Skip to content

Instantly share code, notes, and snippets.

View alopresto's full-sized avatar
🔏
Focusing on NiFi security...

Andy LoPresto alopresto

🔏
Focusing on NiFi security...
View GitHub Profile
@alopresto
alopresto / test_output.txt
Created December 13, 2015 00:41
Test output from trying multiple PBE ciphers on various security providers
/Library/Java/JavaVirtualMachines/jdk1.8.0_66.jdk/Contents/Home/bin/java *.crypto.OpenSSLPBEEncryptorTest,testShouldNotEncryptAndDecryptWithPBELongPasswordWith128BitKeyAndDefaultJCEProvider
[main] INFO com.hortonworks.crypto.OpenSSLPBEEncryptorTest - Running in limited encryption mode
[main] INFO com.hortonworks.crypto.OpenSSLPBEEncryptorTest - Available JCE providers: SUN, SunRsaSign, SunEC, SunJSSE, SunJCE, SunJGSS, SunSASL, XMLDSig, SunPCSC, Apple, BC
[main] INFO com.hortonworks.crypto.OpenSSLPBEEncryptorTest - Password: thisIsABadPassword
[main] INFO com.hortonworks.crypto.OpenSSLPBEEncryptorTest - Salt : saltsalt
[main] INFO com.hortonworks.crypto.OpenSSLPBEEncryptorTest - Checking algorithm PBEWITHMD5AND128BITAES-CBC-OPENSSL
[main] INFO com.hortonworks.crypto.OpenSSLPBEEncryptorTest - Running with provider SUN
[main] WARN com.hortonworks.crypto.OpenSSLPBEEncryptorTest - Provider SUN does not support cipher PBEWITHMD5AND128BITAES-CBC-OPENSSL
[main] INFO com.hortonworks.crypto.OpenSSLPBE
@alopresto
alopresto / test_output_pem.txt
Created December 16, 2015 22:42
Test code and output using BcPEMDecryptorProvider to try to decrypt an OpenSSL-encrypted file
@Test
public void testShouldDecryptOpenSSLWithBcPEMDecryptor() throws Exception {
// Arrange
if (!isUnlimitedStrengthCrypto()) {
logger.info("Running in limited encryption mode. Overriding...")
setJCEUnlimitedStrength()
logger.info("Now running with unlimited strength crypto")
}
logger.info("Plaintext: ${plaintext}")
@alopresto
alopresto / NiFi certificate explanation.md
Created March 1, 2016 20:22
A response to a comment trying to separate the concerns of NiFi TLS, client authentication, and external service TLS.

I understand the differences are subtle because a lot of the terminology overlaps, but these are two very different activities. In the article you linked to, the steps described are intended to strengthen the service NiFi is providing and the ability of users to connect. As an analogy, let's describe building a bank.

By default, the bank is built of wood, has large clear windows with no blinds, and no official sign out front. You've taped a piece of paper saying "GeoffreyBank" to the door (this is plaintext, default, unencrypted HTTP communication from your browser to http://localhost:8080/nifi).

Now, of course, you want to secure your bank. It is going to store valuable items, and people will not use it if they do not trust that you are protecting their property. So, you build stronger walls and put an inner office so that their transactions cannot simply be observed by anyone on the street and you have professional signage so they can recognize that it is the correct bank.

This is analogous to

@alopresto
alopresto / noneEmptyELTest.java
Created March 23, 2016 05:17
A Java JUnit test demonstrating an expression language query which will return true if and only if all attributes enumerated are not empty (i.e. not null, zero-length, or all whitespace characters).
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
@alopresto
alopresto / cipherscan.txt
Created March 30, 2016 05:38
Results of cipherscan and analysis for default secure NiFi 0.6.0.
hw12203:/Users/alopresto/Workspace/cipherscan alopresto
🔓 1s @ 21:57:02 $ python analyze.py -t nifi.nifi.apache.org:8443
nifi.nifi.apache.org:8443 has bad ssl/tls
Things that are bad:
* don't use an untrusted or self-signed certificate
Changes needed to match the old level:
* enable SSLv3
* use a certificate with sha1WithRSAEncryption signature
@alopresto
alopresto / nifi.properties
Created May 15, 2016 23:37
Example NiFi configuration file for debugging AuthorityProvider context loading error.
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
@alopresto
alopresto / authorized-users.xml
Created May 15, 2016 23:39
NiFi config file
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
@alopresto
alopresto / Process.java
Created September 28, 2016 00:08
A Java class which prints the provided arguments to both System.out and System.err for debugging purposes
package org.apache.nifi.process;
import java.util.Arrays;
public class Process {
public static void main(String[] args) {
String allArgs = String.join(" ", Arrays.asList(args));
System.out.println("[System out] Provided arguments: " + allArgs);