I have my parameters in a properties file.
managerDn=cn=read-only-admin,dc=example,dc=com
managerPassword=69BPoqG3sWr/MNspi4ZsDw==
server=ldaps://server.local:636
groupSearchBase=ou=test,dc=example,dc=com
base=dc=example,dc=coms
My password is encrypted, but the client told me: all you have done is encrypt the password and we need it Obfuscating ie making so that no one can read it.
Any idea?
Maybe the best option is to base64 encode the entire property file. It's not encryption but and more "obfuscation". To do this you could do something like this:
//encode:
def encoded = file.text.bytes.encodeBase64().toString()
//decode:
def password = new String(file.text.decodeBase64())
Your property file would like this:
bWFuYWdlckRuPWNuPXJlYWQtb25seS1hZG1pbixkYz1leGFtcGxlLGRjPWNvbQ0KbWFuYWdlclBhc3N3b3JkPTY5QlBvcUczc1dyL01Oc3BpNFpzRHc9PQ0Kc2VydmVyPWxkYXBzOi8vc2VydmVyLmxvY2FsOjYzNg0KZ3JvdXBTZWFyY2hCYXNlPW91PXRlc3QsZGM9ZXhhbXBsZSxkYz1jb20NCmJhc2U9ZGM9ZXhhbXBsZSxkYz1jb21z
here is a link that might help with base64 in Groovy.
NOTE: This really doesn't make anything more secure it's just hiding the plain text. Anyone that knows what they're looking at would decode it the same way you would. It would seem your client isn't familiar with this type of security. There are more secure ways of doing this. You may want to look into salting the actual encryption process or using a token exchange with another service to give you the password.
Related
I have a camel route that looks like the next one:
from("direct:download")
.pollEnrich()
.simple("sftp://my.host:22/folder/?username=foo&fileName=${header.CamelFileName}
&privateKeyFile=src/main/resources/privateSSHKey")
.to("file://state/downloaded");
The file src/main/resources/privateSSHKey is an RSA private key. That works without a problem : JSCH (library used by Camel for the SFTP endpoint) manages to connect and download the desired file.
The previous setup is ok while developing, because I can have the file with the key locally.
However, for prod, we have other system in which I will be able to get a byte array with the content of the key. For that, I am changing the route to look like this:
from("direct:download")
.pollEnrich()
.simple("sftp://my.host:22/folder/?username=foo&fileName=${header.CamelFileName}
&privateKey=" + URLEncoder.encode(new String(sshPrivateKey), "UTF-8"))
.to("file://state/downloaded");
...being sshPrivateKey the byte array. Unfortunately, I always get "auth_cancel" from JSCH, and debugging I can see that this happens when trying to handshake with the SFTP server.
Am I missing something? I am pretty sure that encoding the sshPrivateKey byte[] is the way to go (JSCH was complaining about wrong key if I didn't do it), but I am not sure about what else I am missing?
The origin of the problem is the encoding, the URLEncoding, byte and String can loose some character like + or \\.
I managed to make it work with Byte[] parameter for privateKey method Java DSL.
Example:
String privateKeyString = Files.readString(Path.of("/.ssh/private_key_rsa"), StandardCharsets.UTF_8);
getCamelContext().getRegistry().bind("myPrivateKey", privateKeyString.toByteArray())
from("file://tmp")
.to(sftp("localhost")
.username("test")
.privateKey("#myPrivateKey"));
Is there any way that i can encrypt password in log4j.properties
following is my appender
log4j.appender.DB=org.apache.log4j.jdbc.JDBCAppender
log4j.appender.DB.URL=jdbc:mysql://localhost:3306/anilpractice
log4j.appender.DB.driver=com.mysql.jdbc.Driver
log4j.appender.DB.user=root
log4j.appender.DB.password=P#ssw0rd
log4j.appender.DB.sql=INSERT INTO logs VALUES('%x','%d{dd MMM yyyy HH:mm:ss}','%C','%p','%m')
log4j.appender.DB.layout=org.apache.log4j.PatternLayout
Please help me out how can i encrypt .password tag?
thank you all.
Thank God, Finally got some solution to keep encrypted password in Log4j.properties
What all we have to do is,
Replicate JDBCAppender class of log4j.jar.
Modify the definition of
public void setPassword(String password)
{
this.databasePassword = password;
}
in JDBCAppender
according to your need And replace that class in log4j.jar.
I don't think that is possible. Even if it's possilbe, consider the following:
If you can establish a connection by only providing an "encrypted password", it's like the password is not encrypted, because everyone who copies the encrypted password can connect and compromise your database. The only different is, that the password is presented in a different way and maybe less human readable, but still fully useful. Even if you implement some symetric unencription of the password in your code, if the attacker has access to your configuration file containing the encrypted password, it is very likely that he has also access to your code running on the same machine containing the unencryption algorithm and would be able to decompile and read the algorithm.
Better create a DB-User with restricted access rights to only write into the logging table. In this way a stolen password can't harm your database very much.
