Free SSL Certificate Authorities (CAs)

There are a few public key CAs that issue free SSL certificates via the Automated Certificate Management Environment protocol (ACME). So, this serves as a bookmark for these CAs.

• Let's Encrypt. 
• ZeroSSL. 
• Buypass Go SSL.

More detailed discussion about these three are in this blog post. This post and the discussion of the post have some useful information about these three, such as, support of wildcard certificates and ECC certifications.

Is the Password to the Private Key Correct?

When we generate a public-private key pair for public key cryptography, such as, RSA, we can use a password to control access to the private key. We would know if it is the case by viewing the content of the key file, e.g.,

$ sudo head -1 myprivatekey.key
-----BEGIN ENCRYPTED PRIVATE KEY-----

The problem is that I don't know which password is correct because I have a few. If we are using openssh, we can easily verify if a password is correct by using ssh-keygen with the -y option -- the manual states,

-y      This option will read a private OpenSSH format file and print an
        OpenSSH public key to stdout.

Knowing this, we verify whether a password is correct or not by

ssh-keygen -y -f ./myprivatekey.key; echo "exit code is " $?
Enter passphrase: xxxxxxxx
Load key "./myprivatekey.key": incorrect passphrase supplied to decrypt private key
exit code is  255

which shows that the password I entered was incorrect. However, we entered a correct one, we would observe,

ssh-keygen -y -f ./myprivatekey.key; echo "exit code is " $?
Enter passphrase: yyyyyyyy
exit code is  0

Running Out-dated JNLP Program

When attempted to launch the remote control JNLP Web Start program from a computer server, I encountered an error:

Unsigned application requesting unrestricted access to system
The following resource is signed with a weak signature algorithm MD5withRSA and is treated
as unsigned: http://192.168.1.5:80/Java/release/Win64.jar

The screen shot is also included,

The error is the result that Java has updated and the MD5withRSA should not be used any more. One work around is to temporary enable the MD5withRSA. One may change the Java security configuration by editing the java.security file. In my case, the file is C:\Program Files\Java\jre1.8.0_141\lib\security\java.security. You will find a line that disables a few algorithms, such as,

jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024

We can now simply comment out the line by adding a # at the beginning the line. The line should become,

#jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024

In addition, you may need to launch the Java Console, and add the site, in my case, http://192.168.1.5 in the "Exception Site List".

Free SSL Certificates

It has many benefits for using SSL to enable HTTPS for web services as discussed therein.  In fact, you can access this blog via HTTPS as Google states. It is possible that you can obtain free certificates from a very limited list of providers. Previously, I took a note on "Free SSL Certificates for Securing E-mails and Websites".

I came across Let's Encrypt that can provide free SSL certificates and has a protocol that allows a web service to obtain the certificates "on the fly".

Here is a list of information that may be of your interest before you try.  You can certainly find out the information for their website.

• Which browsers and operating systems support Let’s Encrypt?
• Root Certificates and chain of trust
• User community

Linux Capabilities

It had been for a long time that processes' permission on UNIX/Linux systems are differentiated into two categories, privileged or non-privileged processes. The effective user ID of privileged processes is 0 while that of non-privileged processes is nonzero. User ID 0 belongs to the superuser or root. Such a granularity were viewed as too coarse by many. Starting from Kernel 2.2,  Linux introduces the concept of capabilities that divides the privileges that traditionally associated with superuser into many categories. Linux manual page Capabilities has a good discussion on this topic.

Apparently,  many Linux programmers do  not seem to have a good understanding on this new development. Michael Kerrisk has statistics on the usage of different Linux capabilities. Perhaps, it is easier to get what you need by just assuming the privilege of the superuser than figuring out what you do not really need, which requires perhaps higher cognitive load and activity.

This post demonstrates a few usage of capabilities from an application programmer point of view. 

Packet Socket

Packet socket requires that the opening process has effective UID 0 or the CAP_NET_RAW capability. The following example program sends a message over an Ethernet.

