Develop Reference

Hide or encrypt credentials for JMeter completely?

can I have some ideas on security in JMeter please?
in order to use JMeter behind a corporate proxy the following format can be used to launch from the command line:
jmeter -H localhost -P 8888 -u username -a password -N localhost
Once JMeter is opened (and usual https certificate process followed) I use JMeter recorder to access a corporate application and complete usual business processes (including entering login details).
There are at least two issues with this approach:
a) network scans record any java application being run, with credentials in plain text
b) the JMX file produced has credentials saved in plain text, from when user logs into any secure application.
For the first issue, is it possible to change the http.proxyPass and http.proxyUser values? If so, how best to secure them to prevent anyone monitoring the network from seeing them?
For second issue, how best to hide this information? Parameterize the relevant http requests after manually checking the entire project? The most secure way would be to avoid using the recorder but this would be impractical.
Thanks, D

Any data will be stored in the .jmx test script as plain text.
If you don't want it to appear there you can:
Add User Defined Variables and define the JMeter Variables reference names with their respective values which you want to substitute there
During recording HTTP(S) Test Script Recorder will automatically substitute the values with the JMeter Variables
Replace hard-coded sensitive values with __P() functions
When you will be executing JMeter test you will be able to provide values in the runtime via -J command-line arguments as:
jmeter -Jusername=secret-username -Jpassword=secret-password etc.

Securely pass password to PuTTY process on start

I am maintaining an application in our company (written in C#), which runs on a jumphost and provides the functionality to search across different servers and initiate a PuTTY connection to that server. For this the application currently starts the PuTTY process and passes arguments, like the hostname, username and password. The password for each server is retrieved from a password manager service. The arguments are passed to PuTTY through the command line interface. So the purpose of the application is to automate password retrieval and login to different servers.
The problem with the current approach is, that in the Windows Task Manager its possible for an administrator to see all started PuTTY instances and the corresponding credentials as command line arguments.
So far I haven't found any practical solution to circumvent this. These are the things I researched so far:
Instead of passing password argument, using SendKeys to type password into the promt: Unreliable, as there is no way to read the PuTTY output and know when the application is ready for the input to be typed in.
Using Plink instead of PuTTY and passing arguments through stdin: Plink supports stdin / stdout communication, however the terminal functionality is very limited and not usable in practice after the login was successful.
Modifying PuTTY to mask password: I have seen some suggestions, to modify the PuTTY source code, to overwrite the password in the main args, once the application started. However, this solution seems to only work on Linux, not Windows.
Using SSH.NET library to provide my own SSH terminal implementation: The SSH.NET library seems to be similarly to Plink more suitable for issuing commands programmatically, but not for opening a terminal for the user. I guess it would require a lot of work to implement a full terminal.
Some ideas, that might work:
Modify the PuTTY code, so that arguments can be passed through stdin: Could work, but I don't know how easy that would be, as I don't have very good C knowledge.
Use an alternate client, that supports stdin output. The Java library JSch looks quite powerful and seems to already include a terminal. Would it be possible to create a standalone application, that can a receive stdin and use that to open a terminal and auto login?
Any further suggestions would be greatly appreciated. Are you aware of any other Windows alternative to PuTTY, which supports passing credentials in a more secure way?

Following the suggestion of Martin Prikryl I was able to create a minimal example, which creates a NamedPipe in C# and passes it as a pwfile argument to PuTTY:
public void CreatePipe()
{
var server = new NamedPipeServerStream("SecretPipe");
server.WaitForConnection();
StreamWriter writer = new StreamWriter(server);
writer.Write("top!!secret");
writer.Flush();
server.Dispose();
}
Then PuTTY can be started as follows with the pipe as pwfile argument:
putty.exe -l testuser -pwfile "\\.\PIPE\SecretPipe" hostname

Since 0.77, PuTTY can read the password from a file using -pwfile switch.

Jasypt: how secure master password?

Colleagues, i used Jasypt in my spring-boot project (standalone jar running on Windows).
I need to pass master password via command line to run jar .
It looks like:
java -jar -Djasypt.encryptor.password=masterpass app-1.0.0-RELEASE.jar
So anybody can see masterpass via Windows Task Manager:
How to secure this masterpass?
I have found an example where master password is stored in Windows Environment variable, but, it seems, no good idea.

