Refer: https://veracrypt.eu/en/Beginner%27s%20Tutorial.html
The security for TrueCrypt was broken and a replacement was needed.
256 bit encryption for Safenet
-----Original Message-----
From: Guillaume Radde [mailto:guillaume.radde@redhat.com]
Sent: Tuesday, May 22, 2012 6:11 PM
To: Ruckman, Maurice (HAL)
Cc: Hoggard, Chad (HAL); Augustine, Anila (HAL); HAL DistList: IS UNIX
Subject: 256 bit encryption for Safenet
(Added missing link)
Below are the steps to enable 256 bits encryption. This would need to be done on all JBoss servers and developer-vms.
1) Don't listen to instruction from non-RedHat sources, they pretty much all make you break your RHEL java rpm install, which will cause problem during the next java update.
2) Download the "Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files" from [1]. Accept the license on the page and download jce_policy-6.zip.
3) Unzip the zip content into /opt. Your folder structure should look like this:
/opt/jce
/opt/jce/local_policy.jar
/opt/jce/US_export_policy.jar
3a) After you copy the files into /opt/jce you should change the ownership to root
chown -R root.root jce
4) Run the following command as root:
sudo su -
rm -f /usr/lib/jvm/jre-1.6.0-sun.x86_64/lib/security/{local,US_export}_policy.jar && update-alternatives --install /usr/lib/jvm/jre-1.6.0-sun.x86_64/lib/security/local_policy.jar jce_1.6.0_sun_local_policy.x86_64 /opt/jce/local_policy.jar 160200 --slave /usr/lib/jvm/jre-1.6.0-sun.x86_64/lib/security/US_export_policy.jar jce_1.6.0_sun_us_export_policy.x86_64 /opt/jce/US_export_policy.jar
5) Now update to the new links, choose option 2:
update-alternatives --config jce_1.6.0_sun_local_policy.x86_64
6) That's it :-)
[1] http://www.oracle.com/technetwork/java/javase/downloads/jce-6-download-429243.html
-------------------------------------
Guillaume Radde
Senior Consultant, Red Hat Consulting
guillaume.radde@redhat.com
http://www.redhat.com
-------------------------------------
Notes: You are updating the links with step #4. For example, before changes:
[root@haldevjbs04 /opt/jce]$ ls -l /etc/alternatives | grep -i jce
lrwxrwxrwx 1 root root 71 Feb 1 12:41 jce_1.6.0_sun_local_policy.x86_64 -> /usr/lib/jvm-private/java-1.6.0-sun.x86_64/jce/vanilla/local_policy.jar
lrwxrwxrwx 1 root root 75 Feb 1 12:41 jce_1.6.0_sun_us_export_policy.x86_64 -> /usr/lib/jvm-private/java-1.6.0-sun.x86_64/jce/vanilla/US_export_policy.jar
Safenet Code Sample
The following code stub can be used to encrypt/decrypt with the Safenet appliance. Refer: CryptoTool.java
private static String doEncrypt( final String plainText ) throws Exception
{
NAESession naesession = NAESession.getSession( "mlrtest", "asdf1234" );
SecretKey secretkey = NAEKey.getSecretKey( "test128", naesession );
Cipher cipher =
Cipher.getInstance( "AES/CBC/PKCS5Padding", "IngrianProvider" );
byte [] iv = new byte [16];
String ivString = "1234567890123456";
iv = ivString.getBytes();
cipher.init( Cipher.ENCRYPT_MODE, secretkey, new IvParameterSpec( iv ) );
byte [] outputByteArray = cipher.doFinal( plainText.getBytes() );
return IngrianProvider.byteArray2Hex( outputByteArray );
}
private static String doDecrypt( final String encryptedText )
throws Exception
{
NAESession naesession = NAESession.getSession( "mlrtest", "asdf1234" );
SecretKey secretkey = NAEKey.getSecretKey( "test128", naesession );
Cipher cipher =
Cipher.getInstance( "AES/CBC/PKCS5Padding", "IngrianProvider" );
byte [] iv = new byte [16];
String ivString = "1234567890123456";
iv = ivString.getBytes();
cipher.init( Cipher.DECRYPT_MODE, secretkey, new IvParameterSpec( iv ) );
byte [] decryptedByte =
cipher.doFinal( IngrianProvider.hex2ByteArray( encryptedText ) );
String decrypted = new String( decryptedByte );
return decrypted;
}
Encrypting passwords for JBoss configuration
-----Original Message-----
From: Jeff Lindesmith [mailto:jlindesm@redhat.com]
Sent: Monday, March 19, 2012 2:47 PM
To: Ruckman, Maurice (HAL); Fillman, Eric (HAL); Thompson, Sonya (HAL); Bojja, Sridhar (HAL Contractor); Phatak, Sheetal (HAL)
Cc: Guillaume Radde
Subject: Fwd: Database credentials and JDBC settings for Staging, Prod and Webres
Hi All,
These are the instructions I sent to Mike for encrypting the passwords.
You can look at the /deploy/hal-ds.xml file and the /conf/login-config.xml file to see how the datasource credentials are configured.
