Connecting and monotoring JMX of WSO2 products in EC2 instance

Most of the time current deployments are hosted in EC2 instance as it is very reliable and scalable. When it come to monitoring the WSO2 products via jmx in EC2 instances. You have to add some parameters inorder to connect with it.


add below parameters in /bin/wso2server.sh

    -Dcom.sun.management.jmxremote \

    -Dcom.sun.management.jmxremote.port=XXXX \

    -Dcom.sun.management.jmxremote.ssl=false \

    -Dcom.sun.management.jmxremote.authenticate=false \

    -Djava.rmi.server.hostname=XXX.XXX.XXX.XXX \

Here port should be port that not used any where in the given instance and host-name should be private IP of the EC2 instances.

Access and monitor the server via Jconsole by JMX url connection that has the domain name and the jmx ports define in the carbon.xml  

List of "conditional content aware mediators" and "content aware mediators"

I have Listed down set of "conditional content aware mediators" and "content aware mediators"

conditional content aware mediator

fastXSLT
filter
header
log
property
switch

content aware mediators

bean
cache
callout
clone
command
conditional router
dblookup
dbreport
ejb
enrich
event
payloadfactory
script
spring
store
validate
xquery
xslt
iterate

How to log the Content-Type in WSO2 ESB

To identify the Content-Type in the mediation in wso2 esb.

Please refer to configuration given below. I have modified the sample given in the wso2 esb

How to search for installed Software in Ubuntu

Very simple way to identify your installed software in  you Ubuntu machine.

List all the installed software

dpkg --get-selections 

Find the specif software

dpkg --get-selections |grep 

Check the available Cipher providers and Cipher algorithms in Java Virtual Machine(JVM)

During the penetration test normally the ethical hacker will also evaluate all the aspects of the Java Virtual Machine(JVM). As a part of it they use to check the weak available ciphers out there in JVM.

Therefore, I have create a simple java code to list of all the available ciphers and their providers in the given Java virtual machine. Please find the code below in my Gist

Disabling weak ciphers in JAVA Virtual machine (JAVA) level

There are known vulnerable weak cipher algorithms are out there such as MD2, MD5,  SHA1 and RC4. Having these in the production servers that have the high sensible data may have high security risk.

When you application running based on Apache Tomcat it is possible you to disable it from the removing relevant cipher from catalina-server.xml.

Example

ciphers="SSL_RSA_WITH_RC4_128_MD5,SSL_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,SSL_RSA_WITH_3DES_EDE_CBC_SHA,SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA"

Let say SSL_RSA_WITH_RC4_128_MD5 has been identified as a vulnerable weak cipher. So that simply you can remove that from the list and restart the server


ciphers="SSL_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,SSL_RSA_WITH_3DES_EDE_CBC_SHA,SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA"

Lets say your server is out of control of your hand to control the cipher. Simple but efficient solution is to disable that from the JVM level.

Since Java 1.7 there are two additional properties in $JRE_HOME/lib/security/java.security:


jdk.certpath.disabledAlgorithms=MD2

Controls algorithms for certification path building and validation.

jdk.tls.disabledAlgorithms=MD5, SHA1, RC4, RSA keySize < 1024

This JVM-wide algorithm restrictions for SSL/TLS processing will disable the chipers that listed out there. Furthermore, the used notation is quite obvious here!  it's possible to disallow certain algorithms or limit key sizes.

Note that
Both properties are supported in Oracle JRE 7, Open JRE 7  and IBM Java v7


Further Reading

[1] http://www.papercut.com/kb/Main/SSLCipherConfiguration

Known errors and issue while Running ciphertool in WSO2

I have seen several user mistake and issues that cause the error while running ciphertool.sh of WSO2 carbon servers. So based on my previous experience, I have listed down the error that I encounter so far while using the tool and solution for that...


