How to setup Secure FTP server and process with Core FTP client SSL

Secure FTP Client KeyPair Generation and Connection Process:

 First Create New_Site

 Give the Site Name and Ip Address to Which client need to connect

 

  Beside to the Ip Address Text box, we have the Advance Button

 

  Click the Advance button and select SSH option

   

1)      provide the Key file ,password and click Ok.

2)      If you don’t have the Key File ,click the button Generate Key.

  After Clicking the Generate Key button ,

 

1)      Mention the Path where the Key Pair file generated must fall.

2)      Give the Name of Private Key and Public Key file and Password.

3)      Click the OK Button .

4)      You will get the key Pair file in the Mentioned Path.

5)       Give the generated Key in the Key File and password and then Ok button.

     Give the user name and password and select the SSH /SFTP button .

  Secure FTP Server Configuration for SSH :

  In the Server Side select the Existing Domain which is already created and select the User.

  Now Click the Edit  Button,It will open the User Details Box.

  In the User Details Box ,select the Security Option

 

1)      It will ask for a ssh pub cert file ,give the Created public Key Pair File and the click OK.

  Now Start the Server and click the Client Connect Button .

  It will establish the SSH/SFTP connection.

 

 

Https in Redhat EAP 6.0 or JBoss 7.0

HTTPS in Redhat EAP 6.0 or JBoss 7.0

Steps 1 : Create a keystore by using Keytool if [HTTP / HTTPS]

D:\drvijay>keytool -genkey -alias tomcat -keyalg RSA -keystore https.keystore

Enter keystore password:

Re-enter new password:

What is your first and last name?

  [Unknown]:  abi gnax

What is the name of your organizational unit?

  [Unknown]:  jboss

What is the name of your organization?

  [Unknown]:  abignax

What is the name of your City or Locality?

  [Unknown]:  bangalore

What is the name of your State or Province?

  [Unknown]:  karnataka

What is the two-letter country code for this unit?

  [Unknown]:  IN

Is CN=abi gnax, OU=jboss, O=abignax, L=bangalore, ST=karnataka, C=IN correct?

  [no]:  yes

Enter key password for

        (RETURN if same as keystore password):

Step 2: Add the below line in x:/eap6.0_or_jboss7.0/standalone/configuration/standalone.xml

                <connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" enable-lookups="false" secure="true">

                <ssl password="test123" key-alias="tomcat" certificate-key-file="D:/drvijay/https.keystore" protocol="TLSv1" verify-client="false" certificate-file="D:/drvijay/https.keystore"/>

</connector>

               

Run: https://localhost:8443/appname

Note : Give IP instead of localhost in some cases.

JBoss 6 clustering with Apache Modjk [ Load balance ]

Download the software required

  Apache Server :- httpd-2.2.21-win32-x86-no_ssl.msi
  mod_jk :- tomcat-connectors-1.2.32-windows-i386-httpd-2.0.x.zip
  Jboss Application Server :- jboss-as-distribution-6.0.0.Final.zip

  unzip the mod_jk zip file and copy mod_jk.so and paste it under APACHE_HOME/modules/

Configure Apache to load mod_jk

  1)  Modify APACHE_HOME/conf/httpd.conf  and add a single line at the end of the file
   
     # Include mod_jk's specific configuration file 
  Include conf/mod-jk.conf
 

  and modify these line in httpd.conf file

  Listen localhost:80

  ServerName localhost

  
 2) Next, create a new file named APACHE_HOME/conf/mod-jk.conf:

   # Load mod_jk module
 # Specify the filename of the mod_jk lib
 LoadModule jk_module modules/mod_jk.so

 # Where to find workers.properties
 JkWorkersFile conf/workers.properties

 # Where to put jk logs
 JkLogFile logs/mod_jk.log

 # Set the jk log level [debug/error/info]
 JkLogLevel info

 # Select the log format
 JkLogStampFormat  "[%a %b %d %H:%M:%S %Y]"

 # JkOptions indicates to send SSK KEY SIZE
 JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories

 # JkRequestLogFormat
 JkRequestLogFormat "%w %V %T"
              
 # Mount your applications
 JkMount /helloworld/* loadbalancer

     (Note :- here you have to give you war file name)

