Contents
- Configure secure sockets layer (SSL) for WLS
- Use the keytool utility to create and manage certificates
- Configure hostname verification (anti-man-in-the-middle)
- Configure a network filter (anti-denial-of-service)
- Set max post size (anti-large-buffer)
- Set post timeout (anti-connection-starvation)
- Configure username lockout via the admin console
<< Previous
Configure secure sockets layer (SSL) for WLS
* See this post
Use the keytool utility to create and manage certificates
* keytool is a standard Java tool
* can be used to
– generate private keys
– store private keys (keystore)
– store trusted certificates (truststore)
– display key info
* WLS does not support DSA which is default for keytool
keytool –genkeypair –alias mykey –keypass mykeypass –keyalg RSA –keysize 512 -dname "CN=payroll.mycompany.com..." -keystore mykeys.jks –storepass mypass keytool –importcert –file payroll.pem –alias mykey –keypass mykeypass -keystore mykeys.jks –storepass mypass keytool –list –v -keystore mykeys.jks –storepass mypass
Configure hostname verification (anti-man-in-the-middle)
* Enabled by default:
* Custom hostname verifier class must implement: weblogic.security.SSL.HostnameVerifier
* Command line properties
– ignore hostname verification: -Dweblogic.security.SSL.ignoreHostnameVerification=true
– enforce hostname verification: -Dweblogic.security.SSL.HostnameVerifier=hostnameverifier_class
Configure a network filter (anti-denial-of-service)
Three Basic Types of DoS Attacks
* Consumption of limited resources
* Destruction or alteration of configuration
* Physical destruction or alteration of network components
Filter Network Connections
* Accept or deny network connections based on
– origin of clients
– type of connections (e.g. SSL or not)
weblogic.security.net.ConnectionFilterImpl
* Filter rules: targetAddr localAddr localPort action protocols
* Example:
# allow connection from 192.168.1.0 to 24 on local port 8001 192.168.1.0/24 127.0.0.1 8001 allow 10.10.0.0/16 127.0.0.1 8002 deny # deny connection from badguy.com on local port 7001 *.badguy.com 127.0.0.1 7001 deny # catch all deny 0.0.0.0/0 * * deny
Set max post size (anti-large-buffer)
Set post timeout (anti-connection-starvation)
Configure username lockout via the admin console
Use Admin Port
Change Admin Console Context Root or Disable Admin Console
Next >>
[mv_include id=’3268′]