How to Prevent POODLE Attacks on AWS ELB And CloudFront

What is POODLE?
1. To maintain compatibility with legacy servers, many TLS clients implement a downgrade dance: in a first handshake attempt, offer the highest protocol version supported by the client;
   
2. if this handshake fails, they retry (possibly repeatedly) with earlier protocol versions.
   
3. Unlike proper protocol version negotiation (if the client offers TLS 1.2, the server may respond with, say, TLS 1.0), this downgrade can also be triggered by network glitches, or by active attackers.
   
4. So if an attacker that controls the network between the client and the server interferes with any attempted handshake offering TLS 1.0 or later, such clients will readily confine themselves to SSL 3.0.
   
5. Encryption in SSL 3.0 uses either the RC4 stream cipher or a block cipher in CBC mode.
   
6. RC4 is well known to have biases, meaning that if the same secret (such as a password or HTTP cookie) is sent over many connections and thus encrypted with many RC4 streams, more and more information about it will leak.
   
7. Unlike with the BEAST and Lucky 13 attacks, there is no reasonable workaround.
   
8. This leaves us with no secure SSL 3.0 cipher suites at all: to achieve secure encryption, SSL 3.0 must be avoided entirely.
   

Disable the SSLv3 Protocol to handle POODLE attacks on Cloud Front
1. Similarly to Amazon ELB, Amazon AWS has taken care of the issue disabling SSLv3 for the customers who use the default SSL settings.
   
2. Nevertheless, customers who are using custom SSL certificates with Amazon Cloud Front should disable the SSLv3 protocol manually by following the steps below in the Amazon CloudFront Management Console:
   
3. Select your distribution, then click “Distribution Settings”.
   
4. Click the “Edit” button on the “General” tab.
   
5. In the “Custom SSL Client Support” section, select the option that says: “Only Clients that Support Server Name Indication (SNI)”.
   
6. Click “Yes, Edit” to save these revised settings.
   

Disable the SSLV3 Protocol to handle POODLE on Amazon AWS ELB
1. All the ELBs which are created after 10/14/2014 5:00 PM PDT will use a new SSL Negotiation Policy that will by default no longer enable SSLv3.
   
2. For the existing ELBs, it’s necessary to manually disable SSLv3 via the AWS Management console:
   
3. Select your load balancer (EC2 -> Load Balancers) in the appropriate region
   
4. In the Listeners tab, click “Change” in the Cipher column.|
   
5. Ensure that the radio button for “Predefined Security Policy” is selected, in the dropdown select the “ELBSecurityPolicy-2014-10” policy.
   
6. You can see the Protocol-SSLV3 is unchecked after selecting the policy.
   
7. Click “Save” to apply the settings to the listener
   
8. Repeat these steps for each listener that is using HTTPS or SSL for each LoadBalancer.
   

Read more...

Service Fabric Mesh

Read more...

Azure Dev Ops - Variable Group

1. ADO you may want use variables which might be used across many jobs in the pipeline
   
2. Rather than defining them in each and every pipeline job, ADO gives the option to define them as Variables Groups
   
   
3. Once defined these variables can be linked to any job in the pipeline
   
4. Manage Variables Groups --> Create
   
5. Make sure to Allow access to all pipelines is ENABLED
   
   
6. From the Builds --> Variables --> Variable Groups --> Link Variable Groups
   
7. Select the Group and Click on Link
   
   
8. You should be able to get the variables declared in the group
   

Read more...

Azure Dev Ops- Invoke Agent Demands

1. ADO you may want to force the pipeline builds to run against a specific agent in an agent pool.
   
2. This is possible via “Demands” in the Pipeline builds as shown below
   
3. The scenario check to run the TASK against a specific agent name
   
4. If the agent name matches from the agent pool, then the job will run else the job will switch to the next agent and then condition will be checked against that agent in that pool.
   
5. Until the condition is met the agents in the pool will be round robinly selected by the JOB
   
6. This mechanism is used to check the conditions for running a job in a pipeline during runtime
   

Read more...

Azure Dev Ops - Personal Access Tokens

In My previous post , I mentioned that in order for using REST API calls in ADO you need to use TOKENS to invoke the REST CALLS.

