In an effort to save us simpletons from helping Russian hackers to exploit security flaws in Microsoft operating systems, as part of the latest Windows 10 release/update (and maybe earlier), you can not much control patch downloads and installations.
You can determine if downloaded software is JUST critical patches or other stuff too. You can control (through a setting) what your "work hours" are, up to an 18 hour window. But you can NOT tell Windows 10 that you only want it to reboot (if it has to as a result of a patch) at a specific time. You used to could but that has gone away.
So, if you have a PC that is used for business and is needed on a 24/7 basis and needs to perform on-going tasks (or services) like scheduled file transfers, you can NOT instruct Windows as to when you want the system to reboot (if it needs to as part of an update).
Too bad, so sad if that untimely reboot happens to interrupts your work. If you happen to be online you can postpone the reboot for a bit. If you happen to need to, you can postpone all updates for 25(?) days. What you can't do is you can NOT manage your own PC updates any more. YOU my friend are just too stupid.
The result of this change is that more and more "professional" folks will simply disable the Windows update service so that it NEVER runs. Which in turn will make the security environment that caused Microsoft to make this decision, even worse. Nice going Microsoft! Shame that Microsoft did not consult with folks that use their software before making this sorts of changes. It is even more of a shame that Microsoft is so BAD at writing secure code that this sort of process change is even needed.
Showing posts with label software. Show all posts
Showing posts with label software. Show all posts
Friday, January 19, 2018
Friday, October 6, 2017
Calling Java classes from PowerShell in order to change an iSeries/AS400 password
I was recently working on a "solution" to allow an automated process on a Window 10 system to interact with an iSeries system. A part of the problem to be solved is that the iSeries system in question has a rule requiring frequent password changes. Understandable but not conducive to automated processing. Additionally, the user under which this process would run does not have SECADM rights so calling chgusrprf through FTP was not an option. What to do, what to do...
Search web, search web, search web...
Seems that IBM has a "Toolbox for Java" product (http://www-03.ibm.com/systems/power/software/i/toolbox/) and just so happens that there is a open source version called JTOpen (http://jt400.sourceforge.net/ - got to love that) that supports changing your password remotely.
OK, now I have a possible solution. How do I call a Java class from PowerShell?
Search web, search web, search web...
Try, search, try, search, try search...
Fail... Issues finding the proper classes in the JTOpen to do a password change as this is a toolkit for you to build solutions out of.
Search web, search web, search web...
SOLUTION! Someone (don't you LOVE the Internet?) had a similar issue and wrote a Java JAR to encapsulate the problem into a simple command line type of call. You can get it here: https://github.com/cwg999/AS400PasswordChanger/tree/master/export
Downloaded that.
More try(s) and search(es) and finally SUCCESS!
Here is my simple "walk through" of the above solution in PowerShell. I will wind up putting this into a much larger script that will be scheduled to run in half of the configured password life time.
- Get AS400PasswordChanger.jar from the above link.
- Create a directory and copy that JAR file into it.
- Open a PowerShell.
- In PowerShell, change to the directory you created (that contains the JAR file).
- Enter the following command:
java -jar ./AS400PasswordChanger.jar {iSeries name/IP} {user name} {current password} {new password}
If all goes well, you should see: Change Successful.
The only error I got once I actually got it to work (all prior errors were PowerShell or Java errors) was this one and that was because the iSeries I was using for testing does not allow you to change your password more than once per 24 hours and I had to change it when I logged in due to it having expired already:
com.ibm.as400.access.AS400SecurityException: Password change is not allowed at this time.:{user name}
Hope this saves someone else some time.
Search web, search web, search web...
Seems that IBM has a "Toolbox for Java" product (http://www-03.ibm.com/systems/power/software/i/toolbox/) and just so happens that there is a open source version called JTOpen (http://jt400.sourceforge.net/ - got to love that) that supports changing your password remotely.
OK, now I have a possible solution. How do I call a Java class from PowerShell?
Search web, search web, search web...
Try, search, try, search, try search...
Fail... Issues finding the proper classes in the JTOpen to do a password change as this is a toolkit for you to build solutions out of.
Search web, search web, search web...
SOLUTION! Someone (don't you LOVE the Internet?) had a similar issue and wrote a Java JAR to encapsulate the problem into a simple command line type of call. You can get it here: https://github.com/cwg999/AS400PasswordChanger/tree/master/export
Downloaded that.
