Blogging Techstacks

New HOWTO Article on Configuring Access Logging in Tomcat

I promoted some of the earlier posts on this blog about configuring Tomcat Access Logging to a new HOWTO.  Also incorporated into the HOWTO is some additional information on using the new RemoteIP Valve, which allows you to log client IP or the X-Forwarded-For IP, depending on whether an X-Forwarded-For IP is received.

Check it out and let me know what you think.  Thanks!

HOWTO: Configure Access Logging in Tomcat

 

Groovy News: Gaelyk 0.5.6 Released

It seems like every other article on this blog lately is about a new release of Gaelyk, but there is another one out.  Version 0.5.6 was released today, which is mostly bug fix releases.  From the release announcement:

• Upgraded to GAE SDK 1.3.8
• Fixed a bug when using memcache.clearCacheForUri() which didn't clear all the cache entries
• Added a method Map#toQueryString() to simplify the creation of a query string when you have a map on hands
• Additonal checks when using Memcache's get() and put() methods when using GString keys (now automatically coerced to normal Strings)
• Fixed a small bug with the type coercion of Strings into built-in Datastore types

Download it from the Gaelyk project download page.

Groovy: EVNark v0.3 Released - "snarky"

It's only been about a week since the last release but I thought folks might appreciate this new version of evnark codenamed "snarky".  No new functionality has been added but if you run this in a VT100 compatible terminal that supports color output and you are concerned about security, you will see a trust-inducing "green bar" on hosts using extended validation certificates.  You can rest assured that the ssl host you are connecting to is using encryption that is 'state-of-the-art', (even though the actual encryption level between the two hosts has not changed).  The screenshot below illustrates the change, first with a "normal" site using a scary, "traditional" SSL certificate and the second line of output is the extended validation output:

Hopefully, someone reading this post and has also built-in the green bar support in a browser can comment on whether there is some additional check being performed above and beyond what I'm doing here.  With extended validation certificates costing at least twice as much and the only distinguishing trait in the certificate turning the browser bar green is an object identifier embedded within the cert, I'm kind of feeling like the Internet is getting hoodwinked.

Downloads are now available from the main EVNark page

#!/usr/bin/env groovy
// usage: 'evnark [-h/--host "hostname"] [-p/--port "port"]'
//
// v0.2 
//   + Adds hostname lookup exception handling
//   + Adds connection Timeout exception handling
//   + Modified the output so that it will now state
//     whether or not an EV cert was found.

import java.security.*
import javax.net.ssl.*
import sun.security.x509.* 

/* This section sets up the command 
   line arguments portion of this script. */ 

def cli = new CliBuilder( usage: 'evnark [-h/--host "hostname"] [-p/--port "port"]' )
  cli.h( longOpt:'host', args:1, required:true, type:GString, 'The host or site you want to test' )
  cli.p( longOpt:'port', args:1, required:false, type:GString, 'Optional. Defaults to port 443')

def opt = cli.parse(args)
  if (!opt) return
  if (opt.h) host = opt.h

def port = 443
  if (opt.p) port = Integer.parseInt(opt.p)

// Create the socket
def factory = SSLSocketFactory.getDefault()

try {
  socket = factory.createSocket()
  socketaddr = new InetSocketAddress(host, port)
  socket.connect(socketaddr, 5000)
  } catch(UnknownHostException ex) {
      println "Hostname Resolution Failed.  Is ${host} a valid host?"
      return
  } catch(SocketTimeoutException ex) {
      println "Connection Timed Out. Is ${host} up or available?"
      return
  } 

try {
  socket.addHandshakeCompletedListener( new listener() )
  
  socket.startHandshake() 
  } catch(SSLHandshakeException ex) {
    println "CERTIFICATE PEER COULD NOT BE VERIFIED"
  } catch(SSLException ex) {
      println "The port number you specified (${port}) does not appear to be an ssl port"
  }

