Java Keystore Import Error

When trying I started recieveing the following error:

keytool error: java.lang.Exception: Input not an X.509 certificate

My certificate was in the .pem format and all that I had to do was convert the certificate using the following command:

openssl x509 -outform der -in mycert.pem -out mycert.der

Then I was able to import the certificate using:

keytool -keystore /location/of/keystore -import -alias mycertalias -file mycert.der

XCA Certificate Authority

After much searching and testing various Linux GUI certificate authority applications I finally found one that works consistently and gives me all of the options that I need.  I am not exactly sure how I missed it as it has been out for some time but XCA has turned out to be exactly what I was looking for.  The biggest issue I had was creating certificates for Windows Servers in order to setup LDAPS.  I had used TinyCA2, GnoMint, and various others.  Both were either limited in their capabilities or failed to work consistently.  I even tried to go setup full PKI systems like EJBCA and Windows Certificate Services but found them to be to difficult to pick up in the limited amount of time I had to learn how to use it.

XCA uses a Qt based GUI interface that is well organized and full featured.  I found the ability to create templates a great time saver when you have to crank out lots of certificates. Plus the ability to export to any format is also very handy as sometimes I never know what I need and I can never remember the correct openssl commands to convert to different formats.

http://sourceforge.net/projects/xca/

http://xca.sourceforge.net/

Importing Key and Certificate into Java Keystore

For whatever reason I had a hell of a time trying to import the key and certificate from a third party CA into a Java keystore (JKS) that was used by a java web application.  I just kept finding incorrect steps on how to do it and then after about 3 days of monkeying around with it I finally found what worked.  

The first step was to export the key and certificate into PKCS12 format (either .pfx or .p12 file extension).  The keytool treats the PKCS12 file as a keystore.  If you are using Tomcat or some other Java application server you can actually use the file as a keystore without importing it into a JKS. The keytool gives you the ability to merge keystores which is what I ended up doing.  After several attempts the below command was what I ended up with.

keytool -importkeystore -destkeystore /certs/my.javakeystore -srckeystore certAndKey.p12  -srcstoretype PKCS12

I tried several times with the -alias option and it kept failing giving this error:

keytool error: java.lang.Exception: Alias <alias1> does not exist

I found that the alias that is used initially is in the PKCS12 file.  If the alias you are using does not match up to the alias, which I am assuming is the internal or friendly name, then it will fail.  So if you leave the alias option off then it will import using the default alias that is sees in the PKCS12 file.  In my case it was identical to one I had in my keystore already and it let me change the alias name during the import process.

Setting GRUB2 Password on Debian Squeeze (6.0.5)

To generate the hashed password run the following and enter the password you want to use:

grub-mkpasswd-pbkdf2

Example output:

grub.pbkdf2.sha512.10000.AKSDAKSDJ939302502NKJKANVKANVWIEN2034928345092835ADSIFUA09UFN23548098DF0SDFLKSJDRO0395203WELRFISDUF09U45

Then edit /etc/grub.d/40_custom and append the following lines to the end of the file.  I am using the user root here in this instance.  It is not the same as the system's root account and you can create multiple accounts if you want with whatever names you wish.  Make sure you replace the entry after root with your own output from the grub-mkpasswd-pbkdf2 command.

set superusers="root"

password_pbkdf2 root grub.pbkdf2.sha512.10000.AKSDAKSDJ939302502NKJKANVKANVWIEN2034928345092835ADSIFUA09UFN23548098DF0SDFLKSJDRO0395203WELRFISDUF09U45

Once you have saved that run update-grub and reboot your system.  When it gets to the boot menu then you should try to edit the entries and see if it asks for your username and password in order to test the configuration.

How to Add a Jailed User to the SFTP Only

*Note* These instructions work only with OpenSSH version 5.0 and newer.

Now when you create users that need to be jailed, make sure they belong to the 'sftponly' group. For the user "denis" with the password "test", you will need to do the following steps.

useradd denis
usermod -g sftponly denis
usermod -s /bin/false denis
usermod -d /home/denis denis
passwd denis

Add the User to the SSHD Config

nano /etc/ssh/sshd_config

Add the new user to the end of the list with AllowUser before their name.

Then restart sshd by running: /etc/init.d/sshd restart

To set up the jail run the following commands

chmod 755 /home/denis
chown root:root /home/denis
mkdir /home/denis/data
chown denis:sftponly /home/denis/data

Setting up the atftpd server on Debian Squeeze

I have recently had some issues trying to use tftpd server in conjunction with some of my Cisco equipment.  I kept getting these errors regardless of actual permissions on the system:

%Error opening tftp://192.168.130.6/c1841-ipbase-mz.124-1c.bin (Permission denied)

So I uninstalled that and installed the atftpd server package.  That seemed to do the trick.  I did have to change the default directory as I did already have a directory full of IOS files that I was just too lazy to move where the maintainers think I should put it.  So here are the steps I took to get things working.

1. Install the atftpd package from the repository.

apt-get install atftpd

2. Add this line into /etc/inetd.conf:

tftp dgram udp4 wait nobody /usr/sbin/tcpd /usr/sbin/in.tftpd --tftpd-timeout 300 --retry-timeout 5 --mcast-port 1758 --mcast-addr 239.239.239.0-255 --mcast-ttl 1 --maxthread 100 --verbose=5 /tftpboot

3. Create /tftpboot directory and change permissions to allow writing to the directory.

mkdir /tftpboot

chmod 777 /tftpboot

4. Restart the inetd server.  To restart the server on Debian run:

/etc/init.d/openbsd-inetd restart

After I followed those steps I was able to connect to the server from my Cisco equipment and transfer files both ways.  

You may want to disable the server when you are not actively using it.  To do this comment out the line you added to /etc/inetd.conf and restart or stop inetd.

Changing umask setting for all users

In order to have the umask setting change for all users at login the umask setting in /etc/profile needs to be changed.

1. Use text editor to edit /etc/profile. *Note: You need root access to edit this file.

sudo nano -w /etc/profile

2. Edit the umask line located at the end of the file. *Note: This example is setting the umask to allow the owner and group have read/write while others have no permissions.

umask 007

3. Type in Crtl-X, Y, and hit the Enter key to save and exit.