November 2015 - jboss-jira - Jboss List Archives

[JBoss JIRA] (WFLY-5273) [GSS] (6.4.z) EJB IOR contains wrong port (non-SSL port) information when SSL is required

by Brian Stansberry (JIRA)

[ https://issues.jboss.org/browse/WFLY-5273?page=com.atlassian.jira.plugin.... ] Brian Stansberry resolved WFLY-5273. ------------------------------------ Assignee: (was: Jason Greene) Resolution: Duplicate Issue > [GSS] (6.4.z) EJB IOR contains wrong port (non-SSL port) information when SSL is required > ----------------------------------------------------------------------------------------- > > Key: WFLY-5273 > URL: https://issues.jboss.org/browse/WFLY-5273 > Project: WildFly > Issue Type: Bug > Reporter: Derek Horton > > Description of problem: > - Configure JBoss to only allow IIOP connections over SSL > - It is possible to do this, but the configuration is confusing (possibly a bug) > Details of the setup/issue: > - When enabling SSL for jacorb, it normally listens on both the non-ssl port and the ssl port > - Setting server-requires="ServerAuth" causes the server to stop listening on non-ssl port > - However, the IOR tells client to connect to non-ssl port ...even though its not listening on it > String lookup = "corbaname:iiop:" + host + ":" + port +"#" + ejbLookupPath; > // lookup the IIOP EJB > Object iiopObj = ctx.lookup(lookup); > // the call to the EJB will fail due to the port being wrong non-ssl vs ssl > - The workaround is to use the following ior-setting to correct the port settings in the IOR > /subsystem=jacorb/ior-settings=default/setting=transport-config:add(confidentiality=required) > - Shouldn't setting "server-requires=ServerAuth" change the port info in the IOR? -- This message was sent by Atlassian JIRA (v6.4.11#64026)

10 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFLY-5274) EJB IOR contains wrong port (non-SSL port) information when SSL is required

by Brian Stansberry (JIRA)

[ https://issues.jboss.org/browse/WFLY-5274?page=com.atlassian.jira.plugin.... ] Brian Stansberry updated WFLY-5274: ----------------------------------- Component/s: IIOP > EJB IOR contains wrong port (non-SSL port) information when SSL is required > --------------------------------------------------------------------------- > > Key: WFLY-5274 > URL: https://issues.jboss.org/browse/WFLY-5274 > Project: WildFly > Issue Type: Bug > Components: IIOP > Reporter: Derek Horton > Assignee: Jason Greene > > Description of problem: > - Configure JBoss to only allow IIOP connections over SSL > - It is possible to do this, but the configuration is confusing (possibly a bug) > Details of the setup/issue: > - When enabling SSL for jacorb, it normally listens on both the non-ssl port and the ssl port > - Setting server-requires="ServerAuth" causes the server to stop listening on non-ssl port > - However, the IOR tells client to connect to non-ssl port ...even though its not listening on it > String lookup = "corbaname:iiop:" + host + ":" + port +"#" + ejbLookupPath; > // lookup the IIOP EJB > Object iiopObj = ctx.lookup(lookup); > // the call to the EJB will fail due to the port being wrong non-ssl vs ssl > - The workaround is to use the following ior-setting to correct the port settings in the IOR > /subsystem=jacorb/ior-settings=default/setting=transport-config:add(confidentiality=required) > - Shouldn't setting "server-requires=ServerAuth" change the port info in the IOR? -- This message was sent by Atlassian JIRA (v6.4.11#64026)

10 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFLY-5274) EJB IOR contains wrong port (non-SSL port) information when SSL is required

by Brian Stansberry (JIRA)

[ https://issues.jboss.org/browse/WFLY-5274?page=com.atlassian.jira.plugin.... ] Brian Stansberry reassigned WFLY-5274: -------------------------------------- Assignee: Tomasz Adamski (was: Jason Greene) > EJB IOR contains wrong port (non-SSL port) information when SSL is required > --------------------------------------------------------------------------- > > Key: WFLY-5274 > URL: https://issues.jboss.org/browse/WFLY-5274 > Project: WildFly > Issue Type: Bug > Components: IIOP > Reporter: Derek Horton > Assignee: Tomasz Adamski > > Description of problem: > - Configure JBoss to only allow IIOP connections over SSL > - It is possible to do this, but the configuration is confusing (possibly a bug) > Details of the setup/issue: > - When enabling SSL for jacorb, it normally listens on both the non-ssl port and the ssl port > - Setting server-requires="ServerAuth" causes the server to stop listening on non-ssl port > - However, the IOR tells client to connect to non-ssl port ...even though its not listening on it > String lookup = "corbaname:iiop:" + host + ":" + port +"#" + ejbLookupPath; > // lookup the IIOP EJB > Object iiopObj = ctx.lookup(lookup); > // the call to the EJB will fail due to the port being wrong non-ssl vs ssl > - The workaround is to use the following ior-setting to correct the port settings in the IOR > /subsystem=jacorb/ior-settings=default/setting=transport-config:add(confidentiality=required) > - Shouldn't setting "server-requires=ServerAuth" change the port info in the IOR? -- This message was sent by Atlassian JIRA (v6.4.11#64026)