More try(s) and search(es) and finally SUCCESS!
Here is my simple "walk through" of the above solution in PowerShell. I will wind up putting this into a much larger script that will be scheduled to run in half of the configured password life time.
- Get AS400PasswordChanger.jar from the above link.
- Create a directory and copy that JAR file into it.
- Open a PowerShell.
- In PowerShell, change to the directory you created (that contains the JAR file).
- Enter the following command:
java -jar ./AS400PasswordChanger.jar {iSeries name/IP} {user name} {current password} {new password}
If all goes well, you should see: Change Successful.
The only error I got once I actually got it to work (all prior errors were PowerShell or Java errors) was this one and that was because the iSeries I was using for testing does not allow you to change your password more than once per 24 hours and I had to change it when I logged in due to it having expired already:
com.ibm.as400.access.AS400SecurityException: Password change is not allowed at this time.:{user name}
Hope this saves someone else some time.
Tuesday, February 14, 2017
Accessing Salesforce from Powershell
I am working on a small side project at work and need to pull some account data from Salesforce to merge into a database. This has to be done with some regularity so instead of continuing to do this manually, I decided to create a Powershell script to get the data, convert it into a form that can be imported, and add that to the existing job that that runs to do other data merge tasks.
To save others some time, I am showing the basic Powershell / Salesforce script here:
# Salesforce web service access
$getUserID = Read-Host -Prompt 'Enter Salesforce user ID' # prompt for the Salesforce user
$getPassword = Read-Host -Prompt 'Enter Salesforce password' -AsSecureString # prompt for the Salesforce user password
$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR( $getPassword ) # convert into form that supports decrypting
$plaintextpassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto( $BSTR ) # descrypt string so that we can sent as part of request
# issue the actual OAuth request
$url = "https://login.salesforce.com/services/oauth2/token" # OAuth URL
$params = @{ # OAuth parameters
grant_type="password";
client_id="{replace with your actual Salesforce client_id}";
client_secret="{replace with your actual Salesforce client_secret}";
username="$getUserID";
password="$plaintextpassword"
}
# invoke OAuth call to get security token
$token = Invoke-RestMethod -Uri $url -Method Post -Body $params -ContentType "application/x-www-form-urlencoded"
#"here it is: $token"
# show that it works by getting list of available reports...
$WorkingURI = $Token.instance_url+"/services/data/v35.0/analytics/reports"
Invoke-RestMethod -URI $WorkingURI -Method GET -Headers @{ "Authorization" = "OAuth " + $Token.access_token };
# and then run a query...
$sql="select parent.name, name from account"
$WorkingURI = $Token.instance_url+"/services/data/v20.0/query/?q=$sql"
Invoke-RestMethod -URI $WorkingURI -Method GET -Headers @{ "Authorization" = "OAuth " + $Token.access_token } | ConvertTo-Json
# eof
As an added bonus, it prompts the user for their Salesforce user ID and password. This can/will have other uses. The script its self should be self-explanatory. After successful authorization, the script runs a couple of simple calls, one to retrieve a list of reports and the other to run a simple query.
It makes use of the "password" form of OAuth. You will need to configure Salesforce to allow this to work. Part of that is setting up Salesforce for REST web service access. Doing this will cause the system to generate the client_id and client_secret values that you need to pass in order to generate the token. This link will walk you through that. This script will work with a "chatter" user account as long as you set the permissions. You will need something better than a chatter account to get Salesforce configured.
Have fun...
To save others some time, I am showing the basic Powershell / Salesforce script here:
# Salesforce web service access
$getUserID = Read-Host -Prompt 'Enter Salesforce user ID' # prompt for the Salesforce user
$getPassword = Read-Host -Prompt 'Enter Salesforce password' -AsSecureString # prompt for the Salesforce user password
$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR( $getPassword ) # convert into form that supports decrypting
$plaintextpassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto( $BSTR ) # descrypt string so that we can sent as part of request
# issue the actual OAuth request
$url = "https://login.salesforce.com/services/oauth2/token" # OAuth URL
$params = @{ # OAuth parameters
grant_type="password";
client_id="{replace with your actual Salesforce client_id}";
client_secret="{replace with your actual Salesforce client_secret}";
username="$getUserID";
password="$plaintextpassword"
}
# invoke OAuth call to get security token
$token = Invoke-RestMethod -Uri $url -Method Post -Body $params -ContentType "application/x-www-form-urlencoded"
#"here it is: $token"
