What is Heartbleed ?

The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).

Reference URL's :-
http://heartbleed.com/
https://filippo.io/Heartbleed/
http://pastebin.com/WmxzjkXJ

Heartbleed Bug: Assessment Guide by CISCO

Disable sslv2 and weak ciphers for IHS 6

The methods for disabling specific SSL cipher suites vary based on the web server and the underlying operating systems. Microsoft Internet Information Services (IIS):- by editing windows registry, and Apache 2 - by using mod_ssl directives.

When an SSL connection is established, the client (Web browser) and the Web server negotiate the cipher to use for the connection. The Web server has an ordered list of ciphers, and the first cipher in that list which is supported by the client will be selected.

Threat:

The Secure Socket Layer (SSL) protocol allows for secure communication between a client and a server. SSL encryption ciphers are classified based on encryption key length as follows:                                                                          

HIGH - key length larger than 128 bits                                            

MEDIUM - key length equal to 128 bits                                             

LOW - key length smaller than 128 bits                                            

Messages encrypted with LOW encryption ciphers are easy to decrypt.               

Commercial SSL servers should only support MEDIUM or HIGH strength ciphers to guarantee transaction security.  

Solution:  Disable support for LOW encryption ciphers.                            
Apache Typically, for Apache/mod_ssl, httpd.conf or ssl.conf should have the following lines:                                                                
SSLProtocol -ALL +SSLv3 +TLSv1                                                  
SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM

Solution: Change the list of ciphers supported, and add SSLProtocoLDisable SSLv2.

The following configuration directs the server to prefer strong 128-bit RC4 ciphers first and will provide a significant performance improvement over the default configuration. 

This configuration does not support the weaker 40-bit, 56-bit, or NULL/Plaintext ciphers that security scanners might complain about.

The order of the SSLCipherSpec directives dictates the priority of the ciphers, so we order them in a way that will cause IBM HTTP Server to prefer less CPU intensive ciphers.

we can verify the same with the ssldigger utility.

download link - http://www.mcafee.com/us/downloads/free-tools/ssldigger.aspx



Refere the sample httpd.conf (Tested with IHS-6.1)

---Sample httpd.conf-----congigurations starts----
LoadModule ibm_ssl_module modules/mod_ibm_ssl.so
Listen 443

<VirtualHost YourServer:443>
ServerName YourServer
DocumentRoot "D:\IBM\HTTPServer\htdocs\en_US"
SSLEnable
Keyfile "D:\IBM\HTTPServer\ssl\temp\test_cert.kdb"
SSLV2Timeout 100
SSLV3Timeout 1000


## SSLv3 128 bit Ciphers
SSLCipherSpec SSL_RSA_WITH_RC4_128_MD5
SSLCipherSpec SSL_RSA_WITH_RC4_128_SHA

## FIPS approved SSLV3 and TLSv1 128 bit AES Cipher
SSLCipherSpec TLS_RSA_WITH_AES_128_CBC_SHA

## FIPS approved SSLV3 and TLSv1 256 bit AES Cipher
SSLCipherSpec TLS_RSA_WITH_AES_256_CBC_SHA

## Triple DES 168 bit Ciphers
## These can still be used, but only if the client does
## not support any of the ciphers listed above.
SSLCipherSpec SSL_RSA_WITH_3DES_EDE_CBC_SHA

## The following block enables SSLv2. Excluding it in the
## presence of the SSLv3 configuration above disables
## SSLv2 support.

## SSLv2 128 bit Ciphers
SSLCipherSpec SSL_RC4_128_WITH_MD5
SSLCipherSpec SSL_RC4_128_WITH_SHA

## SSLv2 168 bit 3DES cipher
## These can still be used, but only if the client does
## not support any of the ciphers listed above.
SSLCipherSpec SSL_DES_192_EDE3_CBC_WITH_MD5
</VirtualHost>
SSLDisable

---httpd.conf-----congigurations ends----

once the httpd configurations are doen same can be tested by using tool THCSSLCheck.exe
pls find the attached Result files for before the configurations and after the remediations for ihs 6.1



The httpd.conf file is configured correctly with the strong ciphers and weak SSLv2 ciphers are disabled:
The below config will disable SSLv2 ciphers
<VirtualHost *:443>      
    SSLEnable              

    ## Set strong ciphers  
    SSLCipherSpec 3A        
    SSLCipherSpec 34        
    SSLCipherSpec 35

</VirtualHost>
Attached is the Result file after enabling the strong ciphers as mentioned above

THCSSLCheck v0.1Sample logs for IBM IHS 6 for default configurations
THCSSLCheck v0.1Sample logs for IBM IHS 6 after securing web server
THCSSLCheck v0.1Sample logs for IBM IHS 6 after securing web server as per the config mentioned above

IHS SSL Configurations 6.1

IHS SSL Configurations 6.1 using IBM Key Management Utility


Start Key Management Utility
Create New key database along with password protections as shown in below screens

4 files will be created

1) test_cert.kdb
2) test_cert.crl
3) test_cert.rdb
4) test_cert.sth

Now Create / generate a Certificate Request

Select Personal Certificate Request and Click New Request and get the Certificate from Authorized CA and Complete the Server Certificate Request using ikeyman utility.