Here is a mechanism to generate the Personal Access Tokens

1. Click on the AZURE DEV OPS
   
   
   
   
   
   
2. Click on your Profile
   
   
   
   
   
3. Click on Personal Access Token
   
   
   
   
   
   
4. Copy the TOKEN from the SUCCESS screen into the REST API call
   

Read more...

Capture last TEST Run results AZURE DevOps

You could retrieve the list of test runs, the sort descending the result on ID, since the most recent test run has the greatest ID. Then get the first item of the result. All of this shown below in powershell:

$testingBaseUrl = "https://dev.azure.com/cbre/Research%20Engine/_apis/test/runs"
$testingUrl = $testingBaseUrl + "?api-version=5.0"
$testingUrl = $testingUrl + "-preview.2"

write-host $testingUrl


#create auth header to use for REST calls
$username = "RKesavana"
$token = "your token"  Refer to my blog of how to create Personal access tokens  

#create auth header to use for REST calls 
$accessToken = ("{0}:{1}" -f $username,$token) 
$accessToken = [System.Text.Encoding]::UTF8.GetBytes($accessToken) 
$accessToken = [System.Convert]::ToBase64String($accessToken) 
$headers = @{Authorization=("Basic {0}" -f $accessToken)} 


try{
# write-host "To fetch LIST all the Test ID's information"
$testRuns=Invoke-RestMethod -Uri $testingUrl -Method Get -Headers $headers
$testRunsIdSorted = $testRuns.value | sort-object id -Descending
# write-host $testRunsIdSorted

$testURLByRunID= $testingBaseUrl+"/"+$($testRunsIdSorted[0].id)
$testURLByRunID= $testURLByRunID+ "?api-version=5.0"
$testURLByRunID = $testURLByRunID + "-preview.2"

write-host "To fetch the MOST RECENT run Test RUN ID"
write-host $testURLByRunID
$mostRecentTestRun = Invoke-RestMethod -Uri  $testURLByRunID -Headers $headers -Method Get | Select-Object id,name,url,build,isAutomated,iteration,owner,project,startedDate,completedDate,state,totalTests,incompleteTests,notApplicableTests,passedTests,unanalyzedTests,revision,webAccessUrl

#PRINT the values from the  REST calls 

write-host  "owner" $mostRecentTestRun.owner
write-host "startedDate" $mostRecentTestRun.startedDate
write-host "completedDate" $mostRecentTestRun.completedDate
write-host "totalTests" $mostRecentTestRun.totalTests
write-host "incompleteTests" $mostRecentTestRun.incompleteTests
write-host "notApplicableTests" $mostRecentTestRun.notApplicableTests
write-host "passedTests" $mostRecentTestRun.passedTests
write-host "unanalyzedTests" $mostRecentTestRun.unanalyzedTests
write-host "revision" $mostRecentTestRun.revision
write-host "webAccessUrl" $mostRecentTestRun.webAccessUrl


write-Host "##vso[task.setvariable variable=mostRecentRun;]$mostRecentTestRun


}  Catch  { $exception = $_.Exception
  $respstream = $exception.Response.GetResponseStream()
  $sr = new-object System.IO.StreamReader $respstream
  $ErrorResult = $sr.ReadToEnd()
  write-host $ErrorResult 
}

Read more...

JPA Static Meta Model

1. When you write a criteria query or create a dynamic entity graph, you need to reference the entity classes and their attributes.
   
2. The quickest and easiest way is to provide the required names as Strings.
   
3. But this has several drawbacks, e.g. you have to remember or look-up all the names of the entity attributes when you write the query.
   
4. But it will also cause even greater issues at later phases of the project, if you have to refactor your entities and change the names of some attributes.
   
5. In that case you have to use the search function of your IDE and try to find all Strings that reference the changed attributes.
   
6. This is a tedious and error prone activity which will easily take up the most time of the refactoring
   
7. Use the static metamodel to write criteria queries and dynamic entity graphs.
   
8. This is a small feature defined by the JPA specification which provides a type-safe way to reference the entities and their properties.
   

