OS X Server Security Update 2010-001 and Apache client authentication
So, it seems that Apple have disabled SSL renegotiation (CVE ID: CVE-2009-3555) in the latest security patch thanks to a man-in-the-middle vulnerability. All well and good.
Client authentication with Apache relies on renegotiating a connection (secure connection starts when the server presents the server certificate and is renegotiated when the client presents the client certificate) – which is now broken. My virtual host error logs were filling up with all sorts of completely useless and uninformative errors, such as:
[Mon Jan 25 16:01:57 2010] [info] [client <ip-address>] Connection to child 1 established (server <server-address>:443)
[Mon Jan 25 16:01:57 2010] [info] Seeding PRNG with 144 bytes of entropy
[Mon Jan 25 16:01:57 2010] [info] Initial (No.1) HTTPS request received for child 1 (server <server-address>:443)
[Mon Jan 25 16:01:57 2010] [info] [client <ip-address>] Requesting connection re-negotiation
[Mon Jan 25 16:01:57 2010] [info] [client <ip-address>] Awaiting re-negotiation handshake
[Mon Jan 25 16:01:57 2010] [error] [client <ip-address>] Re-negotiation handshake failed: Not accepted by client!?
[Mon Jan 25 16:01:57 2010] [info] [client <ip-address>] Requesting connection re-negotiation
[Mon Jan 25 16:01:57 2010] [error] [client <ip-address>] Re-negotiation request failed
..and so on. Looks like a problem with the client end – but it’s actually on the server end. The fix? Er.. there isn’t one as yet. I’ll update this post if I work out how to fix it.
- zac.
Birthday drink
Another weekend, another party to bartend at! 
This time around I had some fruit to work with – raspberries and blueberries. I didn’t touch the blueberries, but after a shaky start I’ve got the rough workings of a very tasty raspberry and orange drink:
- 80-90 ml. vodka
- 60 ml. Cointreau
- 2 handfuls fresh raspberries
- 1 cup ice
- Orange juice
- Lemonade
Blend the vodka, Cointreau, raspberries and ice until smooth. Half fill a tulip glass, then top with orange juice and a little lemonade and garnish with a twist of orange rind.
It’s not a complete drink yet – my measurements were rough and the flavour is missing some of the tartness I was aiming for. Maybe needs some lemon juice? A project for another weekend! 
- zac.
Travel ahoy!
All flights for my November/December trip are finally locked and loaded. It goes something like..:
MEL-SYD-LAX//ONT-DFW-MIA-MEX-HAV-CUN-MEX-LHR-AMS-LCY-ZRH-LHR-MXP-LHR-AMS-LHR-MEX-MIA-DFW-ONT//LAX-SFO-SEA-SFO-LAX-SYD-MEL
I also really wanted to head to northern England and across to Ireland, but it wasn’t to be. Something for the next trip!
- zac.
Wedding drinks
Was just over in Perth playing bartender at a wedding party – the hosts provided serious amounts of booze for me to cocktail it up with. I had every intention of following recipes, but that never lasts. Two new drinks – no names for them, not incredibly original flavour combinations but both proved really popular:
- 60 ml. reposado tequila (I was using Cuervo, 1800 would be better)
- 20-30 ml. Frangelico
- Dash of sugar syrup
- Half a lime
- Soda water
- Crushed ice
Muddle the tequila, Frangelico, sugar syrup and lime in a rocks glass. The idea is to balance the bite of the tequila and the zest of the lime against the sweetness of the Frangelico and sugar syrup – too much sugar syrup will wreck the drink, so don’t overdo it.
Top with crushed ice, add soda water to taste, stir and decorate with something floral if so inclined.
- 60 ml. vodka
- 20-30 ml. Cointreau
- Mango/passionfruit syrup (supermarket job, handmade would be nicer of course)
- Soda water
Coat the inside of a highball glass with syrup, top with crushed ice. Build vodka, cointreau and soda water. More for the sweet tooths – I like it with a little more vodka and a little less Cointreau. Might also be nice with a little grenadine syrup if you want something more colourful.