  class listener implements HandshakeCompletedListener {
  void handshakeCompleted(HandshakeCompletedEvent e) {

  def ev_oids = [
    // 'A-Trust GmbH':' Doesn't appear to offer the .yet',
    'AC Camerfirma SA':' 1.3.6.1.4.1.17326.10.14.2',
    'Buypass AS':'2.16.578.1.26.1.3.3',
    // 'Certum':' Doesn't appear to offer them yet',
    'Comodo CA Limited':'1.3.6.1.4.1.6449.1.2.1.5.1',
    'Cybertrust, Inc':'1.3.6.1.4.1.6334.1.100.1',
    'D-TRUST GmbH':'1.3.6.1.4.1.4788.2.202.1',
    // 'DanID':' Doesn't appear to offer the yet ',
    'DigiCert Inc':'2.16.840.1.114412.2.1',
    'DigiNotar':'2.16.528.1.1001.1.1.1.12.6.1.1.1',
    // 'Echoworx Corporation':' Doesn't appear to offer them yet',
    'Entrust, Inc.':'2.16.840.1.114028.10.1.2',
    'GeoTrust Inc.':'1.3.6.1.4.1.14370.1.6',
    // 'Getronics PinkRoccade':'Doesn't appear to offer them yet',
    'GlobalSign nv-sa':'1.3.6.1.4.1.4146.1.1',
    'The Go Daddy Group, Inc.':'2.16.840.1.114413.1.7.23.3',
    // 'IdenTrust, Inc.':' Doesn't appear to offer the yet',
    // 'IpsCA, IPS Certification Authority s.l.':' ',
    'Izenpe S.A.':'1.3.6.1.4.1.14777.6.1.1',
    'Network Solutions L.L.C.':'1.3.6.1.4.1.782.1.2.1.8.1',
    'QuoVadis Limited':'1.3.6.1.4.1.8024.0.2.100.1.2',
    // 'RSA Security, Inc.':' ',
    'SECOM Trust Systems CO.,LTD.':'1.2.392.200091.100.721.1',
    'SecureTrust Corporation':'2.16.840.1.114404.1.1.2.4.1',
    // 'Skaitmeninio sertifikavimo centras (SSC)':' ',
    'StartCom Ltd.':'1.3.6.1.4.1.23223.2',
    'Starfield Technologies':'2.16.840.1.114414.1.7.23.3',
    'SwissSign AG':'2.16.756.1.89.1.2.1.1',
    // 'T-Systems Enterprise Services GmbH':' ',
    // 'TC TrustCenter GMBh':'1.2.276.0.44.1.1.1.4',
    'thawte, Inc.':'2.16.840.1.113733.1.7.48.1',
    // 'Trustis Limited':Doesn't appear to offer them yet',
    'ValiCert, Inc.':'2.16.840.1.114414.1.7.23.3',
    'VeriSign, Inc.':'2.16.840.1.113733.1.7.23.6',
    'Wells Fargo WellsSecure':'2.16.840.1.114171.500.9'
  ]

  def certs = e.getPeerCertificates()
  def crt = certs[0]
  def intcrt = certs[1]

  def ext = crt.getCertificatePoliciesExtension()
  def policies = ext.get(CertificatePoliciesExtension.POLICIES)
    for ( PolicyInformation info in policies ) {
      CertificatePolicyId id = info.getPolicyIdentifier()
        def certpolicyid = id.getIdentifier().toString()
        //println ""
        //println "Found Certificate Policy ID: ${certpolicyid}"
      if ( ev_oids.any { it.value == certpolicyid } )
        println "\033[0;42m" + " This host uses an Extended Validation Cert " + "\033[0m" + "\nThe Certficate Policy ID is: ${certpolicyid}\n"
        else 
        println "This host does NOT use an Extended Validation Cert\nThe Certificate Policy ID is: ${certpolicyid}\n"

    }
  }
}

socket.close()