# show that it works by getting list of available reports...
$WorkingURI = $Token.instance_url+"/services/data/v35.0/analytics/reports"
Invoke-RestMethod -URI $WorkingURI -Method GET -Headers @{ "Authorization" = "OAuth " + $Token.access_token };
# and then run a query...
$sql="select parent.name, name from account"
$WorkingURI = $Token.instance_url+"/services/data/v20.0/query/?q=$sql"
Invoke-RestMethod -URI $WorkingURI -Method GET -Headers @{ "Authorization" = "OAuth " + $Token.access_token } | ConvertTo-Json
# eof
As an added bonus, it prompts the user for their Salesforce user ID and password. This can/will have other uses. The script its self should be self-explanatory. After successful authorization, the script runs a couple of simple calls, one to retrieve a list of reports and the other to run a simple query.
It makes use of the "password" form of OAuth. You will need to configure Salesforce to allow this to work. Part of that is setting up Salesforce for REST web service access. Doing this will cause the system to generate the client_id and client_secret values that you need to pass in order to generate the token. This link will walk you through that. This script will work with a "chatter" user account as long as you set the permissions. You will need something better than a chatter account to get Salesforce configured.
Have fun...
Friday, October 25, 2013
AWK Musings
I like AWK and have used it for years. I feel that it is an elegant language that does what it was designed to do quite well. I don't use it very much at all anymore due to how what I do has changed over the years. It is still in my toolbox and every now and then I like to pull it out, dust it off and use it even if I really don't have a need.
While thinking about this on my way to work this morning, I wondered if there was a web hosted version of AWK (figured there had to be as everything is on the internet) and lo and behold there is! It is an implementation of AWK in JavaScript and is available here. Have not used it much so can not say what (if any) the limitations are but it has worked for the simple things I have thrown at it.
There is also an AWK PDF manual available here (as well as many other places).
Additionally there is also an online "run anything" web site here that supports a great many languages including ADA, AWK, C#, COBOL, Fortran, etc. It has a nice editor and it has worked on the C and AWK that I have submitted. Very nice!
While thinking about this on my way to work this morning, I wondered if there was a web hosted version of AWK (figured there had to be as everything is on the internet) and lo and behold there is! It is an implementation of AWK in JavaScript and is available here. Have not used it much so can not say what (if any) the limitations are but it has worked for the simple things I have thrown at it.
There is also an AWK PDF manual available here (as well as many other places).
Additionally there is also an online "run anything" web site here that supports a great many languages including ADA, AWK, C#, COBOL, Fortran, etc. It has a nice editor and it has worked on the C and AWK that I have submitted. Very nice!
Tuesday, October 8, 2013
ColdFusion (Railo) and RSA Public Key Encryption
I was working on a project that involved having to encrypt some data with a public RSA key that is retrieved from a web service, used to encrypt some data and submit that data as part of a larger XML document back to the service. The data is for performing a web based credit card authorization. The card number and security code need to be individually encrypted using a public key. As this is for a web project, my web language of choice is ColdFusion. I have used it since version 4 and think that you can not beat it for power and speed of development. I just expected that this would be no problem. I was wrong...
I am fond of ColdFusion but not so fond of the most recent releases (since MX). Just did not like where it was going and was not fond of the cost. I like the earlier releases though I thought the move to a true Java core was spot-on. I kept a lookout at the various open source efforts but was not committed.
I had reason to look back into this a couple of months ago (not for this project but close) and came across the Railo project. I am impressed. The quick start version is just fantastic. Download, unzip, and launch. There you go. A local CF development environment at no cost. So far it is really compatible (with the CF versions that I like) and I have not run into any issues to speak of. What is not to love?
Back to my current project.
So, I have to retrieve a public RSA key from a remote web service (any one of many keys will be returned and so when I submit my encrypted data I have to include the ID of the key used), rebuild the public key, use the public key to encrypt sensitive card data and then submit that data to a web service for processing. I had everything done but the encryption part. I searched the web for CF examples/samples of doing RSA and most of the examples I came across assumed you are issuing the key and so show you how to make both the public and private keys and how to encode using the private key. Not a lot on rebuilding a public key. Also, a good bit of "Bouncy Castle" but I wanted to stick with the basic Java (and I had some issues with the BC solution).
