Stuff I'm Up To

Technical Ramblings

Forcing Tomcat to HTTPS — September 28, 2017

Forcing Tomcat to HTTPS

As our environment needs change more and more of our internal services are being forced to change to HTTPS.

Tomcat supports the deployment of services using HTTPS, but many of our vendors have taken the easy route and just use HTTP on the standard port 8080. This is now going to become a bit of a hurdle as we now need to advise clients of the change to HTTPS and the port change involved.

Securing Tomcat with valid certificates is the start of the journey and adding a connector using HTTPS is the first step. Then we need to make calls to the non-secure HTTP site redirect over to the HTTPS version.

Continue reading

Advertisements
Horizon Client Stealing my Mouse — September 27, 2017

Horizon Client Stealing my Mouse

On my Linux VMWare Horizon client (v4.5.0 5650368) it doesn’t seem to matter what choice I make about NOT Connecting USB Devices at Startup it still continued to take over my Logitech USB Receiver.

I’d have to use the keyboard and navigate the menu so I could get control of my mouse back. Thankfully I don’t have a Logitech keyboard that uses the same receiver.

It was an easy fix, but I don’t know why it does it. The permissions to the ~/.vmware folder and files all seem OK. IT’s an easy fix of just editing the file view-preferences and amending the line or lines as follows.

$ vi ~/.vmware/view-preferences
...
view.usbAutoConnectAtStartUp = "FALSE"
view.usbAutoConnectOnInsert = "FALSE"
...

 

Windows, Apache 2.4 and OpenSSL — September 22, 2017

Windows, Apache 2.4 and OpenSSL

In order to make Apache 2.4.27 compliant it needs the later version of OpenSSL v1.1.0. To get this you need to install the VC15 version. The VC11 etc. do not include the later OpenSSL and fail because they are compiled with v1.0.2

  Banner           : Apache/2.4.27 (Win64) OpenSSL/1.0.2l
  Reported version : 1.0.2l
  Fixed version    : 1.1.0

This is detailed in the 16 June 2017 change log, but is repeated here as a reminder to install vcredist_x64 for VC++ 2017 which is linked on the downloads page on Apache Lounge.

References

https://www.apachelounge.com/download/

https://www.apachelounge.com/Changelog-2.4.html

Apache 2.4 TRACE – Nessus plugin 11213 — September 21, 2017

Apache 2.4 TRACE – Nessus plugin 11213

Googling for how to close the vulnerability for the TRACE method on Apache 2.4 results in lots of responses that just use a rewrite rule to respond with a permission denied message.  Even the Nessus plugin output lists the rewrite fix. Nessus doesn’t use this for it’s scans, it carries out a HTTP call for OPTIONS and relies on the server telling it what methods are available.

RewriteEngine On 
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]

Whilst the rewrite rule may be a valid mitigation on Apache servers, the actual vulnerability warning won’t be removed from Nessus’ results.

If you’re using Apache 2.4 then there is a config TraceEnable directive that you should use to simply turn off the TRACE method.

Continue reading

Android Trusted CA Certificate — September 20, 2017

Android Trusted CA Certificate

We have been tested by some of our Android Lollipop tablets. Adding a trusted CA certificate used to be as easy as visiting the proxy portal and clicking the install certificate button.

Now these devices come up with an error complaining that there is “no certificate in file”.

Reading a lot of Android nightmare posts about converting the PEM certificate to pfx/p12 using openssl and then rooting the device and delivering the certificate into the folder for the cacerts using the command line it turned out to be far simpler.

Continue reading

OwnCloud, php7.0-fpm and Memcache — September 19, 2017

OwnCloud, php7.0-fpm and Memcache

When checking out the setup for our OwnCloud system it came up with a few cautionary problems that needed to be resolved.

The problems related to environment variables and file locking.

php does not seem to be setup properly to query system environment variables. The test with getenv(“PATH”) only returns an empty response. Please check the installation documentation ↗ for php configuration notes and the php configuration of your server, especially when using php-fpm.

and

Transactional file locking is using the database as locking backend, for best performance it’s advised to configure a memcache for locking. See the documentation ↗ for more information.

Continue reading