Shade Grown Code

2011-02-04T13:50:00.003-05:00

As a follow up to Remco's How to set up Tomcat logging to Syslog, I am including my own version of a class that enables Tomcat logging to Syslog. This class overrides the standard AccessLogValve and logs messages via Log4J API to category accesslog, level INFO.

To compile this class, you will need catalina.jar and servlet-api.jar in your CLASSPATH.

To configure Tomcat to use this class, edit your conf/server.xml and replace className in the access logging Valve with com.ofc.tomcat.Log4JAccessLogValve. Then, in lib/log4j.properties, configure appenders for category accesslog (property log4j.logger.accesslog)


package com.ofc.tomcat;

/**
 * Redirects AccessLogValve logging to Log4J category "accesslog" level info
 * 
 * @author Nicholas Sushkin
 * @version $Revision: 1.2 $ $Date: 2011/02/04 18:45:36 $
 */
public class Log4JAccessLogValve extends org.apache.catalina.valves.AccessLogValve
{
   /**
    * The descriptive information about this implementation.
    */
    protected static final String info1 =
        "com.ofc.tomcat.Log4JAccessLogValve/1.0";

    private static final org.apache.log4j.Logger log = 
            org.apache.log4j.LogManager.getLogger("accesslog");

    @Override
    public void log(String message)
    {
        log.info(message);
    }

    @Override
    public String getInfo()
    {
        return info1;
    }

    @Override
    protected void open()
    {
    }
}

Troubleshooting tftp-proxy in OpenBSD pf

2010-03-21T22:35:00.009-04:00

Finally figured out OpenBSD firewall configuration in which internal hosts can access TFTP servers on the internet. In OpenBSD pf firewall, you need to configure tftp-proxy. Google search returns a lot of complaints about tftp-proxy not working and not a single success story. I now believe there is a typo in the official manual.

The OpenBSD FAQ for TFTP proxy specifies the following redirect rule to redirect outgoing tftp connections to the internal tftp-proxy.

rdr pass log on $int_if proto udp from $int_if to port tftp -> 127.0.0.1 port 6969

However, according to "pfctl -g -s nat|grep tftp", my pf expands the rule above to the following.

rdr pass log on xl0 inet proto udp from 192.168.2.1 to any port = tftp -> 127.0.0.1 port 6969

It's clear that the expanded rule will will not redirect traffic coming from all of the internal hosts. The rule needs to be changed to

rdr pass log on $int_if proto udp from $int_net to any port tftp -> 127.0.0.1 port 6969

which expands to

rdr pass log on xl0 inet proto udp from 192.168.2.0/24 to any port = tftp -> 127.0.0.1 port 6969

The latter covers the whole internal network instead of just one host 192.168.2.1.

Importing S/MIME certificate into Java

2010-02-25T21:10:00.003-05:00

Although it is now possible to import a certificate in p12 format, into java, just any S/MIME certificate will not work to sign jars.

Thawte used to give out free S/MIME certificates and when imported into Java, those certificates could sign java code. I recently tried to import a Comodo S/MIME certificate into a Java keystore and sign a jar. While I managed to export my S/MIME certificate from Firefox in .p12 format and import .p12 keystore into a Java keystore, signing with this certificate generated a warning "The signer certificate's ExtendedKeyUsage extension doesn't allow code signing." Also, Web Start failed to validate the signed jar, generating an exception in com.sun.deploy.security.CertUtils in the following code

// Require either all of bits 5,6,7 are false or
// that at least bit 7 be true
if ((getNetscapeCertTypeBit(cert, NSCT_SSL_CA) != false ||
getNetscapeCertTypeBit(cert, NSCT_S_MIME_CA) != false ||
getNetscapeCertTypeBit(cert, NSCT_OBJECT_SIGNING_CA) != false) &&
getNetscapeCertTypeBit(cert, NSCT_OBJECT_SIGNING_CA) == false)
{
Trace.msgSecurityPrintln("trustdecider.check.basicconstraints.bitvalue");
return false;
}

To get my S/MIME certificate from Java, I used Firefox Certificate backup as p12, then the following command to find the alias of my certificate inside the .p12 keystore:

keytool -list -keystore comodo-nsushkin\@openfinance.com-exp20120930.p12 -storetype PKCS12