To make it function, I wound up using a number of Java classes from within CF. I have stripped out most/all of the error checking and the non-encryption related code. I also slimmed down the comments to fit within the formatting limitations. Even with that, this should still be plenty to get you going and I hope it saves someone the effort I had to go through. If you already have the key parts and just need to build a public key, lines 50 through 83 are the meat and 96 to 99 do the actual data encryption.
Have fun!
I then include the web safe, encrypted strings in my larger XML document, BineryEncode the entire thing and submit.
Good luck and hope this helps!
Update: 5/12/2016
OK, looks like Railo is dead and a replacement is available called Lucee. I am just starting to use it so can not say much about it at this time. If I get a chance [and think about it], I will update with additional information.
I am fond of ColdFusion but not so fond of the most recent releases (since MX). Just did not like where it was going and was not fond of the cost. I like the earlier releases though I thought the move to a true Java core was spot-on. I kept a lookout at the various open source efforts but was not committed.
I had reason to look back into this a couple of months ago (not for this project but close) and came across the Railo project. I am impressed. The quick start version is just fantastic. Download, unzip, and launch. There you go. A local CF development environment at no cost. So far it is really compatible (with the CF versions that I like) and I have not run into any issues to speak of. What is not to love?
Back to my current project.
So, I have to retrieve a public RSA key from a remote web service (any one of many keys will be returned and so when I submit my encrypted data I have to include the ID of the key used), rebuild the public key, use the public key to encrypt sensitive card data and then submit that data to a web service for processing. I had everything done but the encryption part. I searched the web for CF examples/samples of doing RSA and most of the examples I came across assumed you are issuing the key and so show you how to make both the public and private keys and how to encode using the private key. Not a lot on rebuilding a public key. Also, a good bit of "Bouncy Castle" but I wanted to stick with the basic Java (and I had some issues with the BC solution).
To make it function, I wound up using a number of Java classes from within CF. I have stripped out most/all of the error checking and the non-encryption related code. I also slimmed down the comments to fit within the formatting limitations. Even with that, this should still be plenty to get you going and I hope it saves someone the effort I had to go through. If you already have the key parts and just need to build a public key, lines 50 through 83 are the meat and 96 to 99 do the actual data encryption.
Have fun!
1: <!--- create a web service object --->
2: <cfset webService =
3: createobject("webservice", "https://URL/RequestHandler.svc?wsdl")>
4:
5: <!--- build request for public RSA encryption key --->
6: <cfxml variable="xmldoc" caseSensitive="yes">
7: <requestHeader>
8: <stuff />
9: </requestHeader>
10: </cfxml>
11:
12: <!--- make xml document internet safe --->
13: <cfset xmldoc64 = toBase64( #xmldoc# )>
14:
15: <!--- make the request (via web services) --->
16: <cfset resultsRaw =
17: webService.ProcessRequest( "#xmldoc64#" )>
18:
19: <!--- convert/format results into an xml object --->
20: <cfxml variable="resultsXmlDoc" caseSensitive="yes">
21: <cfoutput>#ToString( ToBinary( resultsRaw ) )#</cfoutput>
22: </cfxml>
23:
24: <!--- check the results code to see if it worked --->
25: <cfif resultsXmlDoc.EncryptionKey.ResponseCode.XmlText eq "0">
26: <!--- now convert the encryption key information
27: into an xml object so it is easier to use (the
28: initial XML doc actually contains another XML doc
29: with the key info) --->
30: <cfxml variable="xmlResultsPublicKey" caseSensitive="yes">
31: <cfoutput>#resultsXmlDoc.EncryptionKey.responseMessage.PublicKey.XmlText#</cfoutput>
32: </cfxml>
33:
34: <!--- save the parts of the RSA key data --->
35: <!--- service can return many keys, save ID --->
36: <cfset publicKeyID =
37: resultsXmlDoc.EncryptionKey.responseMessage.ID.XmlText>
38: <!--- main part of the public key (to be) --->
39: <cfset epublicKeyModulus =
40: xmlResultsPublicKey.RSAKeyValue.Modulus.XmlText>