 # You can use external file for mount points.
 # It will be checked for updates each 60 seconds.
 # The format of the file is: /url=worker
 # /examples/*=loadbalancer
 JkMountFile conf/uriworkermap.properties              

 # Add shared memory.
 # This directive is present with 1.2.10 and
 # later versions of mod_jk, and is needed for
 # for load balancing to work properly
 JkShmFile logs/jk.shm
             
 # Add jkstatus for managing runtime data
 
     JkMount status
        Order deny,allow
     Deny from all
     Allow from 127.0.0.1
 

   3) Create a uriworkermap.properties file in the APACHE_HOME/conf directory.
 # Simple worker configuration file
 # Mount the Servlet context to the ajp13 worker
 /jmx-console=loadbalancer
 /jmx-console/*=loadbalancer
 /web-console=loadbalancer
 /web-console/*=loadbalancer
 /helloworld/*=loadbalancer

Configure worker nodes in mod_jk
   4) Next, you need to configure mod_jk workers file conf/workers.properties
 # Define list of workers that will be used
 # for mapping requests
 worker.list=loadbalancer,status
 #worker.list=node1

 # Define Node1
 # modify the host as your host IP or DNS name.
  worker.node1.port=8009
  worker.node1.host=192.168.7.59
  worker.node1.type=ajp13
  worker.node1.lbfactor=1
  worker.node1.cachesize=10

 # Define Node2
 # modify the host as your host IP or DNS name.
  worker.node2.port=8009
  worker.node2.host= 192.168.7.50
  worker.node2.type=ajp13
  worker.node2.lbfactor=1
  worker.node2.cachesize=10

 # Define Node3
 # modify the host as your host IP or DNS name.
  worker.node3.port=8009
  worker.node3.host= 192.168.7.58
  worker.node3.type=ajp13
  worker.node3.lbfactor=1
  worker.node3.cachesize=10

 # Load-balancing behaviour
  worker.loadbalancer.type=lb
  worker.loadbalancer.balance_workers=node1,node2,node3
  worker.loadbalancer.sticky_session=0
  worker.list=loadbalancer

 # Status worker for managing load balancer
  worker.status.type=status

Configuring HTTP session state replication
     1) Enabling session replication in your application
 To enable replication of your web application sessions, you must tag the application as  distributable in the web.xml descriptor(web.xml of your application war file).

<distributable/>
 

Deploy the application in JBoss
 Deploy the application war file in server\all\deploy
Start the Jboss different nodes
 Then run the Jboss in different machines by using command
      run.bat -b -c all -D jboss.messaging.ServerPeerID= -D  jboss.service.binding.set=ports-default

Example
 run.bat -b 192.168.7.59 -c all -D jboss.messaging.ServerPeerID=1 -D  jboss.service.binding.set=ports-default
 run.bat -b 192.168.7.50 -c all -D jboss.messaging.ServerPeerID=2 -D   jboss.service.binding.set=ports-default

Run the application using the URL
 http://localhost/helloworld/hi.jsp

Cluster Load Balance

step 1:

     download jdkx.x, tomcat 6.0 ,  apache http server [latest], jmeter [optional]

step2 :
       install jdk

    install  2 or 3 or n copies of tomcat 6.0 as tomcatA, tomcatB, tomcatC

step3:
     open server.xml in tomcatx.x\conf

change tomcatA

port="8115" shutdown="SHUTDOWN">

port="8111" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" />

port="8119" protocol="AJP/1.3" redirectPort="8443" />

jvmRoute="tomcatA">


   



change tomcatB

port="8225" shutdown="SHUTDOWN">

port="8221" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" />

port="8229" protocol="AJP/1.3" redirectPort="8443" />

jvmRoute="tomcatA">

   

change tomcatC [ports]


step 4

Add distributed tag in web.xml

Next step to do add distributed tag in web.xml to switching session among the tomcat clustering instance
Make any application, e.g we are making cluster as application folder in webapps
1. TomcatA - >  webapps - > cluster -> WEB-INF -> web.xml
2. TomcatB - >  webapps - > cluster -> WEB-INF -> web.xml
3. TomcatC - >  webapps - > cluster -> WEB-INF -> web.xml
Add  in all three web.xml file