#include <arpa/inet.h>
#include <net/ethernet.h>
#include <netinet/ether.h>
#include <netpacket/packet.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main(int argc, char *argv[])
{
    int sockfd;
    struct sockaddr_ll dest_addr;

    if (argc < 3) {
        printf("Usage: %s destination_host message\n", argv[0]);
        exit(0);
    }

    sockfd = socket(AF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL));

    if (sockfd == -1) {
        perror("Error calling socket(AF_PACKET, SOCK_DGRAM ...): ");
        exit(1);
    }


    /* When you send packets it is enough to specify sll_family, sll_addr,
     * sll_halen, sll_ifindex. The other fields should be 0. */
    memset(&dest_addr, '\0', sizeof(dest_addr));

    dest_addr.sll_family = AF_PACKET;
    dest_addr.sll_ifindex = 1;
    dest_addr.sll_halen = ETH_ALEN;

    if (ether_aton_r(argv[1],
            (struct ether_addr*)&(dest_addr.sll_addr)) == NULL) {
        fprintf(stderr,
            "Error: %s is not in the hex-digits-and-colons format.\n",
            argv[1]);
    }

   if (sendto(sockfd, argv[2], strlen(argv[2]), 0,
            (struct sockaddr*)&dest_addr, sizeof(dest_addr)) == -1) {
        perror("Error calling sendto(...): ");
        exit(1);
    }

    printf("Info: packet sent successful\n");

    close(sockfd);
    return 0;
}

The program takes two command line arguments. The first argument is the Ethernet address of destination host and the second argument is the message to send.

When you run it as a non-privileged user, for instance, as follows,

        $ ./sendpacket 00:0c:29:89:7a:4d "Hello, World"

you would receive an "Operation not permitted" error,

       Error calling socket(AF_PACKET, SOCK_DGRAM ...): : Operation not permitted

Two methods that we can use to make it work. First, run it under root, the traditional method,

        $ sudo ./sendpacket 00:0c:29:89:7a:4d "Hello, World"
        Info: packet sent successful

A new method, which is a better and preferred method, is to give the program minimal but necessary privilege -- since the packet socket requires the program with CAP_NET_RAW privilege, we ought to give the program the privilege, but only the privilege.

However, before that, let us check what privilege the program has,


        $ /sbin/getcap ./sendpacket

It outputs nothing, which means the program does not any privilege. Now we can give the program the privilege by

        $ sudo /sbin/setcap cap_net_raw=ep ./sendpacket

Now check the program's privilege again,

        $ /sbin/getcap ./sendpacket
        ./sendpacket = cap_net_raw+ep

Now the output indicates that the program has its effective privilege set as  CAP_NET_RAW. Run the program again as a non-privileged user,

        $ ./sendpacket 00:0c:29:89:7a:4d "Hello, World"
        Info: packet sent successful

Notable Issues

When I tried to set capability for the program on a Virtual Machine, I received an error:

        Failed to set capabilities on file `./sendpacket' (Operation not supported)

This is because that the file system that the file was on is actually a VMWare HGFS that moutns a Windows NTFS. The Windows NTFS does not support the security capability. When I copied the file to an ext4 file system, the problem went away.

libcap Library

For programming Linux capabilities, you need the libcap library.

On Ubuntu,

          sudo apt-get install libcap-dev

On CentOS/Fedora Linux,

          sudo yum install libcap-devel

Reference and Further Reading

1. http://www.cis.syr.edu/~wedu/seed/Labs/Documentation/Linux/How_Linux_Capability_Works.pdf
2. http://man7.org/linux/man-pages/man7/packet.7.html
3. http://www.linuxjournal.com/article/5737
4. http://ols.fedoraproject.org/OLS/Reprints-2008/hallyn-reprint.pdf
5. http://www.cis.gvsu.edu/~kalafuta/cis458/f12/labs/lab3.html