Error while Deleting the Profile

$cd   /opt/IBM/WebSphere/AppServer/bin

$./manageprofiles -delete -profile <profile Name>

if it is Still giving error then give profile absolute path of Profile with profilePath

$./manageprofiles -delete -profile AppSrv01 -profilePath  /opt/IBM/WebSphere/AppServer/Profiles/AppSrv01

Note: Here AppSrv01 is profileName , ensure profile is deleted from profiles list ,if it is not get removed then manually delete after running the above command or run option                                            -validateAndUpdateRegistry with mange profile command to remove profile directory that is deleted throw -delete option.
command: $./manageprofiles -validateAndUpdateRegistry

Now check the deleted profile will not be there using -listProfiles option with manageprofiles command.

Comand: $./manageprofiles -listProfiles

Disabling SSL v2 and Allow only SSL v3 and TLS v1 -MS

SSL

              Having SSL is additional layer of security you are adding into Wb Application. However, Default SSL configuration leads to certain valunerabilities and you should consider tweaking those configurations. we require some tool to verify SSL settings. There are many available however,I would use SSL-Scan free tool. You can download from

  http://sourceforge.net/projects/sslscan/ 

Download & Installation

                         Following prerequisites must be installed on server where you wish to use Mod Security with Apache. If any one of these doesn't exist then Mod Security compilation will fail. You may use yum install on Linux flavors to install these packages.
                      --> apache 2.X or higher version
                      --> libapr and libapr-util package
                      --> libcurl package
                      --> libpcre package
                      --> libxml2 package
                      --> liblua package
                      --> mod_unique_id module bundled with Apache web server

                 Now ,let's download the latest stable version of Mod Security 2.9.0 from 

                         http://www.modsecurity.org/download/ 

                    Transfer downloaded file to /opt/apache
          
                 [/opt/apache]# ls -lrt  modsecurity-apache_2.9.0.tar.gz

                 Now Extract modsecurity-apache _2.9.0.tar.gz
                                 
                                      # gunzip -c modsecurity-apache_2.9.0.tar.gz
                                      # tar  -xvf  modsecurity-apche_2.9.0.tar

                 Now Move to Extracted folder modsecurity-apache_2.9.0
                                       
                                      # cd modsecurity-apache_2.9.0

                 Run the configuration script including apxs path to existing Apache
                                          
                                      #./configure -with-apxs=/opt/apache/bin/apxs
                      
                 Now Compile and install with make Script
   
                                     # make
                                     # make install

                 Once installation is done ,we can find mod_security2.so  in modules folder under                                             /opt/apache

                Now We have installed Mod Security module in existing Apache web server

Configuration

                 In order to use Mod security feature with Apche, we have to load mod security module in httpd.conf mod_unique_id module is pre requisite for Mod Security. This module provides an environment variable with a unique identifier for each request, which is tracked and used by Mod Security.
  
                 -->Add following line to load module for Mod Security in httpd.conf and save the configuration                            file
               
                 LoadModule unique_id_module modules/mod_unique_id.so
                 LoadModule security2_module modules/mod_security2.so

                --> Restart  Apache web server

                Mod Security is now installed ,Now we need to install Mod Security core rule to take a full advantage of its features. Latest Core Rule can be downloaded from following link,which is free

                https://github.com/SpiderLabs/owasp-modsecurity-crs/zipball/master


                --> copy downloaded core rule zip to /opt/apche/conf    folder
                --> Unzip core rule file, you should see the extracted folder as SpiderLabs-owasp-                                             modsecurity-crs-0f07cbb
                --> lets make folder name simple .rename the SpiderLabs-owasp-modsecurity-crs- 0f07cbb to crs

                [/opt/apache/conf]# mv SpiderLabs-owasp-modsecurity-crs-0f07cbb/  crs  
                        
                --> now Go to crs  folderand rename modsecurity_crs_10_setup.conf.example to                                           modsecurity_crs_10_setup.conf
                        
                                  [/opt/apache/conf/crs]# mv modsecurity_crs_10_setup.conf.exaple                                                                                                 modsecurity_crs_10_setup.conf

                --> Now ,Let's enable these rules to get it working with Apache web server.
                                          Add the following lines in httpd.conf
                                       
                                                  <IfModule security2_module>
                                                        Include conf/crs/modsecurity_crs_10_setup.conf
                                                        Include conf/crs/base_rules/*.conf
                                                    </IfModule>
                In the above Configuration, we are loading Mod Security main configurationfile                                      modsecurity_crs_10_setup.conf and base rules base_rules/*.conf provided by
        Mod Security Core Rules to protect web applications

                --> Restart apache webserver
      Now we successfully configured Mod Security with Apache. Our Apache Web server is protected with Mod Security web application firewall.