- zac.
Ancient history
The final bit of my original computer system that I bought in 1998 finally gave up the ghost yesterday – my Altec Lansing ACS54 4.1 surround (!) speaker system.
The right channel in the amp stopped working properly a little while ago, but I couldn’t bring myself to part with it. When it stopped working altogether, it really had to go. I’m actually a bit amazed it lasted as long as it did!
I’ve replaced it with a set of Logitech X-210 speakers. Cheaper, more likely to break sooner – but it’s awesome being able to listen to music properly again. Vive la technology!
- zac.
Guava Mojito
A tasty tasty recipe:
- 3 – 4 sprigs of mint
- 1/2 – 2/3’s of 1 lime, cut in to wedges
- 1 tblsp. caster sugar
- 40-50 mls. guava nectar
- 80-90 mls. white rum (Havana Club is best)
- crushed ice
Muddle most of the mint and all of the lime, caster sugar and guava nectar in a highball glass – take care not to pulverise the mint completely (floaty bits of mint in the drink = not so good).
Top up with crushed ice and heaps of white rum, stir with a bar spoon and garnish with the remaining mint.
Enjoy!
- zac.
Mac OS X and eToken PKI Client
I’ve also managed to get the Mac drivers for another of the common USB crypto tokens, this time from Aladdin Systems (who are now owned by SafeNet, but that’s neither here nor there).
Installation is about the same, however having a “proper” graphical token management utility (eToken Properties) is much much nicer than having to use a command line based utility. The installer logs you out after it’s done its’ thing, however it took a full reboot before the token was recognised.
I didn’t have the doco handy, so I don’t know if it goes in to detail on how to configure Firefox to use the token; but the process is basically the same as for the SafeNet iKey — go in to the Firefox preferences, Advanced > Encryption > Security Devices > Load, given the module a name (like “eToken PKI” maybe) and point to the following file location:
/Library/Frameworks/eToken.framework/Versions/Current/libeToken.dylib
Restart Firefox just to be sure, but everything should just work. Attempting to use Keychain Access to manage the token is just as pointless an activity as with the iKey token, though at least the Keychain Access app doesn’t crash. In any case, it’s easy enough to use the token management tool to import and delete certificates – that is, unless you’re trying to import CA certificates on to the token, because the only format it can cope with importing is PKCS12 (which is retarded, because the Windows version of the same utility has no problems importing CA certificates). If the PKCS12 file has CA certificates, they do get imported properly.
Key generation is a bit faster than with the iKey token — though whether that is due to better hardware/drivers, I don’t know.
What will be very interesting to see is whether these drivers (and the iKey drivers) work at all with Mac OS X Snow Leopard. I’m guessing they will (at least, with Firefox) – but I’m still waiting on my copy of Snow Leopard to show up, so it’s a bit of a mystery to me for now.
- zac.
Mac OSX and SafeNet iKey tokens
I finally managed to get my hands on the SafeNet iKey token drivers for Mac OSX. For reasons I still don’t entirely understand, SafeNet have seen fit to make the Windows drivers freely available – but the Mac drivers need $$ spent and CDs shipped from the United States.
The driver CDs that I ordered finally made their way to my desk today – was entertained by the amount of packaging they deemed necessary; 5 CDs came in individual envelopes inside a box that could have easily held 100 CDs! Not very environmentally friendly.
Installing the drivers is simple enough, but configuring Firefox is a little more complicated (you have to configure the PKCS11 security device in the advanced preferences by hand). Instruction manual reading required.
First attempt to get things going (on an ancient Graphite Power Mac G4) was filled with fail; the token utility program couldn’t see the token I was trying to use. I suspect the problem was more related to dodgy USB ports than anything else, but no way to test properly. Second installation attempt on my MacBook Core Duo worked properly – token was now recognised, but I couldn’t do anything with it. Pro tip #1: use a token that isn’t damaged.
