IBM Poodle attack preventive actions

IBM Security Bulletins - Padding Oracle On Downgraded Legacy Encryption (POODLE) 

Specifically for WebSeal, IHS, WebSphere, TDS

TITLE: Security Bulletin: Vulnerability in SSLv3 affects Tivoli Access Manager for e-business and Security Access Manager for Web (CVE-2014-3566)
 URL: http://www.ibm.com/support/docview.wss?uid=swg21687954&myns=swgother&mynp=OCSSPREK&mync=E
 ABSTRACT: SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack.  SSLv3 is enabled in IBM Tivoli Access Manager for e-business and IBM Security Access Manager for Web.

TITLE: Security Bulletin: Vulnerability in SSLv3 affects WebSphere included with Tivoli Access Manager for e-business and Security Access Manager for Web (CVE-2014-3566)
URL: http://www.ibm.com/support/docview.wss?uid=swg21687955&myns=swgother&mynp=OCSSPREK&mync=E
ABSTRACT: SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack.  SSLv3 is enabled in the IBM WebSphere product bundled with IBM Tivoli Access Manager for e-business and IBM Security Access Manager for Web.

TITLE: Security Bulletin: Vulnerability in SSLv3 affects Directory Server (CVE-2014-3566)
URL: http://www.ibm.com/support/docview.wss?uid=swg21687611&myns=swgother&mynp=OCSSVJJU&mync=E
ABSTRACT: SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack.  SSLv3 is enabled in Tivoli Directory Server (TDS) and IBM Security Directory Server (SDS).

 

After making chnages one need to check if SSL connection is stopped, you can use below commands if you have OpenSSL installed.

openssl s_client -connect <website_address>:<secureport>-ssl3

openssl s_client -connect <website_address>:<secureport>-tls1

Good Blogs

http://generalcsproblems.wordpress.com/os-and-linux-related-problems/

http://www.kegel.com/c10k.html

http://nick-black.com/dankwiki/index.php/Network_servers

http://pl.atyp.us/content/tech/servers.html

About Software Designs...
http://www.developerdotstar.com/mag/articles/reeves_design.html

ITIM Workflow Mail notification Issue after 5.0 to 5.1 upgrade

I was looking into our newly updated ITIM environment. And it was not sending an email as part of new account creation workflow. I debugged it with IBM engineer and found some tips which can be handy for anyone. 


1. Check first the mail server is working on the ITIM machine.

          $>telnet localhost 25 ( this can be value from enRoleMail.prop, mail.from property )
             once connected type the commands below in sequence, please note that the backspace key 
             won't work, so if you make mistakes you have to drop the connection and reconnect   
             HELO admin.xyz.com
             MAIL FROM:<no-reply@admin.xyz.com>
             RCPT TO:<abc@xyz.ac.uk>
             DATA
               write something here, this will be the body of your message
               .          <- dot on an empty line will terminate and send your email

             you should receive the email immediately. This makes sure mail server functioning okay

2.  In ITIM 5.1, check on WAS Console, Environment -> Shared Library -> ITIM_LIB

     As there is no mail.jar in the ITIM_HOME/lib directory, entry for ${ITIM_HOME}/lib/mail.jar should be removed.

3. 

Locate  $/opt/IBM/Tivoli/IdentityManager/data/enRoleMail.properties  and check that parameters have not been overwritten during the upgrade, in particular need you to double check

      mail.from="From Admin"<no-reply@admin.xyz.com>
mail.postoffice.aggregate.max.emails=1
mail.host=<FLDN_address_of_your_Mail_server>     <.- probably you have localhost here
mail.notification.disabled=false

   4. Check enRole.properties for enrole.workflow.notifyoption = 1

   5. Check on ITIM console, New Account Template and New Password Template should be disabled. Otherwise     this will send default ITIM mails instead the custom workflow mails. 

5 6. Now restart the servers 

   7.  Check Post Office test from ITIM console. ITIM console -> Configure System -> Post office. Make sure to check "Enable Store forwarding" and change the value of collection interval to 5.

   8.

   Check logs at /opt/IBM/Tivoli/common/CTGIM/logs/trace.log 

    if logs are not getting generated change the level of logs in /opt/IBM/Tivoli/IdentityManager/data/enRoleLogging.properties

    handler.file.trace.maxFiles=100

     ( ideally should be 10, but while debugging trace roles too quickly change it to 100)

    handler.file.maxFileSize=20480

    ( this is to not generate too many file with small size )

    logger.trace.com.ibm.itim.workflow.level=DEBUG_MAX

    logger.trace.com.ibm.itim.mail.level=DEBUG_MAX

 

 Hope this helps to resolve / debug your issue.

Shibboleth Links

To setup SSO using shibboleth...
-------------------------------------------------------------------------

http://www.testshib.org/index.html

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPInstall


https://shibboleth.usc.edu/docs/sp/install/#install

https://wiki.library.ucsf.edu/display/~234877@ucsf.edu/Running+Shibboleth+IDP+and+SP+Locally+in+Windows

http://www.itcs.umich.edu/itcsdocs/s4388/