41: <!--- minor part of the public key (to be) --->
42: <cfset epublicKeyExponent =
43: xmlResultsPublicKey.RSAKeyValue.Exponent.XmlText>
44: </cfif>
45:
46:
47: <!--- now that we have all of the parts, we need to
48: make a valid java RSA key object from the parts --->
49:
50: <!--- create java string object for key modulus --->
51: <cfset encodedKeyModulus =
52: createObject( "java", "java.lang.String" ).init( epublicKeyModulus )>
53: <!--- create java string object for key exponent --->
54: <cfset encodedKeyExponent =
55: createObject( "java", "java.lang.String" ).init( epublicKeyExponent )>
56:
57: <!--- need a java BigInt AND decoding on the fly --->
58: <cfset modulusKey =
59: createObject( "java", "java.math.BigInteger" ).init( 1, BinaryDecode( encodedKeyModulus.getBytes( "UTF-8" ), "base64" ) )>
60: <cfset exponentKey =
61: createObject( "java", "java.math.BigInteger" ).init( 1, BinaryDecode( encodedKeyExponent.getBytes( "UTF-8" ), "base64" ) )>
62:
63: <!--- build the KeySpec and load it with key parts --->
64: <cfset javaKeySpec =
65: createObject( "java", "java.security.spec.RSAPublicKeySpec" ).init( modulusKey, exponentKey )>
66:
67: <!--- build RSA key factory for rebuilt public key --->
68: <cfset javaKeyObject =
69: createObject( "java", "java.security.KeyFactory" ).getInstance( "RSA" )>
70:
71: <!--- use the keyspec to initialize the key factory,
72: instantiating a RSA public key from its encoding and
73: recreating a valid public key --->
74: <cfset javaKey = javaKeyObject.generatePublic( javaKeySpec )>
75:
76:
77: <!--- create a new java cipher object and load it with
78: our new (rebuilt) RSA public key --->
79:
80: <!--- mode tells the Cipher we will be encrypting --->
81: <cfset cipher =
82: createObject( "java", "javax.crypto.Cipher" ).getInstance( "RSA" )>
83: <cfset i = cipher.init( cipher.ENCRYPT_MODE, javaKey )>
84:
85: <!--- convert strings into java strings --->
86: <cfset stringCardData =
87: createObject( "java", "java.lang.String" ).init( Session.data.card )>
88: <cfset stringCvvData =
89: createObject( "java", "java.lang.String" ).init( Session.data.cvv )>
90:
91: <!--- ensure strings are the proper character set --->
92: <cfset stringCardDataBytes = stringCardData.getBytes( "UTF8" )>
93: <cfset stringCvvDataBytes = stringCvvData.getBytes( "UTF8" )>
94:
95: <!--- now to perform the encryption on each string --->
96: <cfset encryptedCardData =
97: cipher.doFinal( stringCardDataBytes, 0, len( StringCardData ) )>
98: <cfset encryptedCvvData =
99: cipher.doFinal( stringCvvDataBytes, 0, len( StringCvvData ) )>
100:
101: <!--- base64 them so they are internet safe --->
102: <cfset base64CardData =
103: BinaryEncode( encryptedCardData, "base64" )>
104: <cfset base64CvvData =
105: BinaryEncode( encryptedCvvData, "base64" )>
106:
107: <!--- DONE, we should now have proper, public key
108: encrypted data! Congratulations! --->
I then include the web safe, encrypted strings in my larger XML document, BineryEncode the entire thing and submit.
Good luck and hope this helps!
Update: 5/12/2016
OK, looks like Railo is dead and a replacement is available called Lucee. I am just starting to use it so can not say much about it at this time. If I get a chance [and think about it], I will update with additional information.
Friday, August 2, 2013
VirtualBox by Oracle
If you have not heard of VirtualBox by Oracle you are missing out on a "very good" thing. VirtualBox is an Oracle product that allows you to create multiple virtual PCs within your existing system. These can be Windows, Linux, Mac or others. Using this software you can run Windows XP on an Intel Mac. You can run OSX on a Win8 system. You can even run Win95 or 2000 Server on a Win7 system.
I have one Win XP Pro, 2 Win 2000 Server, a OS X 10.8.2 and an Ubuntu all as virtual environments on my Win8 laptop.
The best part is, the software is free. Yep, free!
So, if you like to play with different operating systems but don't want a bunch of hardware or you want to be able to play your old PC games but they won't install on Win8, why not give VirtualBox a try?
I have one Win XP Pro, 2 Win 2000 Server, a OS X 10.8.2 and an Ubuntu all as virtual environments on my Win8 laptop.
The best part is, the software is free. Yep, free!
So, if you like to play with different operating systems but don't want a bunch of hardware or you want to be able to play your old PC games but they won't install on Win8, why not give VirtualBox a try?
Subscribe to:
Posts (Atom)