It is generally very difficult to hide anything when running on the client's workstation. At the end - when passwords/keys are encrypted, you need to store the password or private key somewhere anyway :/
You can encode/encrypt data to make it more difficult, but once the binaries and configuration reside at the client side, you won't stop a dedicated adversary easily.
If you at least don't want to show the password outside (in the environment or command line) - how about reading the master password from a file and setting a system property in the main before running anything else?
(please let me know if it worked)

At least you should not provide the master-password via commandline option as if other users have access to the machine they can retrieve it from the process list.
Instead provide it via a separate configuration file. So in case you are using spring-boot and have your regular env properties in config/application.properties then simply add a config/application.yml file with just the master-password and keep that only on the machine with only user permissions (chmod go -rxw). See e.g. here:
https://github.com/oasp/oasp4j/wiki/guide-configuration#password-encryption
Everything else from the installation may come from your git repo where people with access only see encrypted passwords but can not decrypt unless they have the master-password what they do not have if they have no physical access to the productive machine. Operators may provide the passwords only encrypted to the dev team so they never know the actual passwords. DevOps gurus might not like this but keeping the passwords secret to a minimum number of admins is generally good for security.

Using TGT acquired in Java for SSH/Other applications

Currently, I am able to authenticate users in a java application by using JAAS and grabbing the ticket-granting-ticket that is sent from a Windows server running Active Directory. This is easily done with the Krb5LoginModule in java.
Now I would like to run an ssh command from my java application and use my TGT to enable ssh not to ask for password. I have seen some tutorials (OpenSSH & Kerberos) for getting ssh to work with kerberos, but they use kinit to get their TGT and the ticket is stored in /tmp/krbcc_XXX. Then after the ticket is generated they can ssh freely.
I could write the TGT to disk and store it in /tmp/krbcc_XXX or I could run the ssh command in a PrivilegedAction, however I don't know if either will work. Is there an accepted way to do this?
Basically, I would like to call something like this and have it not ask me for a password:
// Create Command.
List<String> arguments = new ArrayList<String>();
arguments.addAll(Arrays.asList("ssh", "user#host", "xterm"));
// Run SSH command.
ProcessBuilder process = new ProcessBuilder(arguments).start();

You have to clarify first who will initiate the SSH request. Java or the underlying Linux/Unix system. If you go with the latter, this is not cross-platform and not the Java way. You should use a Java SSH impl which supports Keberos. Everything should go smooth. JSch is a pure Java impl with gss-api-with-mic support.
On the other hand, you could try to get the private credentials from the Subject created with the LoginContext and write it to the default CC file location.. After you have done that, try klist. If it reads the cc file, you're done. If this does not work, you could examine Sun's CC reader code and reverse it. Probably, the sun.security.krb5.internal.ccache.FileCredentialsCache is the interesting one along with its update and save methods. The task is to have the private subject credentials be compatible with the desired class sun.security.krb5.internal.ccache.Credentials.
Note: This solution is completely Sun-dependent. I would go for the first approach or you rather run kinit first.

how to ssh onto a host without password using java

Im currently using a java application to run commands on a unix box by invoking an instance of the bash as follows --
proc = Runtime.getRuntime().exec("/bin/bash", null, wd);
and Im executing commands on the box by Printwriter as follows --
PrintWriter out = new PrintWriter(new BufferedWriter(new OutputStreamWriter(proc.getOutputStream())), true);
Now, as a requirement I need to ssh onto another host, invoke an instance of that host's bash and run some commands. If this can be done without having to enter the password, it would be great. If not, how do I make the application to enter the 'password' at the right time? Reading the output of the shh command and based on that, writing out the password does not seem appealing.
Any pointers on the above would be of great help.
Regards
p1nG

Use a ssh-library written in Java instead of runtime-exec'ing a ssh program.

You can use SSH-2 for java, which seems to be actively maintained.
Alternatively, set up a pubic/private key for password-less authentication, and store the private key in the ~/.ssh folder of the user running the java program.

You can setup password-less SSH authentication. Here is a step by step guide for setting up the same.
http://manjeetdahiya.com/2011/03/03/passwordless-ssh-login/

I can't imagine how you're going to avoid supplying a password. If you could log in to a system without supplying a password just by somehow telling it that supplying a password would be inconvenient for you, this would rather destroy the value of any security. Security Guard: "Do you have an ID that allows you access to this building?" Visitor: "Yes officer, but it's too much trouble to get it out of my wallet." Guard: "Oh, okay then, go rght ahead in."
Rather than exec'ing, you probably want to establish a socket connection and pass messages back and forth cleanly. Or as others have noted, use a library that does the grunt work for you.