JSF 2.0 (EE 6) Feature Red Hat JBoss EAP 6

Feature in JSF 2.0 (EE 6) GitHub JsfApplicationJboss.

Using JAAS in Tomcat Example

JAAS is part of the Java SE since Java 5, so choosing that API, when you want to deploy to only a web container, such as Tomcat or Jetty, is a good choice.

/META-INF/context.xml. See where best to put your configuration How to handle Configuration in Tomcat with Context

<?xml version="1.0" encoding="UTF-8"?>
<Context>
  <Realm className="org.apache.catalina.realm.JAASRealm" 
    appName="BytesLoungeLogin"
    userClassNames="com.byteslounge.jaas.UserPrincipal"
    roleClassNames="com.byteslounge.jaas.RolePrincipal" />
</Context>

$CATALINA_BASE/conf/jaas.config

BytesLoungeLogin {
    com.byteslounge.jaas.BytesLoungeLoginModule required debug=true;
};

And starting

JAVA_OPTS=$JAVA_OPTS "-Djava.security.auth.login.config==$CATALINA_BASE/conf/jaas.config"

JAAS authentication in Tomcat example

Scanning Your System with OpenSCAP

With SCAP and a good policy you can centrally scan your system and verify that they are properly secured and get a nice automatically report at the end.

Resource

• What Are “STIGs” and How Do They Impact Your Overall Security Program?
• OpenSCAP Choosing a Policy
• STIG List

Java Smart Card APDU Commands

Almost all smart card are Java Smart Card based. You can manage smart card via the Java Smart Card SDK, but you can also access the card via standard Java SE and javax.smartcardio API.To do that you need to know the card and card type native APDU commands, here are some examples.

https://joinup.ec.europa.eu/svn/mocca/branches/mocca-1.3.4-cardmgmt/smccTest/src/main/java/at/gv/egiz/smcctest/PKCS15Test.java

Requiring SSL client authentication in a user friendly way in Apache

Requiring SSL client authentication in a user friendly way in Apache

Remember when downgrading to 'SSLVerifyClient require', you also weaken your defense from DOS attacks.

OWASP XSS (Cross-Site Scripting)

XSS is all about scripts sent to a web page and typically it is javascripts.

There are three types of XSS: Stored XSS, Reflected XSS and DOM based XSS

Top 10-2017 A7-Cross-Site Scripting (XSS)

https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet

To protect against XSS, you must have a strong Data Validation:

1. Accept known good otherwise reject (white list), e.g. phone number, only ascii [a-zA-Z0-9])
2. Sanitize. i.e. change the user input into an acceptable format. See Input Validation - OWASP Java HTML Sanitizer
3. Reject known bad (blacklist), e.g. , ' (SQL injection)

OWASP Data Validation

Beside Data Validation, you should add OWASP Security HTTP Headers. And especially 'X-XSS-Protection: 1; mode=block'.

Oracle Code One 2018 Hacking and Hardening Java Web Applications

https://s3.amazonaws.com/cmj-presentations/Hacking+and+Hardening+Java+Web+Apps+-+OC12018.pdf

Kali Linux Varient Virtual Machine https://s3.amazonaws.com/cmj-presentations/hacking-uberconf-2016/hhjwa-2016.1-vbox-amd64.ova

https://s3.amazonaws.com/cmj-presentations/hacking-rwx-2017/Hacking_and_Hardening_Java_Web_Applications.pdf

https://github.com/cjudd/wordyninjablog

https://github.com/cjudd/hacking-and-hardening-java-web-apps-workshop