from setting up .htaccess files which can override default security features.

ScriptAlias is to be commented and to disable the use of cgi-bin. Recommended to use "Directory", "SetHandler" and "Options" instead if required.

To place the "%D" (time taken to serve the request, in microseconds) in Log format. It will be helpful during troubleshooting time.

Only recommend to compile mod_ssl statiscally into Apache core. This is more for performance since nowsaday, we rely more on HTTPS services.

For at least minimum control over the Apache, enable the following modules like "mod_authz_host" for access control, "mod_dir" for directory control and "mod_rewrite" for filtering of rogue web entities.

Restrict what Apache would listen on to provide its services. e.g. Listen .

Use group or distribution email address for "ServerAdmin".

Set a timeout limit ("Timeout") for server to fail a request after waiting for a number of seconds. Default is 300.

Limit the number of requests allowed per connection ("MaxKeepAliveRequests") when KeepAlive is on. Default is 100.

Limit the time a server will wait for subsequent request ("KeepAliveTimeout") before terminating the connection. Default is 15 seconds. This one will affect how much resource Apache will hoard.

Enable "mod_deflate" for better throughput especially in high-volume web services.

# Range is 1 (least compression) to 9 (most compression)

DeflateCompressionLevel 6

    # Netscape 4.x has some problems...

    BrowserMatch ^Mozilla/4 gzip-only-text/html

    # Netscape 4.06-4.08 have some more problems

    BrowserMatch ^Mozilla/4\.0[678] no-gzip

    # Only compress for IE 7, 8 or 9 as there are bugs

    # compressing for IE 6 and older

    BrowserMatch \bMSIE(7|8|9) !no-gzip !gzip-only-text/html

    # Don't compress images and pdf

    SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png|pdf)$ no-gzip dont-vary

    # Make sure proxies don't deliver the wrong content

    Header append Vary User-Agent env=!dont-vary

To enable compression within the "vhost" or "location" for outgoing traffic.

SetOutputFilter DEFLATE

Set TraceEnable to "off"

Configure the SSLCipherSuite to use only the better cipher, e.g SSLCipherSuite ALL:!ADh:!SSLv2:!EXPORT56:!EXPORT40:!RC4:!DES:+HIGH

Also set SSLProtocol all -SSLv2 to disable SSL version 2.

Remove contents in cgi-bin, htdocs, icons, extra and original if not required.

If you want to hide and mask away Apache identity further, update in ap_release.h to the following


#define AP_SERVER_BASEVENDOR “Restricted Server”
#define AP_SERVER_BASEPRODUCT “Secure Web Server”

Remove the welcome page if it exist.

How to capture network traffic using tcpdump on Sourcefire IDS box

In the usual Linux box, we capture network traffic using tcpdump like below

# tcpdump -i eth0

However, in the Sourcefire IDS box, it appears that the network interface are not configured. See below.


eth0      Link encap:Ethernet  HWaddr 01:0A:0B:FB:CD:39
          BROADCAST MULTICAST  MTU:1518  Metric:1
          RX packets:83477 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:614 (16.5 Mb)  TX bytes:0 (0.0 b)
          Memory:f2e20000-f2e40000


After checking on google, you cant dump on ethX. What you need to do is to dump from fpX instead, where eth0 will have the corresponding fp0, eth1 will have fp1 and so on.

Thats it.

Blocking Rogue Scanners in Apache

Backgound

Exploring the use of mod_rewrite in Apache to block vulnerability scanners, scripties, exploit scanners and other black hats. Was wondering if the following is enough, hope that someone whose got experience in this can give some comments. :)

The Codes

#
# Hardened Apache Mod_Rewrite Security Rule
#
RewriteEngine on

#
# Known Web vulnerabilty Scanners
#
RewriteCond %{HTTP_USER_AGENT} ^.*(syhunt|sqlmap|WhatWeb|Netsparker|w3af|Nstalker|acunetix|qualys|nikto|wikto|pikto|pykto).* [NC]
RewriteRule .* - [F]