10 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFLY-5500) While deploying .ear to wildfly it is in .isdeploying mode , not fully depolyed

by Brian Stansberry (JIRA)

[ https://issues.jboss.org/browse/WFLY-5500?page=com.atlassian.jira.plugin.... ] Brian Stansberry resolved WFLY-5500. ------------------------------------ Resolution: Incomplete Description > While deploying .ear to wildfly it is in .isdeploying mode , not fully depolyed > ------------------------------------------------------------------------------- > > Key: WFLY-5500 > URL: https://issues.jboss.org/browse/WFLY-5500 > Project: WildFly > Issue Type: Feature Request > Reporter: Mullainathan Subramanian > Assignee: Jason Greene > -- This message was sent by Atlassian JIRA (v6.4.11#64026)

10 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFLY-5450) Update to Hibernate Core 5.0.4.Final

by Brian Stansberry (JIRA)

[ https://issues.jboss.org/browse/WFLY-5450?page=com.atlassian.jira.plugin.... ] Brian Stansberry updated WFLY-5450: ----------------------------------- Component/s: JPA / Hibernate > Update to Hibernate Core 5.0.4.Final > ------------------------------------ > > Key: WFLY-5450 > URL: https://issues.jboss.org/browse/WFLY-5450 > Project: WildFly > Issue Type: Component Upgrade > Components: JPA / Hibernate > Reporter: Martin Kamp Jensen > Assignee: Jason Greene > Fix For: 10.0.0.Final > > > Please, if possible, include the latest Hibernate Core bugfix release in the final version of WildFly 10. -- This message was sent by Atlassian JIRA (v6.4.11#64026)

10 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFLY-5632) Unable to configure https using CLI with attribute enabled-cipher-suites

by Stuart Douglas (JIRA)

Stuart Douglas created WFLY-5632: ------------------------------------ Summary: Unable to configure https using CLI with attribute enabled-cipher-suites Key: WFLY-5632 URL: https://issues.jboss.org/browse/WFLY-5632 Project: WildFly Issue Type: Bug Components: Web (Undertow) Reporter: Martin Choma Assignee: Stuart Douglas User is unable to configure https using enabled-cipher-suites attribute {code} [standalone@localhost:9990 /] /core-service=management/security-realm=FIPSRealm:add {"outcome" => "success"} [standalone@localhost:9990 /] /core-service=management/security-realm=FIPSRealm/server-identity=ssl:add(keystore-provider=PKCS11, keystore-password="NSS FIPS 140-2 Certificate DB") { "outcome" => "success", "response-headers" => { "operation-requires-reload" => true, "process-state" => "reload-required" } } [standalone@localhost:9990 /] /subsystem=undertow/server=default-server/https-listener=https:add(socket-binding=https, security-realm=FIPSRealm, enabled-cipher-suites="DHE", enabled-protocols="TLSv1") { "outcome" => "failed", "failure-description" => {"WFLYCTL0080: Failed services" => {"jboss.undertow.listener.https" => "org.jboss.msc.service.StartException in service jboss.undertow.listener.https: Failed to start service Caused by: java.lang.NullPointerException"}}, "rolled-back" => true, "response-headers" => {"process-state" => "reload-required"} } {code} {code} 14:52:20,753 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-1) MSC000001: Failed to start service jboss.undertow.listener.https: org.jboss.msc.service.StartException in service jboss.undertow.listener.https: Failed to start service at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1904) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) Caused by: java.lang.NullPointerException at org.wildfly.extension.undertow.HttpsListenerService.startListening(HttpsListenerService.java:120) at org.wildfly.extension.undertow.ListenerService.start(ListenerService.java:138) at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1948) at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1881) ... 3 more 14:52:20,753 ERROR [org.jboss.as.controller.management-operation] (management-handler-thread - 2) WFLYCTL0013: Operation ("add") failed - address: ([ ("subsystem" => "undertow"), ("server" => "default-server"), ("https-listener" => "https") ]) - failure description: {"WFLYCTL0080: Failed services" => {"jboss.undertow.listener.https" => "org.jboss.msc.service.StartException in service jboss.undertow.listener.https: Failed to start service Caused by: java.lang.NullPointerException"}} {code} This works OK. It means reload is used between commands {code} /core-service=management/security-realm=FIPSRealm:add /core-service=management/security-realm=FIPSRealm/server-identity=ssl:add(keystore-provider=PKCS11, keystore-password="NSS FIPS 140-2 Certificate DB") reload /subsystem=undertow/server=default-server/https-listener=https:add(socket-binding=https, security-realm=FIPSRealm, enabled-cipher-suites="DHE", enabled-protocols="TLSv1") {code} Also same commands without enabled-cipher-suites works OK {code} /core-service=management/security-realm=FIPSRealm:add /core-service=management/security-realm=FIPSRealm/server-identity=ssl:add(keystore-provider=PKCS11, keystore-password="NSS FIPS 140-2 Certificate DB") /subsystem=undertow/server=default-server/https-listener=https:add(socket-binding=https, security-realm=FIPSRealm, enabled-protocols="TLSv1") {code} -- This message was sent by Atlassian JIRA (v6.4.11#64026)