Get Started

                Lets get it started with some of the important configuration in Mod Security to harden &secure web applications. In this section , we will do all configuration modification in /opt/apache/conf/crs/modsecurity_crs_10_setup.conf

               we will refer /opt/apache/conf/crs/modsecurity_crs_10_setup.conf as setup.conf in this section for example purpose. It's important to understand what are the OWASP rules are provided in free.

Types of rules provided by OWASP are.

Base Rules-these rules are heavily tested and probably false alarm ratio is less.

Experimental Rules-these rules are for experimental purpose and you may have high false alarm. It's important to configure , test and implement in UAT before using these in production environment.

Optional Rules- these optional rules may not be suitable for the entire environment. Based on your requirement you may use them. If you are looking for CSRF, User Trackin, Session hijacking, etc. protection then you may consider using optional rules. we have base, optional  and experimental rules after extracting downloaded crs zip file from OWASP download page. These rules configuration file is available in crs/base, crs/optional_rules ans crs/experimental_rules folder.

Some of the Base rules are 

modsecurity_crs_20_protocal_violations.conf:This rule is protecting from protocal vulnerabilities like response splitting , request smuggling, using non-allowed protocal(HTTP 1.0).
modsecurity_crs_21_protocal_anamalies.conf:This is to protect from request, which is missing with Host, Accept, User-Agent in header.
modsecurity_crs_23_protocal_request_limit.conf:This rule has dependency on application specific like request size , upload size, length of parameter, etc.
modsecurity_crs_30_http_policy.conf:This is to configure and protect allowed or disallowed method like CONNECT , TRACE,PUT, DLETE, etc.
modsecurity_crs_35_bad_robots.conf: Detect malicious robots.
modsecurity_crs_40_generic_attacks.conf:This is to protect from OS command injection, remote file inclusion, etc.
modsecurity_crs_41_sql_injection_attacks.conf: This rule is to protect SQL and blindSQL inject request.
modsecurity_crs_41_xss_attacks.conf: Protect from cross site scripting request
modsecurity_crs_42_tight_security.conf: Directory traversal detection and request.
modsecurity_crs_45_trojans.conf:Tthis rule is to detect generic file management output , uploading of http backdoor page, known signature.
modsecurity_crs_47_common_exceptions.conf:This is used as an exception mechanism to remove common false positives that may be encountered suck as Apache internal dummy connection, SSL pinger, etc.

Logging
             Logging is one of the first things to configure so you can have logs created for what Mod Security is doing. there are two types of logging available , Debug &Audit log.

          Debug Log : This is to Duplicate the Apache error , warning and notice message from the error log.
   
          Audit Log  : This is to write the transaction logs that are marked by Mod Security rule, Mod Security gives you flexibility to configure Audit , Debug or both logging. By Default configuration will write both logs. However , you can change based on your requirement. Log is controlled in SecDefultAction directive. Let's look at default logging configuration in setup.conf

          secDefaultAction "phase:1,deny,log"

 To log Debug ,Audit log - use "log" .    
 To log  only audit log - use  "nolog,auditlog"
 To log only debug log - use "log,noauditlog"
You can specify the Audit Log location to be stored which is controlled by SecAuditLog directive. Let's write audit log into /opt/apache/logs/modsec_audit.log by adding as shown below.

         Implementation
          Add SecAuditLog directive in setup.conf and  restart apache web server
       
           SecAuditLog /opt/apache/logs/modsec_audit.log

After restart , you should see modsec_audit.log getting generated in /opt/apache/logs

Enable Rule Engine

By default Engine Rule is Off that means if you don't enable RuleEngine you are not utilizing all the advantage of Mod Security. Rule Engine enabling or disabling is controlled by SecRuleEngine directive
          Implementation
                        Add SecRuleEngin directive in setup.conf and restart apache  web Server

                             SecRuleEngine On

There are three values for SecRuleEngine:
          On- to enable Rule Engine
          Off- to disable Rule Engine
          DetectOnly - enable Rule  Engine but never executes any actions like                                                                                   block,deny,drop,allow,proxy or redirect.