Step:-1) Personal Certificate Request ( Create CSR )
Step:-2) Signer Certificates ( Get CSR signed by Authorized CA and import Root CA)
Step:-3) Personal Certificates ( Import the Certificate received from CA )

imp note:-> All the signer Certificates must exists in the Key Database before completing the Certificate Request.

httpd modifications

#Enable or Load below module
LoadModule ibm_ssl_module modules/mod_ibm_ssl.so


Listen 443

ServerName mytestserver.com
DocumentRoot "D:\IBM\HTTPServer\htdocs\en_US"
SSLEnable
Keyfile "D:\IBM\HTTPServer\ssl\temp\test_cert.kdb"
SSLV2Timeout 100
SSLV3Timeout 1000

SSLDisable


Restart Http Services and Check https://mytestserver.com/

WebSphere Console Security Implementation

access Link  was http://localhost:9060/ibm/console

Enabling Global Security for WAS IBM Console

Before this copy of these files are taken sothat we can revert back.

select GlobalSecurity
goto LocalOS Tab enter valid system user/pass and save will change the foll file
cells / wwwCell01 / security.xml

SuccessMessage:-
The settings on this panel are not validated until this registry is selected as the Active user registry on the Global Security panel and security is enabled.

Still not asking for the Password
hence goto general tab of global security and check Enable Global Security and with that Enforce Java2 security is by default get checked.
Active User Registry must be local OS

Error Note:-The Lightweight Third Party Authentication (LTPA) password is not set. Validation failed.
hence password this also set as same as local os Password Administrator/Password
Changes Done to :- cells / wwwCell01 / security.xml

After All these  Changes u will hav to Restart the DManager for the changes to take effect.

Now after Enabling the Security the Access Link is

https://localhost:9043/ibm/console/logon.jsp

Tested all the activity like Server 1 Started ok and working fine.

Internet Information Server returns IP address in HTTP header

Note:- This procedure is applicable to IIS6 Only It is tested, but test in Test Environment B4 going on to Prod Server.set the name that you want to display it can be PublicIP/AnySiteName by using the Param SetHostName as shown below, with the command results.

CMD:cscript.exe adsutil.vbs set w3svc/1/SetHostName www.MyTestSite.com
CMD:-Results are mentioned below

Above results can be cross checked or verified by using either HTTP HEAD Params or directly by trying the below script, and belive me it will not reveil the Server Private IP thro/over the Internet
No need to stop start the IIS Server also.


CMD:-cscript adsutil.vbs enum /w3svc/1
CMD:-Results are mentioned below

The other useful info is like /w3svc/1 where 1 is the siteid and if more then 1 site are deployed on to your server then by appending that siteid details about the same can be viewed.
Here 1 is the SiteID for the Default web site for Windows IIS server.
CMD:- cscript adsutil.vbs enum w3svc/SiteID

And apart from all this stuff the simplest way to hide your server information thro' the Http Header is to stop the Default WebSite or Do Not Host your website with the Default Site always create a new site with minimal requirements.

Server certificate rejected by ChainVerifier (SSL Error with TIBCO BW 5.3)

An IOException was thrown while trying to execute the Http method caused by: java.io.IOException: Failed to create secure client socket: Server certificate rejected by ChainVerifier

Simple Steps to make your TOMCAT Run on HTTPS using KEYTOOL utility

1). keytool -genkey -alias www.mytest.com -keyalg RSA -keysize 2048 -keystore www_mytest_com.jks

2). keytool -certreq -alias www.mytest.com -file www_mytest_com.csr -keystore www_mytest_com.jks

3). keytool -import -trustcacerts -alias www.mytest.com -file D:\www_mytest_com.p7b -keystore www_mytest_com.jks
This will install Certificate and the Root Certificate associated with the same., sometimes this will not work and in that case try the below steps.

3.1). keytool -import -alias www.mytest.com -file D:\www_mytest_com.cer -keystore www_mytest_com.jks
3.2). keytool -import -trustcacerts -file D:\www_mytest_com_root.cer -keystore www_mytest_com.jks

4). Modify server.xml and Restart TOMCAT SERVER
 <Connector port="443" maxHttpHeaderSize="8192"
    maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
    enableLookups="false" disableUploadTimeout="true"
    acceptCount="100" scheme="https" secure="true"
    clientAuth="false" keyAlias="www.mytest.com"
    keystoreFile="C:\Program Files\Java\jre6\bin\www_mytest_com.jks"
    keypass="changeit"/>

**Note: By default Tomcat will look for your Keystore with the file name .keystore in the home directory with the default password changeit. The home directory is generally /home/user_name/ on Unix and Linux systems, and C:\Documents and Settings\user_name\ on Microsoft Windows systems

**TIBCO Admin Console needs certificate in PEM format and here is the method to export your CERT into PEM

exportcert - This option is available with JRE-1.6 if u r using JRE-1.5 then simply try export option and it will export the cert into the PEM format.

keytool -exportcert -alias www.mytest.com -keypass changeit -keystore www_mytest_com.jks -rfc -file keytool_www_mytest_com.pem -storepass changeit

Useful links @ Tibco SSL Certificates
http://www.tibcommunity.com/docs/DOC-2178
http://www.tibcommunity.com/docs/DOC-2195

Tomcat 6 - Discloses username="tomcat" password="s3cret" roles="manager"

Tomcat 6 - Discloses username="tomcat" password="s3cret" roles="manager"

Custom Error page configurations not working with Tomcat 6.x and while using the Manager application of tomcat if user tries the invalid username / passwords it discloses the 401 unauthorized page as shown below.

to manage the issue either disable the Manager application or modify the error page so that  username="tomcat" password="s3cret" roles="manager" this string can be avoided and for the same comment out the below code of the 401.jsp file located at D:\ApacheSoftwareFoundation\Tomcat6.0\webapps\manager and restart the tomcat and you are done.

<pre>
&lt;role rolename="manager"/&gt;
&lt;user username="tomcat" password="s3cret" roles="manager"/&gt;
</pre>