Once I found out the alias "nicholas sushkin's the usertrust network id #3", I imported my S/MIME private key and certificate from p12 file into my JKS keystore under alias "nsushkin" using the following command:

keytool -importkeystore -deststorepass changeit -destkeypass changeit -destkeystore java-certs.keystore -srckeystore comodo-nsushkin\@openfinance.com-exp20120930.p12 -srcstoretype PKCS12 -alias "nicholas sushkin's the usertrust network id #3" -destalias nsushkin

Fixing broken sound in flash plugin in Slackware 13.0

2009-11-14T17:19:00.005-05:00

I upgraded my laptop to Slackware 13.0. In general, hardware support has improved. All hardware was detected automatically by HAL and UDEV. That includes formerly problematic Synaptic touchpad, both monitors attached via DVI and VGA, and Logitech Quickcam. I only needed minor adjustments to get dual screen out of the mirroring mode.

One of the minor problems was that flash plugin in Mozilla wouldn't play sound. That was despite that my username being a member of the group "audio". It turned out that if you had more than one sound device, Flash would only output sound to the first configured device (alsa card #0). When I booted the laptop with webcam attached through USB, the snd-usb-audio module loaded before snd-hda-intel, resulting in the first configured audio device (webcam) not supporting any audio output.

The workaround would be to always boot with the webcam unplugged. However, a better solution is to hint the device loading system (udev) that the built-in intel sound device needs to be loaded first. Google found me a solution in a Slackware forum at linuxquestions.org. Add a file in /etc/modprobe.d containing the following instruction: "options snd slots=snd-hda-intel,snd-usb-audio". You can check the mapping of sound card slots to modules using "cat /proc/asound/modules"

References: Slackware, Where Alsa looks for default sound card, Synaptics Touchpad with HAL, Dual-screen with xrandr.

Command line email with attachments

2009-11-12T16:46:00.003-05:00

This is a perl script which can be used as a replacement for "mail" program, but supporting email attachments.


#!/usr/bin/perl -w

#****h* common/send_files
# NAME
#   send_files - sends an email with multiple file attachments
# FUNCTION
#   Uses sendmail to send an email with attachments. Takes message text
#   from the standard input.
# PARAMETERS
#   --from    - From email address
#   --to      - To email address
#   --subject - Email subject
#   --file    - Attach a file (use multiple times to attach multiple files)
#
#   All the unprocessed options are treated as files to be attached
#
# EXAMPLE
#   echo "Look here" | send_files --from from@example.com --to to@example.com \
#                                 --subject "Files" --file /tmp/1.txt --file /tmp/2.txt
#
#   echo "Specify files last" | send_files --from from@example.com --to to@example.com \
#                                          --subject "Files" --file /tmp/*.txt
# HISTORY
#   $Header: send_files.pl,v 1.6 2008/04/08 20:53:13 nsushkin Exp $
# SOURCE
#
use MIME::Lite;
use MIME::Types;
use Getopt::Long;

my ($opt_from, $opt_to, $opt_subject) = ("", "", "");
my @files = ();
my $VERSION = sprintf("%d.%03d", q$Revision: 1.6 $ =~ /(\d+)\.(\d+)/);

GetOptions("from=s" => \$opt_from,
           "to=s" => \$opt_to,
           "subject=s" => \$opt_subject,
           "file=s" => \@files);

push @files, @ARGV;
$oldC = $/;
binmode STDIN; undef $/;
$message=<STDIN>;
$/ = $oldC;

$msg = MIME::Lite->new(
    From     => $opt_from,
    To       => $opt_to,
    Subject  => $opt_subject,
    Type     => 'TEXT',
    Data     => $message
    );

$msg->replace(
    'X-Mailer' => "send_files.pl $VERSION"
    );

for $file (@files)
{
    die "Not readable $file: $!" unless -r $file;
    chomp (my $mimeTypeS=`file -bi "$file"`);
    my MIME::Type $mimeType = MIME::Types->new->type($mimeTypeS);
    chomp (my $fileName=`basename "$file"`);

    $msg->attach(
        Type     => $mimeTypeS,
        Path     => $file,
        Filename => $fileName,
        Encoding => ($mimeType->mediaType eq 'text' ? 'quoted-printable' : 'base64')
        );
}

$msg->send;
#***

Converting XML Schema to Relax NG

2009-08-29T19:10:00.004-04:00

Needed to convert W3 XML Schema for web.xml files to Relax NG so that I can edit those files in emacs with XML element expansion and syntax highlighting provided by nxml mode. I found a lot of references on the Internet for Sun's XSD to RNG converter. However, most links pointing to Sun website were broken. Finally, I found that RNG converter is a part of the Kohsuke Kawaguchi's MS V project. After installing rngconv.zip, I downloaded web-app_2_4.xsd, j2ee_1_4.xsd, jsp_2_0.xsd from Sun's XML Schemas for J2EE and converted the first one for use with nxml.