1. The Metamodel Generator also takes into consideration xml configuration specified in orm.xml or mapping files specified in persistence.xml. However, if all configuration is in XML you need to add in at least on of the mapping file the following persistence unit metadata:

2. Maven dependency: The jar file for the annotation processor can be found as below.
   

   
       org.hibernate
       hibernate-jpamodelgen
       1.0.0
   
   

3. Maven compiler plugin configuration - direct execution
   
   

   
       maven-compiler-plugin
       
           1.6
           1.6
           
               org.hibernate.jpamodelgen.JPAMetaModelEntityProcessor
           
       
   
   

4. Maven compiler plugin configuration - indirect execution
   

   
       maven-compiler-plugin
       
           1.6
           1.6
           -proc:none
       
   
   

   
   
5. Configuration with maven-processor-plugin
   

   
       org.bsc.maven
       maven-processor-plugin
       2.0.5
       
           
               process
               
                   process
               
               generate-sources
               
                                                   
                       org.hibernate.jpamodelgen.JPAMetaModelEntityProcessor
                   
               
           
       
       
           
               org.hibernate
               hibernate-jpamodelgen
               1.2.0.Final
           
       
   
   

6. Javac Task configuration
   As mentioned before, the annotation processor will run automatically each time the Java compiler is called, provided the jar file is on the classpath.
   
   
   

7. IDE Configuration
   
   
   

1. A simple entity for this example.
   

   @Entity
   @Table(name="ALERT")
   public class AlertEO implements java.io.Serializable{
   
    private static final long serialVersionUID = 1L;
    private Integer id;
    private String name;
    private String description;
    /**
     * method to get serial Id
     * 
     * @return id
     */
    @Id
    @Column(name="id")
    @GeneratedValue(strategy = GenerationType.AUTO)
    public Integer getId() {
     return id;
    }
    
    /**
     * Functions to get id
     * @return id
     */
    public void setId(Integer id){
     this.id = id;
    }
   
    /**
     * Functions to get name
     * @return name
     */
    @Column(name = "name")
    public String getName(){
     return name;
    }
    
    /**
     * Functions to set name
     * @return name
     */
    public void setName(String name){
     this.name = name;
    }
   
    /**
     * Functions to get description
     * @return description
     */
    @Column(name = "description")
    public String getDescription(){
     return description;
    }
   
    /**
     * Functions to set description
     * @return description
     */
    public void setDescription(String description){
     this.description=description;
    }
     /* (non-Javadoc)
     * @see java.lang.Object#toString()
     */
    @Override
    public String toString() {
     return "AlertEO [id=" + id + ", name=" + name + ", description=" + description + "]";
    }
   

   
   
   
2. 
   The class of the static metamodel looks similar to the entity.
   Based on the JPA specification, there is a corresponding metamodel class for every managed class in the persistence unit.
   You can find it in the same package and it has the same name as the corresponding managed class with an added ‘_’ at the end
   
   

   @Generated(value = "org.hibernate.jpamodelgen.JPAMetaModelEntityProcessor")
   @StaticMetamodel(AlertEO.class)
   public abstract class AlertEO_{
    public static volatile SingularAttribute<AlertEO, String>firstName;
    public static volatile SingularAttribute<AlertEO, String> lastName;
    public static volatile SetAttribute<AlertEO, Book> books;
    public static volatile SingularAttribute<AlertEO, Long> id;
    public static volatile SingularAttribute<AlertEO, Integer> version;
   }
   

   
   
3. Using metamodel classes
   
4. You can use the metamodel classes in the same way as you use the String reference to the entities and attributes.
   
5. The APIs for criteria queries and dynamic entity graphs provide overloaded methods that accept Strings and implementations of the Attribute interface.
   
   

   CriteriaBuilder cb = this.em.getCriteriaBuilder();
   // create the query
   CriteriaQuey<AlertEO> q = cb.createQuery(AlertEO.class);
   // set the root class
   Root<AlertEO> a = q.from(AlertEO.class);
   // use metadata class to define the where clause
   q.where(cb.like(a.get(AlertEO_.name), "J%"));
   // perform query
   this.em.createQuery(q).getResultList();
   

Read more...