Error set 1

[vanji@vanjiTestMachine bin]# ./ciphertool.sh -Dconfigure

[Please Enter Primary KeyStore Password of Carbon Server : ]

Exception in thread "main" org.wso2.ciphertool.CipherToolException: Error initializing Cipher

        at org.wso2.ciphertool.CipherTool.handleException(CipherTool.java:861)

        at org.wso2.ciphertool.CipherTool.initCipher(CipherTool.java:202)

        at org.wso2.ciphertool.CipherTool.main(CipherTool.java:80)

Caused by: java.security.InvalidKeyException: No installed provider supports this key: (null)

        at javax.crypto.Cipher.chooseProvider(Cipher.java:878)

        at javax.crypto.Cipher.init(Cipher.java:1653)

        at javax.crypto.Cipher.init(Cipher.java:1549)

        at org.wso2.ciphertool.CipherTool.initCipher(CipherTool.java:200)

This error can cause when keyAlias miss match when generating the key-store, Therefore please reconsider to generate right Key-store with the right keyAlias OR change the values in carbon.xml

Error set 2

I have notice flowing IOError read error while working on windows machine

[Please Enter Primary KeyStore Password of Carbon Server : ]

Exception in thread "main" org.wso2.ciphertool.

CipherToolException: IOError read

ing primary key Store details from carbon.xml file

        at org.wso2.ciphertool.CipherTool.handleException(CipherTool.java:861)

        at org.wso2.ciphertool.CipherTool.getPrimaryKeyStoreData(CipherTool.java

:305)

        at org.wso2.ciphertool.CipherTool.initCipher(CipherTool.java:180)

        at org.wso2.ciphertool.CipherTool.main(CipherTool.java:80)

Caused by: java.io.FileNotFoundException: C:\Program Files\Java\jdk1.6.0_16\bin\

repository\conf\carbon.xml (The system cannot find the path specified)

        at java.io.FileInputStream.open(Native Method)

        at java.io.FileInputStream.(FileInputStream.java:106)

        at java.io.FileInputStream.(FileInputStream.java:66)

        at sun.net.www.protocol.file.FileURLConnection.connect(FileURLConnection

.java:70)

        at sun.net.www.protocol.file.FileURLConnection.getInputStream(FileURLCon

nection.java:161)

        at com.sun.org.apache.xerces.internal.impl.XMLEntityManager.setupCurrent

Entity(XMLEntityManager.java:653)

        at com.sun.org.apache.xerces.internal.impl.XMLVersionDetector.determineD

ocVersion(XMLVersionDetector.java:186)

        at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(X

ML11Configuration.java:771)

        at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(X

ML11Configuration.java:737)

        at com.sun.org.apache.xerces.internal.parsers.XMLParser.parse(XMLParser.

java:107)

        at com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.

java:225)

        at com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderImpl.parse(Doc

umentBuilderImpl.java:283)

        at javax.xml.parsers.DocumentBuilder.parse(DocumentBuilder.java:180)

        at org.wso2.ciphertool.CipherTool.getPrimaryKeyStoreData(CipherTool.java

:289)

        ... 2 more

There is a windows long classpath issue in the script. Please edit the following lines in ciphertool.bat script 

[vanji@vanjiTestMachine bin]$ ./ciphertool.sh -Dconfigure
[Please Enter Primary KeyStore Password of Carbon Server : ]
Exception in thread "main" org.wso2.ciphertool.CipherToolException: Error initializing Cipher
        at org.wso2.ciphertool.CipherTool.handleException(CipherTool.java:861)
        at org.wso2.ciphertool.CipherTool.initCipher(CipherTool.java:202)
        at org.wso2.ciphertool.CipherTool.main(CipherTool.java:80)
Caused by: java.security.InvalidKeyException: Wrong key usage
        at javax.crypto.Cipher.init(Unknown Source)
        at javax.crypto.Cipher.init(Unknown Source)
        at org.wso2.ciphertool.CipherTool.initCipher(CipherTool.java:200)
        ... 1 more