One little quirk was to add in the RNC schema a definition for xsi:schemaLocation attribute to the definition of element web-app

namespace xsi = "http://www.w3.org/2001/XMLSchema-instance"
element web-app {
attribute xsi:schemaLocation { "http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" },
...

set role plustrace

2009-03-17T11:59:00.004-04:00

Just spent an hour trying to configure autotrace in Oracle 10.2.0.3.0. It turns out that in addition to granting plustrace role to a user and creating a PLAN table, you also need to enable the plustrace role in the user's session using "SET ROLE PLUSTRACE;"

Read comments at the bottom of Tom Kyte's autotrace topic.

What will save the Earth and Wall Street?

2009-02-27T10:48:00.009-05:00

A couple of recent articles in Wired and O'Reilly claim that technology for transparency, specifically XBRL (Extensible Business Reporting Language), is going to be crucial in saving the climate and also Wall Street. Go learn XBRL now!

In The Wired article, Daniel Roth suggests that XBRL

"...should become the lingua franca of every investment bank, hedge fund, pension fund, insurance company, and endowment fund. ... It is impossible to track any one loan in a CDO [collateralized debt obligation]; when it is combined and divided with other loans, it loses its independent identity... But if those mortgages and loans carried XBRL tags, and everybody who touched them along the way was required to use those tags as well, anyone would have been able to track their circuitous route through the financial industry and judge each CDO based on its actual content."

Chicago Climate Exchange (CCX) is a market for trading offsets of carbon and other climate related emissions, implementing the "trade" component of a "cap and trade" climate control scheme. As far as I understand, currently, CCX takes semi-manual submissions of trades via its website. However, it turns out XBRL can be used to automate carbon credit accounting and trading.

Kurt Cagle writes

"...think of each participant [of smart power grid] as a node in a network. At any given point, the state of that node - how much energy they have available for transmission at that point in time, how much energy they currently need to fulfill demands upon them - can be represented as an XBRL accounting document."

For more information, read the following recent articles

Volkerding praises KDE4 again

2009-02-09T14:25:00.002-05:00

Recently on Slackware ChangeLog, Volkerding wrote:

Tue Jan 27 14:33:35 CST 2009
KDE 4.2.0 is released -- congratulations to the KDE development team for such
an amazing job on this beautiful and highly user-friendly desktop environment!
Thanks also to Eric Hameleers, who did a ton of work getting KDE 4.2.0 ready
for Slackware. Once again (for now), these packages are compatible with
Slackware 12.2. Enjoy! :-)

Hopefully Slackware 13 will integrate KDE4 and I will be able to enjoy the new features and eye candy.

Alan Kay on modern programming languages

2009-01-23T17:41:00.001-05:00

Most software today is very much like an Egyptian pyramid with millions of bricks piled on top of each other, with no structural integrity, but just done by brute force and thousands of slaves.

Read the rest in A Conversation with Alan Kay

Tuckey Rewrite

2008-10-01T09:27:00.002-04:00

Note to self, Tomcat mailing list recommends a Url rewrite filter for a servlet container called Tuckey UrlRewrite. It functions similarly to the popular apache mod_rewrite. I speculate it may be helpful in a RESTful application to map requests to JSPs.

$5 multifactor authentication for OpenID

2008-09-03T12:37:00.002-04:00

Paypal provides a $5 unique password security key which works with Verisign OpenID provider, according to blog "i like ellipses". Get it while the introduction price makes it a better deal than the $30 Verisign's own security key.

Availability of this key is a great news because using a unique password key makes your OpenID identity much more trustworthy.

Changing fan on Thinkpad T41

2008-07-21T19:05:00.005-04:00

After four years in service, the fan of my Thinkpad T41 started to fail. The computer either wouldn't boot with "fan error" message at boot time if the fan doesn't start or the fan would whine causing video card to overheat, freezing X11. Time to change the fan.