Make sure you do an "svn update" on your local vms first so that you have the latest changes to these files.
Thanks,
Jeff
----- Forwarded Message -----
From: "Jeff Lindesmith" <jlindesm@redhat.com>
To: "Mike Schumacher (HAL)" <mschumacher@hollandamerica.com>
Sent: Thursday, March 15, 2012 8:34:50 AM
Subject: Fwd: Database credentials and JDBC settings for Staging, Prod and Webres
Hi Mike,
Got this response from Dave.
Sounds like these are passwords that do not work anymore.
We will of course need passwords that do work.
I was thinking as well about how the passwords can be communicated to me for JBoss datasource configuration.
All I really need is the encrypted password that JBoss can decrypt.
You or someone else on the team can perform the following steps to generate these encrypted passwords.
1. Login to one of the JBoss infrastructure VMs, say haldevjbs01 for example.
2. Change to the main JBoss app server directory: cd /var/lib/jbossas 3. Execute the following java command (testpassword represents the actual password you want to encrypt).
java -cp client/jboss-logging-spi.jar:lib/jbosssx.jar org.jboss.resource.security.SecureIdentityLoginModule testpassword
4. The resulting encrypted password will be displayed like the following.
Encoded password: 638fb8430bc67ad6c3bc376bef610c0a
This encrypted value is all I need. So, you could send me a list of usernames and corresponding encrypted passwords.
Thanks,
Jeff
----- Forwarded Message -----
From: "David Risley (HAL)" <DRisley@HollandAmerica.com>
To: "Anila Augustine (HAL)" <AAugustine@HollandAmerica.com>
Cc: "Jeff Lindesmith" <jlindesm@redhat.com>
Sent: Wednesday, March 14, 2012 1:43:27 PM
Subject: RE: Database credentials and JDBC settings for Staging, Prod and Webres
These were the original passwords that we set. They should no longer work but you are welcome to try them:
web_owner/ befe2010
halw_dwh/ halw_dwh
siebel_ro/siebel_ro
hal_web/ #never heard of this one.
DaveR
"Peace" - is the message really so hard to understand?
-----Original Message-----
From: Augustine, Anila (HAL)
Sent: Monday, March 12, 2012 3:03 PM
To: Risley, David (HAL)
Cc: Jeff Lindesmith; Schumacher, Mike (HAL)
Subject: RE: Database credentials and JDBC settings for Staging, Prod and Webres
Importance: High
Hi Dave,
Could you please help with the request below?
Thanks
Anila
________________________________________
From: Lindesmith, Jeff (HAL)
Sent: Thursday, March 08, 2012 12:51 PM
To: Risley, David (HAL)
Cc: guillaume.radde@redhat.com; rgullett@redhat.com; Schumacher, Mike (HAL)
Subject: Database credentials and JDBC settings for Staging, Prod and Webres
Hi Dave,
Basically, what we need are the username and passwords used by Websphere to connect to databases and the JDBC connection urls.
For example, on dev we have the following connection urls with corresponding credentials.
connection url = jdbc:oracle:thin:@//haltstdbs02:37200/devweb
username = web_owner
password = web_owner
connection url = jdbc:oracle:thin:@haltstdb01.hq.halw.com:17101:devdwh1
username = halw_dwh
password = halw_dwh
connection url = jdbc:oracle:thin:@//haltstcrm01:2900/tstcrm1
username = siebel_ro
password = siebel_ro
connection url = jdbc:oracle:thin:@10.194.100.103:1521:tsgp
username = hal_web
password = hal_web
connection url = jdbc:oracle:thin:@haltstdbs05.hq.halw.com:17401:tstdwh1
username = halw_dwh
password = halw_dwh
We need the equivalent settings for these connections for the Staging, Production and Webres environments.
Thanks,
Jeff Lindesmith
Senior Consultant
Red Hat Consulting
-----Original Message-----
From: Jeff Lindesmith [mailto:jlindesm@redhat.com]
Sent: Monday, March 19, 2012 2:47 PM
To: Ruckman, Maurice (HAL); Fillman, Eric (HAL); Thompson, Sonya (HAL); Bojja, Sridhar (HAL Contractor); Phatak, Sheetal (HAL)
Cc: Guillaume Radde
Subject: Fwd: Database credentials and JDBC settings for Staging, Prod and Webres
Hi All,
These are the instructions I sent to Mike for encrypting the passwords.
You can look at the /deploy/hal-ds.xml file and the /conf/login-config.xml file to see how the datasource credentials are configured.
Make sure you do an "svn update" on your local vms first so that you have the latest changes to these files.
Thanks,
Jeff
----- Forwarded Message -----
From: "Jeff Lindesmith" <jlindesm@redhat.com>
To: "Mike Schumacher (HAL)" <mschumacher@hollandamerica.com>
Sent: Thursday, March 15, 2012 8:34:50 AM
Subject: Fwd: Database credentials and JDBC settings for Staging, Prod and Webres
Hi Mike,
Got this response from Dave.
Sounds like these are passwords that do not work anymore.
We will of course need passwords that do work.