I want a user to be able to submit a url, and then display that url to other users as a link.
If I naively redisplay what the user submitted, I leave myself open to urls like
http://somesite.com' ><script>[any javacscript in here]</script>
that when I redisplay it to other users will do something nasty, or at least something that makes me look unprofessional for not preventing it.
Is there a library, preferably in java, that will clean a url so that it retains all valid urls but weeds out any exploits/tomfoolery?
Thanks!
URLs having ' in are perfectly valid. If you are outputting them to an HTML document without escaping, then the problem lies in your lack of HTML-escaping, not in the input checking. You need to ensure that you are calling an HTML encoding method every time you output any variable text (including URLs) into an HTML document.
Java does not have a built-in HTML encoder (poor show!) but most web libraries do (take your pick, or write it yourself with a few string replaces). If you use JSTL tags, you get escapeXml to do it for free by default:
ok
Whilst your main problem is HTML-escaping, it is still potentially beneficial to validate that an input URL is valid to catch mistakes - you can do that by parsing it with new URL(...) and seeing if you get a MalformedURLException.
You should also check that the URL begins with a known-good protocol such as http:// or https://. This will prevent anyone using dangerous URL protocols like javascript: which can lead to cross-site-scripting as easily as HTML-injection can.
I think what you are looking for is output encoding. Have a look at OWASP ESAPI which is tried and tested way to perform encoding in Java.
Also, just a suggestion, if you want to check if a user is submitting malicious URL, you can check that against Google malware database. You can use SafeBrowing API for that.
You can use apache validator URLValidator
UrlValidator urlValidator = new UrlValidator(schemes);
if (urlValidator.isValid("http://somesite.com")) {
//valid
}
I need some pointers how to update an encrypted password in an LDAP (OpenLDAP) of a user within an LDAP tree. The passwords in the LDAP server are prefixed with {crypt} which I suppose indicates that it is encrypted (with DES?)
I need to write a method which updates a user's passwords. What is the right way to do this? Do I need to prefix the string with {crypt} myself? How do I encrypt the password for {crypt}?
UPDATE:
Just to clarify what I need is the Java code to encrypt the attribute so that it works with {crypt}. I also don't know if I have to prefix the attribute with the string {crypt} myself.
No, you just need to update the attribute, just like any other attribute, but remembering that unlike most attributes it is a byte[] not a String.
There is also an ExtendedOperation for password modification in association with the Password Policy IETF draft, but you haven't mentioned you're using that.
In some cases, using a pre-encoded password might prevent the directory server from enforcing password quality checks.
I have a properties file in java, in which I store all information of my app, like logo image filename, database name, database user and database password.
I can store the password encrypted on the properties file. But, the key or passphrase can be read out of the jar using a decompiler.
Is there a way to store the db pass in a properties file securely?
There are multiple ways to manage this. If you can figure out a way to have a user provide a password for a keystore when the application starts up the most appropriate way would be to encrypt all the values using a key, and store this key in the keystore. The command line interface to the keystore is by using keytool. However JSE has APIs to programmatically access the keystore as well.
If you do not have an ability to have a user manually provide a password to the keystore on startup (say for a web application), one way to do it is to write an exceptionally complex obfuscation routine which can obfuscate the key and store it in a property file as well. Important things to remember is that the obfuscation and deobfuscation logic should be multi layered (could involve scrambling, encoding, introduction of spurious characters etc. etc.) and should itself have at least one key which could be hidden away in other classes in the application using non intuitive names. This is not a fully safe mechanism since someone with a decompiler and a fair amount of time and intelligence can still work around it but is the only one I know of which does not require you to break into native (ie. non easily decompilable) code.
You store a SHA1 hash of the password in your properties file. Then when you validate a users password, you hash their login attempt and make sure that the two hashes match.
This is the code that will hash some bytes for you. You can easily ger bytes from a String using the getBytes() method.
/**
* Returns the hash value of the given chars
*
* Uses the default hash algorithm described above
*
* #param in
* the byte[] to hash
* #return a byte[] of hashed values
*/
public static byte[] getHashedBytes(byte[] in)
{
MessageDigest msg;
try
{
msg = MessageDigest.getInstance(hashingAlgorithmUsed);
}
catch (NoSuchAlgorithmException e)
{
throw new AssertionError("Someone chose to use a hashing algorithm that doesn't exist. Epic fail, go change it in the Util file. SHA(1) or MD5");
}
msg.update(in);
return msg.digest();
}
No there is not. Even if you encrypt it, somebody will decompile the code that decrypts it.
You could make a separate properties file (outside the jar) for passwords (either direct DB password or or key passphrase) and not include that properties file with the distribution. Or you might be able to make the server only accept that login from a specific machine so that spoofing would be required.
In addition to encrypting the passwords as described above put any passwords in separate properties file and on deployment try to give this file the most locked down permissions possible.
For example, if your Application Server runs on Linux/Unix as root then make the password properties file owned by root with 400/-r-------- permissions.
Couldn't you have the app contact a server over https and download the password, after authenticating in some way of course?