generate a self signed certification for dropwizard

1. use JDK keytool to generate keystore:

yiyujia@hadoopDev: keytool -genkeypair -keyalg RSA -dname "CN=localhost" -keystore linkedBAC.keystore -keypass 123456 -storepass 12345


2. modify Dropwizard configuration file as bellow.

server:
 #  softNofileLimit: 1000 #  hardNofileLimit: 1000   applicationConnectors:
     - type: http
       port: 8088
     - type: https
       port: 8443
       keyStorePath: linkedBAC.keystore
       keyStorePassword: 123456
       validateCerts: false       validatePeers: false   adminConnectors:
     - type: http
       port: 8081
     - type: https
       port: 8444
       keyStorePath: linkedBAC.keystore
       keyStorePassword: 123456
       validateCerts: false       validatePeers: false

3. Using curl to test your Dropwizard applicaiton.

curl -k --data "user_name=yiyu&password=123456&device_id=1&grant_type=password" https://localhost:8443/oauth2/token/accessToken


4. Or, if want to use web browser to test, we need to add self signged certification as exception by following steps as below.

 

 

 

prepare Azure management certification for Vagrant

On Linux

• Creating certification
  
  1. openssl genrsa -out azureMgt.key 2048
  2. openssl req -new -key azureMgt.key -out azureMgt.csr
  3. openssl x509 -req -days 730 -in azureMgt.csr -signkey azureMgt.key -out tempAzureMgt.pem
  4. cat azureMgt.key tempAazureMgt.pem > azureMgt.pem
  5. openssl x509 -inform pem -in azureMgt.pem -outform der -out azureMgt.cer
  6. openssl pkcs12 -export -out azureMgt.pfx -in azureMgt.pem -inkey azureMgt.key -name "Azure Certification"
• Uploading file azureMgt.cer to Azure management portal
• Using file azureMgt.pem on your azure client side. for example, using this file in Vagrant (the pfx format has problem based on my testing).
• Generating SSH key for vagarant to launch VM on azure.
  
  1. openssl req -x509 -nodes -days 1095 -newkey rsa:2048 -keyout azuresshkey.key -out azuresshcert.pem
  2. Change the permissions on the private key and certificate for security. chmod 600 azuresshcert.pem ; chmod 600 azuresshkey.key
  3. azuresshcert.pem is vm's ssh certifiction. azuresshkey.key is the ssh key that we use to access VM

On Windows

work on this later. 

OAuth 1.0 and OAuth 2.0, three-legged authenticaton and two-legged authentication

It is easy for a Web developer to understand why we need OAuth1.0. It is a three legs scenario: 1) Web browser user, 2) third party service provider that want to access user's info from 3) OAuth provider that hosts user's valuable info.

So, for the reason of security, web browser user should not just gives third party web site his/her user name and password to get info on behalf of himself/herself. You know, not every web site could be trusted. It is not only because of immoral web sites may use your personal info in wrong way but also because of their capability of securing your privacy. Therefore, URL redirecting comes into OAuth framework. Also, web browser use may not want to allow the web site to access all info hosted in OAuth service provider's site. Therefore, the OAuther plays as authorization framework too. Furthermore, for the reason of light encryption and signature, HMAC was employed. But, OAuth2.0 drop the signatures and asks the authorrization request to be send over SSL/STL, in which securet key is delivered and directly validated. So, in OAuth2.0, there is no requirements for the order of parameters. However, the benefit is not cost free as the server and client have to spend more resource to handle SSL communication.

To be used in native app, like movbile app, OAuth2.0 standardize the extension about two legs authorization, which I think there is security problem. You may think a server or user's own server could be trusted to have user's cridential info. But, it will be highly risk to implement two leg flow in a mobile app, which may be used on large amount device and different people. Here is an article about OAuth2.0 and the road to hell. But, in case of users want to make their own application to get info through OAuth service provider. It doesnot matter to use password flow. And put this flow under the name of OAuth (OAuth 2.0 actually).

Below is three different flows from Salesforce as examples. It is important for developer to understand which flow they need to start with according to their use case. It is interesting to see they declare that their flow is for authenticating purpose. What is the difference between authenticationa nd authorization if all resources are expose once authentication is past.

OAuth 2.0 User-Agent Flow


OAuth 2.0 Web server


OAuth 2.0 Username-Password Flow

http://stackoverflow.com/questions/7561631/oauth-2-0-benefits-and-use-cases-why http://hueniverse.com/2012/07/oauth-2-0-and-the-road-to-hell/ http://www.wolfe.id.au/2012/10/20/what-is-hmac-and-why-is-it-useful/

How to ssh into your home machine through company's http proxy

Sometimes, we want to remote login into our home PC/Server for fun. We can simply setup port forward on home router to expose home PC's SSH port outside. However, your office network environment may only allow you to access public Internet through HTTP/HTTPS proxy only. In this case, we need helps from corkscrew and ssh over tunnel. Below is my steps to setup corkscrew and ssh tunnel.

1. install corkscrew
   
   1. wget http://www.agroman.net/corkscrew/corkscrew-2.0.tar.gz
   2. tar -xvf corkscrew-2.0.tar.gz
   3. enter untared corkscrew directory and run following command
      ./configure
   4. make
   5. make install
   6. corkscrew should be installed under /usr/local/bin directory already.
2. Setup corkscrew in
   1. vi ~/.ssh/config

   2. Host pineHouse
      Hostname my.home.ip.address
         KeepAlive yes
         ServerAliveInterval 30
         ForwardAgent yes
         ProxyCommand corkscrew proxy.example.com 8080 %h %p
      

   3. ssh myName@pineHouse

For more advanced info, I read this blog post: "Build and Configure an HTTP-Proxy Application".

http://mtu.net/~engstrom/ssh-proxy.php

using multiple ssh private key files

There is situation where I have to convert development enviroment from one machine to the other. It includes transfer ssh private key file to new machine. Then, I have to seek solution for having multiple ssh private keys. It is very simple. What I need to do is edit ~/.ssh/config file to have multiple lines for IdentifyFile as below,

IdentityFile ~/.ssh/id_dsa
IdentityFile ~/.ssh/id_dsa.1
IdentityFile ~/.ssh/id_dsa.2

In fact, I just follow this link to get job done.