#
# Random Underground Web Exploit Scanners
#
RewriteCond %{HTTP_USER_AGENT} ^.*(04\/XP|2search|3653Client|ActMon|adfsgecoiwnf|adlib|AdTools|Agentcc|AHTTPConnection|al|Aldi|Alerter|API\sGuide\stest\sprogram|Arrow\sSearch|asd|AskInstallChecker|Async\sHTTP\sAgent|Atomic\_Email\_Hunter|AutoHotkey|AutoIt|Avzhan\sDDoS\sBot|BGroom|Binget\sPHP\sLibrary|BlackSun\BOT\/0\.1|Brontok|Browser\sPal|Brutus\sAET|BysooTB|Casino|changhuatong|CholTBAgent|cibabam|ClickAdsByIE|CodeguruBrowser|core\-project|CPUSH\_HOMEPAGE|CPUSH\_UPDATER|ctwopop|darkness|DataCha0s|Delphi|DigExt|DMFR|Downloader1|DriveCleaner\sUpdater|Duckling|dwplayer|eAnthMngr|ed2k\sedonkey2000\sruntime\sdetection|EI|EmailSiphon|ErrCode|ErrorFix|ewBrandTest|EzReward|Feat2\sUpdater|Flag|Flame|Flipopia|FPRecover|FPUpdater|FSD|FSW|GabPath|gbot|Godzilla|Google\sbot|GPInstaller|GPRecover|GPUpdater|Hardcore\sSoftware|http\sprotocol|HTTP\sWininet|HTTPCSDCENTER|iamx|iebar|IEP|IEToolbar|iexp\-get|iMeshBar|INet\s\-\sWin32\.Virus\.Jusabli\.A|InfoBot|Install\sStub|Installer|IST|istsvc|javasw\s\-\sTrojan\.Banload|Known\sSkunkx\sDDOS\sBot|Lizard|Lotto|MacProtector|Macrovision\_DM\_2\.4\.15|malware|MBVDFRESCT|mdms|me0hoi|meterpreter|MGS\-Internal\-Web\-Manager|Mirar\_KeywordContentHijacker|Morfeus|Morfeus\sScanner|Moxilla|Mozilla\/\/4\.0|Mozzila|MSDN\sSurfBear|msndown|Museon|My\sAgent|MyApp|MyBrowser|MyLove|MYURL|MyWay|MyWebSearchSearchAssistance|Navhelper|Need2Find|NOKIAN95\/WEB|NSIS\_DOWNLOAD|NSIS\_Inetc|NSIS\_INETLOAD|NSISDL|OCInstaller|OCRecover|Oncues|Opera\/8\.89\s\-\sP2P\-Worm\.Win32\.Palevo\.ddm|Opera\/9\.80\sPesto\/2\.2\.15|OSSProxy|Our\_Agent|Pass|Pcast\sLive|PcPcUpdater|pcsafe|PinballCorp\-BSAI\/VER\_STR\_COMMA|PoisonIvy\sRAT|poller|Popup\sStopper|PrivacyInfoUpdate|ProxyDown|psi|PyCurl|qixi|QvodDown|RAbcLib|random|RAV1|RCleanT|REKOM|Remote\s\-\sWin32\/Babmote\.A|Revolution\sWin32|RookIE|SAcc|SAH\sAgent|ScrapeBox|Se2011|Search\sToolbar|SelectRebates|Setup\sFactory|sgrunt|Shareaza|shprrprt\-cs\-|SimpleClient|smrtshpr\-cs|snprtzdialno|spam\_bot|SpamBlockerUtility|Spedia|SpeedRunner|SpyDawn|Spy\-Locked|SpywareStrike|SQTR\_VERIFY|STORMDDOS\s\-\sBackdoor\.Win32\.Inject\.ctt|String\s\(AskPartnerCobranding\)|Strip\-Player|Stubby|StubInstaller|SysCleaner|TCYWinHTTPDownload|Tear\sApplication|TeomaBar|test\_hInternet|Tiny|TM\_SEARCH3|Travel\sUpdate|Trololo|URLBlaze|UtilMind\sHTTPGet|vaccinepc|VB\sWININET|VCTestClient|VERTEXNET|Viper|VMozilla|vyre32|W32\/Fujacks\.htm|WakeSpace|wget\s3\.0|WHCC\/|Win32|Win32\sAmti|Win32\/Ferabsa\.A|WinFix\sMaster|WMUpdate|WSEnrichment|YZF|Zango|Installer|ZC\-Bridge|zeroup|ZmEu|ZOMBIES\_HTTP\_GET).* [NC]
RewriteRule .* - [F]