10 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFLY-926) Jboss AS 7.1.1 / Jboss EAP 6.0 Beta2 : Jboss use weakeness security cipher algorithm (Blowfish 56 bits)) to encrypted DataSource Password

by Brian Stansberry (JIRA)

[ https://issues.jboss.org/browse/WFLY-926?page=com.atlassian.jira.plugin.s... ] Brian Stansberry resolved WFLY-926. ----------------------------------- Resolution: Rejected Resolving based on Arun's comment. > Jboss AS 7.1.1 / Jboss EAP 6.0 Beta2 : Jboss use weakeness security cipher algorithm (Blowfish 56 bits)) to encrypted DataSource Password > ----------------------------------------------------------------------------------------------------------------------------------------- > > Key: WFLY-926 > URL: https://issues.jboss.org/browse/WFLY-926 > Project: WildFly > Issue Type: Bug > Components: Domain Management, Security > Environment: Jboss EAP 6.0 Beta2 > Jboss AS 7.1.1 > Linux RHEL 5.4 > JDK 1.6.0_24 > Reporter: Yannick LE NY > Assignee: Stefan Guilhen > > In Jboss EAP 6.0 Beta2 or Jboss AS 7.1.1, Jboss use weakeness cipher algorithm (Blowfish 56bits) to encrypted DataSource Password. > http://middlewaremagic.com/jboss/?p=1026 said : > "JBoss AS7 uses picketbox security implementations. In this example we will see how we can provide an Encrypted Password for our DataSources rather than using the ClearText Password. The picketbox provides us a class for encrypting the Cleartext passwords using class "org.picketbox.datasource.security.SecureIdentityLoginModule"." > When you search about the org.picketbox.datasource.security.SecureIdentityLoginModule java class on the Internet, you find this source file > http://grepcode.com/file/repository.jboss.org/nexus/content/repositories/... . > In the file SecureIdentityLoginModule.java, we can see that this is the weakness Blowfish cipher algorithm (line Cipher cipher = Cipher.getInstance("Blowfish"); ) > that is used by the Cipher getInstance function : > (http://docs.oracle.com/javase/6/docs/api/javax/crypto/Cipher.html#getInst... ) > Blowfish info : http://en.wikipedia.org/wiki/Blowfish_%28cipher%29 > Weakness because, by default, the JDK use Blowfish with 56 bits key : > Source : http://docs.oracle.com/javase/1.5.0/docs/guide/security/CryptoSpec.html#AppB > Extract : The SunJCE provider uses the following default keysizes: KeyGenerator : Blowfish: 56 bits > org.picketbox.datasource.security.SecureIdentityLoginModule class use javax.crypto.Cipher class. > As you can see at : http://docs.oracle.com/javase/6/docs/api/javax/crypto/Cipher.html#getInst..., > getInstance function can use several cipher Algorithms. > The cipher Algorithms available are : > http://docs.oracle.com/javase/1.5.0/docs/guide/security/CryptoSpec.html#AppA (part Cipher) > http://docs.oracle.com/javase/6/docs/technotes/guides/security/crypto/Cry... > Then can you replace the weakness Blowfish Cipher Algorithm used to encrypted DataSource Password by > AES-256 ? > Note : The security team in my big company want now that all the application servers used in the company use strong > cipher algorithm as 3DES used by Oracle Weblogic 10 or as AES-256 used by Oracle Weblogic 11. -- This message was sent by Atlassian JIRA (v6.4.11#64026)

10 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFCORE-1105) Not able to enable JMX Remote access

by Brian Stansberry (JIRA)