I found the fan part number at IBM's website, it was "CPU Fan Long", FRU 13N5341. I searched online shops for the part, finding several listing the fan from anywhere from $30 to $80. At three different cheapest stores, I tried to order the fan and failed, each time the store canceling my order because the fan was out of stock. Then, I found the IBM parts store, 1-800-388-7080. At the IBM store, the fan was $58 and 1-2 day shipping via DHL was $15, an amazing deal. They just changed the part number to 91P9252. I ordered the fan on Friday. On Monday I received a new looking fan, nicely packaged, with thermal gel intact (covered with a removable film) and thermal grease pre-applied in the right place (gel above the video card heat sink and the grease above the CPU).

The hardest part was removing the old fan. I had to find just the right screwdriver (Philips #1 from my toolkit having Ph 0..3) and applying drops of WD-40 to the fan screws. Once the fan was out, putting new fan and closing the laptop was a piece of cake. The laptop booted just fine and noise disappeared. Let's hope the thermal gel and grease adhere correctly, but it looks like IBM still got the chops. Let's hope new Chinese owners (Lenovo) won't screw it up.

NoClassDefFoundError: oracle/gss/util/NLSLocale

2008-07-11T22:35:00.004-04:00

When I upgraded my Oracle JDBC driver to 10.2.0.4, Oracle XSQL Utility started giving me the following exception when using "-encoding UTF-8"

Exception in thread "main" java.lang.NoClassDefFoundError: oracle/gss/util/NLSLocale
at oracle.xml.sql.XSULocale.getJavaCharset(XSULocale.java:122)
at OracleXML.To_XML(OracleXML.java:1092)
at OracleXML.ExecuteGetXML(OracleXML.java:917)
at OracleXML.main(OracleXML.java:185)

Ok, it turns out that in Oracle 10.2.0.4, some classes that used to be in
orai18n.jar got separated into their own jars, which are shipped with Oracle
XDK, not with Oracle JDBC drivers. For example, oracle.gss.util.NLSLocale is now in $XDKHOME/jlib/orai18n-mapping.jar.

LCD text in NetBeans

2008-06-11T14:26:00.003-04:00

Finally figured out how to enable sub-pixel rendering (also known as LCD text) in NetBeans. Just add -J-Dawt.useSystemAAFontSettings=lcd to netbeans_default_options variable in your ~/.netbeans/6.1/etc/netbeans.conf

Bash Random Shuffle

2008-03-18T16:41:00.005-04:00

Here is a bash function which returns a random permutation of the input lines of text.

#****f* shadegrowncode/randomShuffle
# NAME
#   randomShuffle - prints random permutation of lines in standard input
# FUNCTION
#   Prints all or the first N lines of a random permutation of the
#   lines of standard input. The random permutation is obtained using
#   Durstenfeld shuffle algorithm. Performance is O(N) in memory and
#   CPU.  Limit the input to 32768 lines or rewrite using a different
#   random generator.
# SEE ALSO
#   http://en.wikipedia.org/wiki/Knuth_shuffle
# PARAMETERS
#   * 1 - (optional) return only the first N of the random lines of input
# SOURCE
function randomShuffle
{
    typeset -a elements
    typeset length=0
    while read line
    do
        elements[$length]=$line
        length=$(($length + 1))
    done
    typeset firstN=${1:-$length}
    if [ $firstN -gt $length ]
    then
        firstN=$length
    fi
    for ((i=0; $i < $firstN; i++))
    do
        randPos=$(($RANDOM % ($length - $i) ))
        printf "%s\n" "${elements[$randPos]}"
        elements[$randPos]=${elements[$length - $i - 1]}
    done
}
#***

Usage examples:
Print three random users from the password file:

$ cut -d: -f1 /etc/passwd | randomShuffle 3
sync
sysadmin
vcsa

Print a random permutation of digits:

$ echo $(printf "%s\n" 0 1 2 3 4 5 6 7 8 9 | randomShuffle)
4 1 0 6 8 7 2 5 3 9

Volkerding says KDE4 better than MacOS

2008-02-15T20:25:00.002-05:00

Patrick Volkerding (Slackware Project Lead) gives glowing thumbs up to KDE4 and slates it for inclusion into Slackware 14. Slackware is currently at version 12 and releases once a year. At this rate, KDE4 will be in Slackware in 2009. Among other things, Patrick says the following.

The look of the new [KDE] desktop is stunning, and the use of SVG and hardware acceleration gives (IMHO) even something like MacOS a run for its money in terms of appearance and user-friendliness. We look forward with great anticipation to merging KDE4 when it is mature enough (and it's getting there fast), and then watching it just get better and better.

The full quote can be found in Slackware ChangeLog.