Once configured, the token needs to be removed and reinserted before Keychain Access can see it and interact with it. Pro tip #2: don’t expect much from Keychain Access. You can’t import PKCS12 files to the token and it crashes if you look at it the wrong way. Use Firefox instead.
Once configured, Firefox handles certificate imports quite nicely – and enrolling/installing certificates using our regular enrollment pages works properly as well (albeit key generation takes a very long time indeed). During enrollment, you’re first prompted to choose a security level (key size) and then the security device, which will allow you to select the token for key storage (the token label is what appears in the dropdown). During certificate installation, Firefox automagically works out where the certificate should live and asks for the token password if needed.
The one annoyance is that any CA certificates are copied to the browser store and not the token store; Firefox won’t have it any other way. There doesn’t appear to be any method of moving CA certificates to the token on a Mac, whether by using Firefox or the included token utility.
Exciting stuff.
- zac.
Exporting certificates from a Java keystore
Busy day at work filled with a number of disappointments, however one thing which made my day – I found that there is a patently easy way to convert JKS keystores to PKCS12 certificate bundles (and vice versa). It’s a keytool command that was introduced with JDK 6:
Convert JKS to P12
keytool -importkeystore -srckeystore keystore.jks -srcstoretype JKS -deststoretype PKCS12 -destkeystore keystore.p12
Convert P12 to JKS
keytool -importkeystore -srckeystore keystore.p12 -srcstoretype PKCS12 -deststoretype JKS -destkeystore keystore.jks
Mucho gratitude to tomas at EJBCA for blogging about this last year .. I’m just annoyed at myself for not having found the post earlier.
- zac.
Christchurch
Some trip notes that are a few weeks late now:
- This trip was my first international flight with JetStar. Pro tips: make a point of being first in queue, even if that means being at the airport 3 1/2 hours before departure. Exit row seats (aim for row 13 on the JQ A320/321) are significantly more comfortable than non-exit row seats. Expect your bags to be weighed – the 10kg cabin baggage limit is rigorously enforced.
- The Qantas First lounge at MEL is really quite lovely – very intimate feel, great menu, good booze. In saying that, I was initially offered some Moet & Chandon rubbish, but they were quite quick to get the Veuve Cliquot flowing after I asked if there was anything better!
- Flying on JetStar really isn’t that bad, all things considered. Set your expectations appropriately and have travel insurance in case something goes wrong. Sure, I didn’t get fed – but the staff were polite and friendly, the flights departed and arrived when they said they would and I even had a seat spare next to me (both ways)! Was entertaining to board the flight back to see the exact same CSM from the flight over – she remembered me (or pretended to), which I thought was nice touch. No status credits is a bit of a downer, but you can’t expect the world for a $160 return airfare.
- Hotel Off The Square was a great choice of hotel, perfect location, comfy bed, proper shower – however might be a bit noisy for some (didn’t bother me in the slightest). No on-site parking or restaurant might be a deal breaker also (again, not something I was worried about).
- Christchurch is really nice – the river winds through the northern end of the city centre and has lots of weeping willows and parkland around it, which is very pretty. The city is fairly quiet and laid back; not really a party town but great for a relaxing weekend away (which is exactly what I was after). Loads of good bars and cafes also down Lichfield Street – including my pick, Le Plonk. Awesome vibe, great cocktails, live music. Also good was St Germain, a french restaurant I took myself to dinner at. They had a vego menu! Also great wines, but slightly disappointed that they didn’t have the liqueur of the same name (previously, previously) – however they redeemed themselves with a wicked French 75 at the end of my meal, so was very happy. Definitely a place I’d love to spend a week or two in and around – maybe hire a car and see some of the surrounding countryside too.
- zac.