Once Rule Engine is on -Mod Security is ready to protect with some of the common attack types.

Disable SSL v2
SSL v2 has many security flaws and if you are working towards penetration test or PCI compliance then you are expected to close security finding SSL v2. Any SSL v2 communication may be vulnerable to Man-in Middile attack that could allow data tempering or disclosure. let's implement apache web server to accept only latest SSL v3 and reject SSL v2 connection request.

Implementation:

          Go to $Web_Server/conf/extra  folder
          Modify SSL Protocol directive in httpd-ssl.conf as below to accept only SSL v3 and TLS v1

          SSLProtocal -ALL +SSLv3 +TLSv1

verification
         Let's use sslscan utility to validate as below command .change localhost to your actual domain name

           [/opt/apache/conf/extra] # sslscan --no-failed localhost

In output you could see only SSLv3 and TLSv1 ,Which is Safe from SSLv2 vulnerabilities

Disabling or enabling a high availability manager -MS

A unique HAManagerService configuration object exists for every core group member. The enable attribute in this configuration object determines if the high availability manager is enabled or disabled for the corresponding process. When the enable attribute is set to true,the high availability manager is enabled.when the enable attribute is set to false, the high availability manager is disabled. By default ,the high availability manager is enabled. if the setting for the enable attribute is changed, the corresponding process must be restarted before the change goes into effect.You must use the wsadmin tool to disable or enable a high availability manager.
First You must ensure you need to use a high availability manager to manage members of a core group.
to Avoid the trouble : when you disable the high availability manager,make sure that you disable it for all the servers in core group so that all members are disabled. Do not disable the high availability manager for select members of the core group.

Procedure to disable or enable  high availability manager

1.In the administrative console, navigate to the Core Group Service Page for the Process
      
  From Deployment manger ,
              for  Deployment Manager click System Administration -> Deployment manager -> Core group service
            for Node Agent click System Administration -> Node agent-> node_agent-> Core group service
            for an application server click Servers->Server Types-> WebSphere application servers-> server_name -> Core group service

2.If you want to disable the high availability manager for this process, deselect the Enable service at server start up option.

3.If you want to enable the high availability manager for this process, select the Enable service at server start up option.

4. Click on OK and  then click Review.

5.select Synchronize changes with nodes , and then click Save.

6. Restart all of the processes for which you changed the Enable service at server start up property setting.

Now processes start with the high availability manager in the changed state.

Verify                                              
check the Systemout  log file for following messages:

           HMGR005l: The Single Server DCS Core Stack Transport has been started for core group DefaultCoreGroup

The Above message indicates that the high availability manager is disabled because the hihg availability manager communication transport can only establish communication with a single server process.

   HMGR001l: The DCS Core Stack Transport has been started for core group DefaultCoreGroup There are x members.

The above message indicates that the high availability manager is enabled because the high  availability manager communication transport can establish communication with multiple server processes. X indicates the numbers of server processes with which communication is established.

JDBC Connection Problems -MS

You have created the JDBC Provider and created alias and Datasource .You are Testing the Connection

         If you are getting NameNotFoundException  in the SystemOut.log that means there is JNDI lookup problem check Namespace lookup that are mentioned in the Code and config file's as mentioned in Previous post

         If you are getting the SQLException Problem is either userid and password passes in  J2C Authentication alias ,make sure the valid userid and password are passed.

         If you are getting the java.lang.UnsatisfiedLinkError ,
              1.If you are using Type2 or Type3 driver and getting  java.lang.UnsatisfiedLinkError    
                 This means JVM is unable to Load a native libraries that are needed by JDBC driver to
                 Resolve this check DataBase Home and library paths are correct
                 (ex:Oracl_Home,LIBPATH)
              2.connecting user has proper permissions to access Native libraries
              3.32-bit  native libraries cannot be used with 64-bit application server JVM and vice
                 verse.Mismatches between the two can also cause java.lang.UnsatisfiedLinkError

         If  you are getting java.sql.SQLException: [IBM][SSLServer JDBC Driver][SQLServer]Could not find stored procedure 'master..xp_jdbc_open'. The problem is with stored procedure for JTA are not installed on the SQL ServerDatabase.these Stored procedures are required for XA connections.