#
# Denial-of-Service Tool
#
RewriteCond %{HTTP_USER_AGENT} ^.*(ApacheBench).* [NC]
RewriteCond %{HTTP_USER_AGENT} ^.*(WWW\-Mechanize|revolt|Crawl|Mail\.Ru|Walker|sbide|findlinks|spide|Ace\sExplorer|winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner).*  [NC]
RewriteRule .* - [F]

RewriteLogLevel 2
RewriteLog logs/rewrite.log

More Questions

What if the scanners change their user-agent strings? Should i change the way to block these scanners instead? e.g. access string?


I get 403 in the access log files but inside rewrite.log, it just say which rule is invoked but didn't record the user-agent string detected. Is there a way to increase verbosity without going too high in the RewriteLogLevel?

Apache on Windows cant start because of SSLSessionCache error

Received a call that a new setup of Apache could not start up no matter how she tweak the configurations.

She is on MS Windows Server 64bit, Apache 2.2.24 64 bit, etc, etc..

Event log:















Another event log that points the exact problem.


















As i administer a large set of servers that are of different flavours, first i did a comparison between the UNIX httpd.conf and this Windows one. Noticed that there is this chuck "(x86)" is in the windows configuration file.

Microsoft used this (x86) string to differentiate between 64bit and 32bit programs and Apache is unable to interpret it.

In the UNIX world, we can usually use escaping to workaround but i'm not sure if this can work in windows world as setting to 8.3 format using \~1 or \~2 does not work 100% of the time.

In the end, just advise her to point the path to another path that does not have any parenthesis. The Apache work like a charm.

Job done!

How to list the top 5 largest directories

# du -sk /opt/* | sort +0nr | head -5
25456556        /opt/data
12634192        /opt/read
5483564 /opt/download
196104  /opt/scripts
132964  /opt/freeware

tip.. if you want to include the hidden files and directories, try this.

# du -sk .[a-z]* * | sort +0nr | head -5

How to un-mount a volume forcefully

If you ever want to unmount a volume forcefully when the system does not allow, you need to find out who is holding on to the resource, terminate it and then unmount. This is very important to prevent data loss.

Who is holding on to the volume

# lsof | grep "/opt/download"


# fuser -cu /opt/data/System.log

Now terminate them

# kill -9

The PID will be determined from the fuser or lsof command above.

Now unmount the volume peacefully

# umount /opt/download

If you disregard who's active and want to unmount right away,

  # fuser -km /opt/download

In case, you want to unmount a NFS volume that is unreachable, try this.

# umount -f /opt/download

Done...

How to retrieve the list of failed logins in AIX

short and sharp.

# /usr/sbin/acct/fwtmp < /etc/security/failedlogin  | more

How to modify permission for queue on MS MQ

Recently, a request was made to modify the permission on a queue on MS MQ. Has been administering IBM Websphere MQ so this one is new to me.

Failed attempt

Open up Computer Management console, navigated to the queues under services and application, right click to the security properties and started tweaking.


Ops. System says "Access to Message Queuing System is denied" that essential mean i do not have the rights. Probably administrator account was not used to create the queues? So how?

Found the solution!

Turn out that i just need to click "Advanced" from the security tab, then go to the owner tab, take over control using administrator account, apply and ok. Going back to assign permission to the queue now is OK.

Done. :D

Default password in Websphere Application Server plug-in for Apache expiry

If you are using the key store installed by default on your web server for the Websphere Application Server plug-in and that you have never  changed the key store's password, you will hit the following problem.