Edit the line from 73 to 77 with the following lines

call ant -buildfile "%CARBON_HOME%\bin\build.xml" -q 
set CARBON_CLASSPATH=.\conf 
FOR %%c in ("%CARBON_HOME%\lib\*.jar") DO set CARBON_CLASSPATH=!CARBON_CLASSPATH!;".\lib\%%~nc%%~xc" 
FOR %%C in ("%CARBON_HOME%\repository\lib\*.jar") DO set CARBON_CLASSPATH=!CARBON_CLASSPATH!;".\repository\lib\%%~nC%%~xC" 



Error Set 3

[vanji@vanjiTestMachine bin]$ ./ciphertool.sh -Dconfigure 
[Please Enter Primary KeyStore Password of Carbon Server : ] 
Exception in thread "main" org.wso2.ciphertool.CipherToolException: Error initializing Cipher 
        at org.wso2.ciphertool.CipherTool.handleException(CipherTool.java:861) 
        at org.wso2.ciphertool.CipherTool.initCipher(CipherTool.java:202) 
        at org.wso2.ciphertool.CipherTool.main(CipherTool.java:80) 
Caused by: java.security.InvalidKeyException: Wrong key usage 
        at javax.crypto.Cipher.init(Unknown Source) 
        at javax.crypto.Cipher.init(Unknown Source) 
        at org.wso2.ciphertool.CipherTool.initCipher(CipherTool.java:200) 
        ... 1 more 

If you are changed the default keystore privided with wso2server new one, make sure you have change all the references for that keystore. You may have to change the entries in following files. 

WSO2Server/reposotory/conf/carbon.xml 
WSO2Server/repository/conf/security/secret-conf.properties 
WSO2Server/repository/conf/sec.policy 
WSO2Server/repository/conf/security/cipher-text.properties 
WSO2Server/repository/conf/tomcat/catalina-server.xml 
WSO2Server/reposotory/conf/axis2/axis2.xml 

Not only the keysore name, make sure you change keypassword, keystore pasword and keyalias according to your keystore.

Error Set 4


[vanji@vanjiTestMachine:~/software/wso2/wso2esb-4.8.0
$ sh bin/ciphertool.sh -Dconfigure
Exception in thread "main" org.wso2.ciphertool.CipherToolException: IOError reading primary key Store details from carbon.xml file 
at org.wso2.ciphertool.CipherTool.handleException(CipherTool.java:861)
at org.wso2.ciphertool.CipherTool.getPrimaryKeyStoreData(CipherTool.java:305)
at org.wso2.ciphertool.CipherTool.initCipher(CipherTool.java:180)
at org.wso2.ciphertool.CipherTool.main(CipherTool.java:80)
Caused by: java.io.FileNotFoundException: /home/vanji/software/wso2/repository/conf/carbon.xml (No such file or directory)
at java.io.FileInputStream.open(Native Method)
at java.io.FileInputStream.(FileInputStream.java:120)
at java.io.FileInputStream.(FileInputStream.java:79)
at sun.net.www.protocol.file.FileURLConnection.connect(FileURLConnection.java:70)
at sun.net.www.protocol.file.FileURLConnection.getInputStream(FileURLConnection.java:161)
at com.sun.org.apache.xerces.internal.impl.XMLEntityManager.setupCurrentEntity(XMLEntityManager.java:651)
at com.sun.org.apache.xerces.internal.impl.XMLVersionDetector.determineDocVersion(XMLVersionDetector.java:186)
at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:772)
at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:737)
at com.sun.org.apache.xerces.internal.parsers.XMLParser.parse(XMLParser.java:119)
at com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.java:232)
at com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderImpl.parse(DocumentBuilderImpl.java:284)
at javax.xml.parsers.DocumentBuilder.parse(DocumentBuilder.java:180)
at org.wso2.ciphertool.CipherTool.getPrimaryKeyStoreData(CipherTool.java:289)
... 2 more



When you run the ciphertool.sh from outside the bin folder  you will see this error and this is the limitation of the tool.


I have listed the issue that i have encountered so far, if i found anything new I will keep update this blog-post with my new findings