I was thinking as well about how the passwords can be communicated to me for JBoss datasource configuration.
All I really need is the encrypted password that JBoss can decrypt.
You or someone else on the team can perform the following steps to generate these encrypted passwords.
1. Login to one of the JBoss infrastructure VMs, say haldevjbs01 for example.
2. Change to the main JBoss app server directory: cd /var/lib/jbossas 3. Execute the following java command (testpassword represents the actual password you want to encrypt).
java -cp client/jboss-logging-spi.jar:lib/jbosssx.jar org.jboss.resource.security.SecureIdentityLoginModule testpassword
4. The resulting encrypted password will be displayed like the following.
Encoded password: 638fb8430bc67ad6c3bc376bef610c0a
This encrypted value is all I need. So, you could send me a list of usernames and corresponding encrypted passwords.
Thanks,
Jeff
----- Forwarded Message -----
From: "David Risley (HAL)" <DRisley@HollandAmerica.com>
To: "Anila Augustine (HAL)" <AAugustine@HollandAmerica.com>
Cc: "Jeff Lindesmith" <jlindesm@redhat.com>
Sent: Wednesday, March 14, 2012 1:43:27 PM
Subject: RE: Database credentials and JDBC settings for Staging, Prod and Webres
These were the original passwords that we set. They should no longer work but you are welcome to try them:
web_owner/ befe2010
halw_dwh/ halw_dwh
siebel_ro/siebel_ro
hal_web/ #never heard of this one.
DaveR
"Peace" - is the message really so hard to understand?
-----Original Message-----
From: Augustine, Anila (HAL)
Sent: Monday, March 12, 2012 3:03 PM
To: Risley, David (HAL)
Cc: Jeff Lindesmith; Schumacher, Mike (HAL)
Subject: RE: Database credentials and JDBC settings for Staging, Prod and Webres
Importance: High
Hi Dave,
Could you please help with the request below?
Thanks
Anila
________________________________________
From: Lindesmith, Jeff (HAL)
Sent: Thursday, March 08, 2012 12:51 PM
To: Risley, David (HAL)
Cc: guillaume.radde@redhat.com; rgullett@redhat.com; Schumacher, Mike (HAL)
Subject: Database credentials and JDBC settings for Staging, Prod and Webres
Hi Dave,
Basically, what we need are the username and passwords used by Websphere to connect to databases and the JDBC connection urls.
For example, on dev we have the following connection urls with corresponding credentials.
connection url = jdbc:oracle:thin:@//haltstdbs02:37200/devweb
username = web_owner
password = web_owner
connection url = jdbc:oracle:thin:@haltstdb01.hq.halw.com:17101:devdwh1
username = halw_dwh
password = halw_dwh
connection url = jdbc:oracle:thin:@//haltstcrm01:2900/tstcrm1
username = siebel_ro
password = siebel_ro
connection url = jdbc:oracle:thin:@10.194.100.103:1521:tsgp
username = hal_web
password = hal_web
connection url = jdbc:oracle:thin:@haltstdbs05.hq.halw.com:17401:tstdwh1
username = halw_dwh
password = halw_dwh
We need the equivalent settings for these connections for the Staging, Production and Webres environments.
Thanks,
Jeff Lindesmith
Senior Consultant
Red Hat Consulting
Encryption setup for bouncycastle
Location of file on VM:
/usr/lib/jvm/java-1.6.0-sun.x86_64/jre/lib/security/java.security
/usr/lib/jvm/java-1.6.0/jre/lib/security/java.security
Excerpt:
#
# List of providers and their preference orders (see above):
#
security.provider.1=sun.security.provider.Sun
security.provider.2=sun.security.rsa.SunRsaSign
security.provider.3=com.sun.net.ssl.internal.ssl.Provider
security.provider.4=com.sun.crypto.provider.SunJCE
security.provider.5=sun.security.jgss.SunProvider
security.provider.6=com.sun.security.sasl.Provider
security.provider.7=org.jcp.xml.dsig.internal.dom.XMLDSigRI
security.provider.8=sun.security.smartcardio.SunPCSC
security.provider.9=org.bouncycastle.jce.provider.BouncyCastleProvider
Accuvant Holland America Evaluation Agmt 12 6 2011
From: Ruckman, Maurice (HAL)
Sent: Wednesday, December 14, 2011 10:24 AM
To: Mounagurusamy, Jayakumar (HAL)
Cc: Augustine, Anila (HAL)
Subject: RE: Accuvant Holland America Evaluation Agmt 12 6 2011
Importance: High
Encryption Algorithm used is DESede:
Triple DES Encryption (also known as DES-EDE, 3DES, or Triple-DES). Data is encrypted using the DES algorithm three separate times. It is first encrypted using the first subkey, then decrypted with the second subkey, and encrypted with the third subkey.
Technical Notes for Reference:
C:changeMancomhalwsecurityDESedeEncrypter.java
public static String ENCRYPTION_ALGORITHM = "DESede";
Cipher cipher = Cipher.getInstance( ENCRYPTION_ALGORITHM );
Refer: Accuvant Holland America Evaluation Agmt 12 6 2011 [pdf]