[root@server ]# gsk7capicmd_64 -keydb -expiry -db ./plugin-key.kdb -pw WebAS
Validity:  Thursday, 26 April 2012 23:20:31 PM SGT

Do note that default password for the key DB is "WebAS".

To resolve this issue, you can just change the password without setting the expiry date.

Here's the steps that i used. (only CLI since i don't usually access UI.)

Get your LD library path

[root@server ]# export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/IBM/WebSphere/Plugins/gsk7/gsk7_64/lib64/

Check that the Key DB really expired

 [root@server ]# gsk7capicmd_64 -keydb -expiry -db ./plugin-key.kdb -pw WebAS
Validity:  Thursday, 26 April 2012 23:20:31 PM SGT

Let's change the password. Take note that you must stash the key for the password to be saved.

[root@server ]# gsk7capicmd_64 -keydb -changepw -pw WebAS -new_pw WebAS2 -stash -db plugin-key.kdb

If you really fancy, change the password back. (But i don't recommend this as this pose a big security risk!)

[root@server ]# gsk7capicmd_64 -keydb -changepw -pw WebAS2 -new_pw WebAS -stash -db plugin-key.kdb

Let's verify.

[root@server ]# gsk7capicmd_64 -keydb -expiry -db ./plugin-key.kdb -pw WebAS
Validity:  0


We are now done with the password change.

IBM Reference: http://www-01.ibm.com/support/docview.wss?uid=swg21579757

AIX su restriction using sugroup

In AIX, we can restrict who can access a particular user account using the SUGROUP parameter.

Background

Using the below example to explain.

We have normal user account ‘user1’.

We are going to create the admin account for ‘user1’, this account is ‘admin1’.

We do not want to allow any NON-admin to access ‘admin1’, hence we use SUGROUP to restrict. Here, I used ‘admingrp’ group since all admin are in this group.

Not to worry if another DBA access ‘admin1’ since /var/log/authlog would show who used that account. Below example log showed someone using root accessing ‘user2’ account before using ‘admin1’.

devserver:/:>tail -2 /var/log/authlog

Feb 14 10:12:11 devserver auth|security:notice su: from root to user2 at /dev/pts/0

Feb 14 10:12:15 devserver auth|security:notice su: from user2 to admin1 at /dev/pts/0

Parameters and Procedure

The account creation via smitty in its entirety. Further notes

-          Requirement is ‘admin1’ should be member of the group ‘appgrp’ is in so that he can access files in appgrp.

-          Also ‘admin1’ needs to be member of staff group to access ‘user1’ files.

-          Since this is a privilege account, we set the following

o   No remote login (SSH, telnet, etc)

o   No local login (physical, console)

o   Shorter account expiry

-          SU GROUP set to ‘admingrp’

 If you want to user command line, which I don’t really recommend unless you script.

devserver:/:>mkuser "id=11705" "pgrp=appgrp" "groups=appgrp,staff" "home=/home/admin1" "shell=/usr/bin/bash" "gecos=name name name" "login=false" "su=true" "rlogin=false" "admin=false" "sugroups=admingrp" "maxage=5" admin1

devserver:/:>passwd admin1

devserver:/:>pwdadm -c admin1

Result

Remote login will fail.

me@server [~]

~$ssh admin1@devserver

admin1@devserver's password:

Received disconnect from 10.10.50.10: 2: Remote login for account admin1 is not allowed.

Access to root will fail.

devserver:/:>su -user1

$ su - admin1

admin1's Password:

-bash-3.2$ su -

root's Password:

You are not allowed to su to this account.

Cannot su to "root" : Account is not accessible.

Non admin will not be able to access this account.

me@devserver [~]

~$su - admin1

admin1's Password:

You are not allowed to su to this account.

Cannot su to "admin1" : Account is not accessible.