[ https://issues.jboss.org/browse/WFCORE-1105?page=com.atlassian.jira.plugi... ] Brian Stansberry moved WFLY-4412 to WFCORE-1105: ------------------------------------------------ Project: WildFly Core (was: WildFly) Key: WFCORE-1105 (was: WFLY-4412) Component/s: Domain Management Logging (was: Class Loading) (was: Domain Management) (was: Logging) Affects Version/s: (was: 8.2.0.Final) > Not able to enable JMX Remote access > ------------------------------------ > > Key: WFCORE-1105 > URL: https://issues.jboss.org/browse/WFCORE-1105 > Project: WildFly Core > Issue Type: Bug > Components: Domain Management, Logging > Environment: windows & linux > Reporter: Shark Xu > Assignee: David Lloyd > > Can not enable JMX remote access port. > Config in domain.xml: > <jvm-options> > <option value="-Dcom.sun.management.jmxremote.port=19999"/> > <option value="-Dcom.sun.management.jmxremote.authenticate=false"/> > <option value="-Dcom.sun.management.jmxremote.ssl=false"/> > </jvm-options> > java.lang.IllegalStateException raised during startup. > Logs: > [Server:server-one] Exception in thread "main" java.lang.IllegalStateException: The LogManager was not properly installed (you must set the "java.util > .logging.manager" system property to "org.jboss.logmanager.LogManager") > [Server:server-one] at org.jboss.logmanager.Logger.getLogger(Logger.java:61) > [Server:server-one] at org.jboss.as.server.DomainServerMain.main(DomainServerMain.java:86) > [Server:server-one] at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) > [Server:server-one] at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) > [Server:server-one] at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) > [Server:server-one] at java.lang.reflect.Method.invoke(Method.java:606) > [Server:server-one] at org.jboss.modules.Module.run(Module.java:312) > [Server:server-one] at org.jboss.modules.Main.main(Main.java:460) -- This message was sent by Atlassian JIRA (v6.4.11#64026)

10 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFLY-5615) Security module options not parsed

by Brian Stansberry (JIRA)

[ https://issues.jboss.org/browse/WFLY-5615?page=com.atlassian.jira.plugin.... ] Brian Stansberry resolved WFLY-5615. ------------------------------------ Resolution: Cannot Reproduce Bug Using the correct address works fine: {code} [standalone@localhost:9990 /] /subsystem=security/security-domain=myDomain/authentication=classic/login-module=myauth:read-resource(recursive=true) { "outcome" => "success", "result" => { "code" => "Simple", "flag" => "optional", "module" => undefined, "module-options" => undefined } } [standalone@localhost:9990 /] /subsystem=security/security-domain=myDomain/authentication=classic/login-module=myauth2:read-resource(recursive=true) { "outcome" => "success", "result" => { "code" => "SimpleUsers", "flag" => "sufficient", "module" => undefined, "module-options" => { "foo" => "bar", "one" => "two" } } } {code} > Security module options not parsed > ---------------------------------- > > Key: WFLY-5615 > URL: https://issues.jboss.org/browse/WFLY-5615 > Project: WildFly > Issue Type: Bug > Components: Domain Management, Security > Affects Versions: 10.0.0.CR4 > Reporter: Heiko Braun > Assignee: Brian Stansberry > Priority: Critical > > I've created a login module with several options and the result appears in standalone.xml. However when I read the resource using the CLI, these options are not shown. > {noformat} > <security-domain name="myDomain" cache-type="default"> > <authentication> > <login-module name="myauth" code="Simple" flag="optional"/> > <login-module name="myauth2" code="SimpleUsers" flag="sufficient"> > <module-option name="foo" value="bar"/> > <module-option name="one" value="two"/> > </login-module> > </authentication> > </security-domain> > {noformat} > {noformat} > [standalone@localhost:9990 /] /subsystem=security/security-domain=myDomain/authentication=classic/login-module=myauth:read-resource(recursive=true) > { > "outcome" => "success", > "result" => { > "code" => "Simple", > "flag" => "optional", > "module" => undefined, > "module-options" => undefined > } > } > {noformat} -- This message was sent by Atlassian JIRA (v6.4.11#64026)

10 years, 8 months

1
0
0 / 0

[JBoss JIRA] (WFLY-5631) Undertow.js 1.0.1.Final

by Stuart Douglas (JIRA)

[ https://issues.jboss.org/browse/WFLY-5631?page=com.atlassian.jira.plugin.... ] Stuart Douglas moved JBEAP-1764 to WFLY-5631: --------------------------------------------- Project: WildFly (was: JBoss Enterprise Application Platform) Key: WFLY-5631 (was: JBEAP-1764) Component/s: Web (Undertow) (was: Web (Undertow)) > Undertow.js 1.0.1.Final > ----------------------- > > Key: WFLY-5631 > URL: https://issues.jboss.org/browse/WFLY-5631 > Project: WildFly > Issue Type: Component Upgrade > Components: Web (Undertow) > Reporter: Stuart Douglas > Assignee: Stuart Douglas > -- This message was sent by Atlassian JIRA (v6.4.11#64026)

10 years, 8 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-jira November 2015