"http://java.sun.com/xml/ns/javaee"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
   version="2.5">
 
 

step 5

Install mod_jk in module

Mod_jk is connector that communicates with apache web server and tomcat. We need to download and copy that connector in module folder of apache
http://tomcat.apache.org/connectors-doc/ we are using latest connector of mod_jk
Make mod_jk.log file in logs folder otherwise apache will throw error
RENAME MOD_JK.SO OR MOD_JK.[WINDOWS]


server.xml

Include c:/apache-tomcat/conf/auto/mod_jk.conf
[httpd.conf]


step 6

Edit in httpd.conf

Open apache -> httpd.conf
Open in any text editor and add

LoadModule jk_module modules/mod_jk-apache-2.2.4.so
JkWorkersFile "C:\cluster\Apache\conf\workers.properties"
JkLogFile "logs/mod_jk.log"
JkLogLevel error
JkMount /cluster loadbalancer
JkMount /cluster/* loadbalancer

Worker.properties file

Make a file with name of workers.properties in conf folder. This file tells properties of all tomcat instances. We have to specify all tomcat properties here. Apache will forword request to tomcat through this file
Vertical tomcat clustering this file like

workers.tomcat_home=/tomcatA
workers.java_home=$JAVA_HOME
ps=/
worker.list=tomcatA,tomcatB,tomcatC,loadbalancer

worker.tomcatA.port=8119
worker.tomcatA.host=localhost
worker.tomcatA.type=ajp13
worker.tomcatA.lbfactor=1

worker.tomcatB.port=8229
worker.tomcatB.host=localhost
worker.tomcatB.type=ajp13
worker.tomcatB.lbfactor=1
worker.tomcatC.port=8339
worker.tomcatC.host=localhost
worker.tomcatC.type=ajp13
worker.tomcatC.lbfactor=1
worker.loadbalancer.type=lb
worker.loadbalancer.balanced_workers=tomcatA,tomcatB,tomcatC
worker.loadbalancer.sticky_session=1

step 7



worker.tomcatC.lbfactor=100
increase and decrease request to this tomcatC instance

Restart apache, tomcatA, tomcatB, tomcatC

Check clustering if apache start properly, It is fine without any errors otherwise check problems,basically mod_jk problems come. So download different mod_jk for your machine. Start all tomcats, tomcatA, tomcatB, and tomcatC. If all tomcats is started this means tomcat is working fine.
Open test.jsp on browser and check session id. Check which tomcat on test.jsp is running tomcatB or tomcatC. Close that tomcat, reload test.jsp. Check session id,if session id is same. Then tomcat clustering is working fine.

Test jsp file

Make test.jsp in cluster folder of webapps
tomcatA

<%
  session.setAttribute("a","a");
%>







 
   
   
 
 
   
   
 

TomcatA Machine
Session ID :	<%=session.getId()%>

tomcatB

<%
  session.setAttribute("a","a");
%>







 
   
   
 
 
   
   
 

TomcatB Machine
Session ID :	<%=session.getId()%>

TomcatC
<%
  session.setAttribute("a","a");
%>







 
   
   
 
 
   
   
 

TomcatC Machine
Session ID :	<%=session.getId()%>

step 8


[httpd.conf]
Alias /docs /var/www/html/docs

JkMount /docs loadbalancer
JkMount /docs/* loadbalancer

JkUnMount /docs/*.gif loadbalancer
JkUnMount /docs*.png  loadbalancer


or

If the Tomcat Host appBase (webapps) directory is accessible by the Apache web server, Apache can be configured to serve web application context directory static files instead of passing the request to Tomcat.
Caution: For security reasons is is strongly recommended that JkMount is used to pass all requests to Tomcat by default and JkUnMount is used to explicitly exclude static content to be served by httpd. It should also be noted that content served by httpd will bypass any security constraints defined in the application's web.xml.
Use Apache's Alias directive to map a single web application context directory into Apache's document space for a VirtualHost:

# Static files in the examples webapp are served by apache
  Alias /examples /vat/tomcat3/webapps/examples
  # All requests go to worker1 by default
  JkMount /* worker1
  # Serve html, jpg and gif using httpd
  JkUnMount /*.html worker1
  JkUnMount /*.jpg  worker1



  JkUnMount /*.gif  worker1

links

http://www.easywayserver.com/implementation-tomcat-clustering.htm#server-xml

http://tomcat.apache.org/connectors-doc/webserver_howto/apache.html

Source Code Analysis Tools

From OWASP

Source Code Analysis tools are designed to analyze source code and/or compiled version of code in order to help find security flaws. Ideally, such tools would automatically find security flaws with a high degree of confidence that what is found is indeed a flaw. However, this is beyond the state of the art for many types of application security flaws. Thus, such tools frequently serve as aids for an analyst to help them zero in on security relevant portions of code so they can find flaws more efficiently, rather than a tool that simply finds flaws automatically.

Open Source or Free Tools Of This Type

• FindBugs - Find Bugs (including some security flaws) in Java Programs
• FxCop (Microsoft) - FxCop is an application that analyzes managed code assemblies (code that targets the .NET Framework common language runtime) and reports information about the assemblies, such as possible design, localization, performance, and security improvements.
• PMD - PMD scans Java source code and looks for potential code problems (this is a code quality tool that does not focus on security issues)
• PreFast (Microsoft) - PREfast is a static analysis tool that identifies defects in C/C++ programs
• RATS (Fortify) - Scans C, C++, Perl, PHP and Python source code for security problems like buffer overflows and TOCTOU (Time Of Check, Time Of Use) race conditions
• SWAAT - Simplistic Beta Tool - Languages: Java, JSP, ASP .Net, and PHP
• Flawfinder Flawfinder - Scans C and C++

Commercial Tools from OWASP Members Of This Type

These vendors have decided to support OWASP by becoming members. OWASP appreciates the support from these organizations, but cannot endorse any commercial products or services.

• Static Source Code Analysis with CodeSecure™ (Armorize Technologies)
• Static Source Code Analysis with hypersource (art of defence)
• Source Code Analysis (Fortify)
• Ounce (Ounce Labs)

What Is a Hacker ?

                The Jargon File contains a bunch of definitions of the term ‘hacker’, most having to do with technical adeptness and a delight in solving problems and overcoming limits. If you want to know how to become a hacker, though, only two are really relevant.

There is a community, a shared culture, of expert programmers and networking wizards that traces its history back through decades to the first time-sharing minicomputers and the earliest ARPAnet experiments. The members of this culture originated the term ‘hacker’. Hackers built the Internet. Hackers made the Unix operating system what it is today. Hackers run Usenet. Hackers make the World Wide Web work. If you are part of this culture, if you have contributed to it and other people in it know who you are and call you a hacker, you're a hacker.

The hacker mind-set is not confined to this software-hacker culture. There are people who apply the hacker attitude to other things, like electronics or music — actually, you can find it at the highest levels of any science or art. Software hackers recognize these kindred spirits elsewhere and may call them ‘hackers’ too — and some claim that the hacker nature is really independent of the particular medium the hacker works in. But in the rest of this document we will focus on the skills and attitudes of software hackers, and the traditions of the shared culture that originated the term ‘hacker’.

There is another group of people who loudly call themselves hackers, but aren't. These are people (mainly adolescent males) who get a kick out of breaking into computers and phreaking the phone system. Real hackers call these people ‘crackers’ and want nothing to do with them. Real hackers mostly think crackers are lazy, irresponsible, and not very bright, and object that being able to break security doesn't make you a hacker any more than being able to hotwire cars makes you an automotive engineer. Unfortunately, many journalists and writers have been fooled into using the word ‘hacker’ to describe crackers; this irritates real hackers no end.

The basic difference is this: hackers build things, crackers break them.

If you want to be a hacker, keep reading. If you want to be a cracker, go read the alt.2600 newsgroup and get ready to do five to ten in the slammer after finding out you aren't as smart as you think you are. And that's all I'm going to say about crackers.