Another admin can access this account.

devserver:/:>su - user2

$ su - admin1

admin1's Password:

-bash-3.2$ id

uid=11705(admin1) gid=101(appgrp) groups=1(staff)

  

Switching LDAP repository in Websphere Application Server 7

This is to record the steps i used to switch LDAP repository in Websphere Application Server 7 and enabled LDAP over SSL.

Lets Start

Point your browser to the WAS console and login using admin account.

Add in the new LDAP server configurations

As i use a few repositories in my environment, i would be updating the repositories in the "Federated repositories" section.

Click on left column's link: Security -> Global Security -> Configure (the drop down box is pointed to "Federated repositories"

The page refreshed, look for "Manage repositories" -> Add

Fill the following.
- Repository identifier
- Directory type (here, i used IBM TDS)
- Primary hostname (put in IP, if you have the entry in /etc/hosts, can use hostname)
- Port (389 for a start. Later will be updated to 636)
- Bind DN (The account to connect to LDAP server)

Click Apply when you are done. Then Click Save. Wait for sync to finish and click OK.

If there is something wrong, WAS will complain.

i.e.
cannot reach the LDAP server. (ACL/firewall??)
wrong port
Bind DN is wrong
etc

Import LDAP server SSL

 Store the SSL certificate as a flat file in the WAS server. You may need to convert the SSL certificate to "der" format and deposit the certificate to the deployment manager directory.

Create WAS Truststore

We will create the key store in WAS to store keys and certificate for LDAP. Idea is to separate key store for different functions.

By java definition, keystore is an object that holds personal certificate. truststore is a Java object that holds signer certificates. I gather we will only create the truststore since WAS security guide listed this step.

Click Security -> SSL Certificate and key management -> keystores and certificates

Then click New

Fill up the following
- Name (i used LDAPTruststore)
- Management scope (IBM security guide recommended cell level)
- Path (Where you want to store this key store)
- Password

Import the LDAP SSL certiticate into LDAPTruststore

From the breadcrumb of the previous step, Click on "LDAPTruststore" and Signer certificates.


Click Add


Fill up the following
- Alias (i used ldapcert)
- File Name (the path to the LDAP ssl certificate you put in previous step.)


Click Apply when you are done. Then Click Save. Wait for sync to finish and click OK

Creating SSL alias link to the Trust store

We will create Click Security -> SSL certificate and key management -> SSL configuration.

Click New

Fill up the following
- Name (I used LDAPSSLSettings)
- Trust store name (its LDAPTruststore)
- Key store name (its LDAPTruststore)
- Management Scope (Its Cell Level)

Click OK then Save then OK.

We are now ready to enable LDAP over SSL communication to LDAP server

Go back to the repository.

Click Security -> Global Security -> Configure (drop down bar should point to "Federated repositories")

When the page refreshed, Click "Manage repositories"

Fill up the following
- Port (change to 636)

Check the "Require SSL communication"

Choose the radio button "use specific SSL alias" and select LDAPSSLSettings from the drop down menu.

Click Apply when you are done. Then Click Save. Wait for sync to finish and click OK

Add the Base DN

Here, we need to configure from where in LDAP server we should make the queries.

Click Security -> Global Security -> Configure (drop down bar should point to "Federated repositories")

Click the "Add base entry to realm" button

Fill up the following
- Repository (Put in the name you used for "Repository identifier")
- OU (Put in the Base DN here)

Click Apply when you are done. Then Click Save. Wait for sync to finish and click OK 

A little housekeeping

Removethe base DN for the old LDAP server.

Click on the base DN -> remove
Then Click Save. Wait for sync to finish and click OK  

Click on Manage repositories
Check the old repository -> delete
Then Click Save. Wait for sync to finish and click OK  

Restart AppSvr, NodeMgr and Dmgr

To be safe, i would prefer to restart everything and make sure i still can log in as administrator and the application would have no problem working with the new LDAP server.

Check the Dmgr logs, AppSvr logs for signs of errors.

A small test

Click on "users and groups" -> manage users
Search for some valid users and verify that they come from the new LDAP server.
Get the software team to verify too in case the problem is subtle enough not to be caught in the application logs.