         If you are typical error messages like
DSRA8040I: java.sql.SQLException: IOException:The Network Adapter could not establish the connection 
DSRA0010E: SQL State=null, Error code=17,002
Then try to connect to the database server using a stand alone java program to determine if you are able to connect successfully with the same properties that you have set in your Data Source outside the WebSphere Application server then Go with other possible Trouble shooting Technics .if it is giving same error out side WebSphere Application Server it is not related to WebSphere Application Server Coordinate with DBA Team to Resolve the Issue.

JNDI and Naming Problems -MS

Troubleshooting naming and JNDI problems using the WebSphere Application and  Deployment Manager.

Steps to help resolve common naming lookup problems
Which methods are you using , corbaloc / corbaname, for direct lookups or Java for indirect lookups.
e.g: WebSphere _AppServer_Root/bin>dumpNameSpace.[sh/bat] -host myhost.mycompany.com -port 901
  OR 
WebSphere _AppServer_Root/bin>dumpNameSpace.[sh/bat] url corbaloc:iiop:myhost.mycompany.com:901

Example

example using corbaloc provider URL and lookup:

env.put(Context.PROVIDER_URL," corbaloc::server.aust.in.ibm.com:9809");
ctx=new InitialContext(env);
Object obj = ctx.lookup("jdbc/PlantsByWebSphereDataSource")

The following is how the object is seen in the dumpNameSpace output:

Install_Root\bin> dumpNameSpace -url corbaloc::server.austin.ibm.com:9809

the output is get is as follows
.......
.......
.......
39  (top) /nodes/server/servers/server1jdbc/petstore/PetStoreDB  PetStoreDB
40  (top) /nodes/server/servers/server1jdbc/petstore/PlantsByWebSpehereDataSource  PLANTSDB
41  (top) /nodes/server/servers/server1jdbc/petstore/CatalogDB  CatalogDB
.......
.......
.......

Now You can able to see the object int he namespace
if  YES:
         -->check for spelling mistakes on lookup code versus what is seen in namespace.
        --> Confirm you are connecting to the namespace of the proper server,see the provider URL
        -->  If Provider URL or ctx.lookup values are pickedup from the properties file,print out the variable values to SystemOut to confirm the correct values are provided.
       --> If This does not resolve the problem , then go to what to do next.
if NO:
         Use the administrative console to verify that:
      --> The server hosting the target resource is started.
      --> The Web module or EJB container, if applicable, hosting the target resource is running.
      -->The JNDI name of the target resource is correct and updated.
      --> If the problem resource is remote , that is , not on the same node as the Name Server node, that the JNDI name is fully qualified, including the host name. This is especially applicable to Network Deployment Configurations.
If Still Problem not Resolved

  If you are using the java:lookup method, you cannot use dumpNameSpace to see the lookup Object. This is because the object is in the application's own namespace.
                   
1.Check your configuration against the following example of a java: namespace lookup. this shows the mapping from the sample code with the resource.xml, the resource .xml with the ibm-resource-bnd.xmi, and finally with the object as seen in the namespace.(where resource =web,application,appclient or ejbjar)

Code sample:
       ctx = new InitialContext();
       Object obj = ctx.lookup("java:comp/env/plantsby/PlantsDS");

NOTE: Mapping is configuring between the resource.xml and ibm-resource-bnd.xmi files.

web.xml:
                <resource-ref id="ResouceRef_1">
                             <res-ref-name>plantsby/PlantsDS</res-ref-name>
                             <res-type>javax.sql.DataSorce</res-type>
                             <res-auth> Container</res-auth>
                 </resource-ref>
ibm-web-bnd.xmi:
                     <resRefBindings xmi:id="ResourceRefBinding_1" jndiName = "jdbc/PlantsByWebSphereData                                   Source">
                      <bindingResourceRef href="WEB-INF/web.xml#ResourceRef_1"/>
                     </resRefBindings>

2. The dumpNameSpace utility can Still be used to show the real object in the namespace as defined in the binding file. This is different from that of the java:'s namespace.
output of dumpNameSpace Output:

.......
.......
.......
39  (top) /nodes/server/servers/server1jdbc/petstore/PetStoreDB  PetStoreDB
40  (top) /nodes/server/servers/server1jdbc/petstore/PlantsByWebSpehereDataSource  PLANTSDB
41  (top) /nodes/server/servers/server1jdbc/petstore/CatalogDB  CatalogDB
.......
.......
.......
If the configuration looks to be setup properly, when compared with the preceding sample, then get a dump of the applications,java: namespace using the wsadmin utility.