Reason to switch to Linux #11

2008-01-10T02:15:00.000-05:00

Windows taskbar clock cannot display seconds since Windows 95.
Why? Because when installed on a 4 Mb machine, Windows 95 was too slow to display seconds. This and other lame excuses are blogged at MSDN. There is a whole shareware industry around Windows to fix this problem. If you want to measure time, use online javascript stop watch or US atomic clock at time.gov

Java sighting on a cup of milk

2007-12-11T19:59:00.000-05:00

Looking at this cup of soy milk in Taipei, I thought at first that somebody stole Java logo. Then, looking closer, I realized it's a genuine ad for Java training. Something you won't see on a milk container in the US...

Form based login from a shell script

2007-11-02T21:35:00.000-04:00

The following code uses only shell scripting and curl to log in to a website protected by a form based authentication and download contents of page "about.jspx". We pay special attention to returning reasonable error messages. These snippets were tested with Tomcat 5.5.

Get user name, password, and the application's URL from the command line,

eval set -- $(getopt "u:p:b:" "$@")
while [ "$1" != "--" ]
do
    case "$1" in
    -u) shift; WEB_UID="$1"; shift; ;;
    -p) shift; WEB_PWD="$1"; shift; ;;
    -b) shift; BASE_URL="${1%\/}"; shift; ;;
    esac
done

Store URLs in variables,

typeset aboutUrl="$BASE_URL/about.jspx"
typeset securityAction="$BASE_URL/j_security_check"
typeset logoffUrl="$BASE_URL/logoff.jsp"

Access the URL and look for session cookie JSESSIONID,

headers="$(curl -s -S -f -L -D - -o /dev/null --url "$aboutUrl" 2>&1)" \
|| error "Error accessing $aboutUrl: $headers"
if [[ "$headers" =~ 'Set-Cookie: JSESSIONID=([^;]*)' ]]
then
    sid="${BASH_REMATCH[1]}"
fi

If JSESSIONID cookie is set, submit user name and password to the login form. On success, the application will redirect us to the original URL. Variable "about" will store the page source or the error message.
```
about="$(curl -s -S -L -f -b "JSESSIONID=$sid" -o - \
-d "j_username=$WEB_UID" \
-d "j_password=$WEB_PWD" \
--url "$securityAction" 2>&1)" \
|| error "Error submitting credentials to $securityAction: $about"
```

Parse the page for some useful information (looking for <sysdate date="20071102">)

if [[ "$about" =~ 'sysdate date=\"([^\"]*)\"' ]]
then
    date="${BASH_REMATCH[1]}"
fi

Finally, hit the logoff URL so that the application may clean up.

curl -s -f -b "JSESSIONID=$sid" --url "$logoffUrl" -o /dev/null

For more information, see cURL and libcurl

Sun NetBeans day

2007-09-25T14:48:00.001-04:00

September 11th was a Sun NetBeans day in Boston. Here's what I learned:

NetBeans keeps improving. NetBeans 6 consolidates six independent Java parsers of version 5 into one. Syntax highlighting and refactoring can now use more semantic information; it is now faster and more powerful and accurate.
Profiler is now improved and built-in into NetBeans. It can be enabled or disabled at runtime using profiling points. More info at Netbeans profiler pages.
The most active site about NetBeans is NetBeans Wiki.
New England has an active Java User Group, which organizes nice talks. See NEJUG.org
A lot of introductory presentation about Java technology inluding RIA and REST is posted by one of the speakers at JavaPassion.com. The speaker himself was speaking way too fast with a Korean accent, but his presentations must be filled with information.

Upgraded to Slackware 12

2007-09-21T20:10:00.000-04:00

Updated my Thinkpad T40 from Slackware 11 to Slackware 12. The 2 hour upgrade went without a hitch. I was pleasantly surprised to find out that Paul compiled KDE KMail with S/MIME support. Great, I don't need to roll my own packages any more.

Fixed S/MIME interoperability between KDE KMail and Mozilla Thunderbird

2007-05-04T13:42:00.000-04:00

Nelson Bolyard fixed interoperability problem between Thunderbird and KMail (or rather gpgsm). There was a bug in how gpgsm encoded cipher preferences, which Thunderbird could not understand and was falling back to RC2/40 cipher. In gpgsm, RC2/40 was not implemented for patently political
reasons. Thunderbird crypto library was made more lenient in what it accepted. So, now, TB would correctly responds to KMail using 3DES instead of RC/40. More details are in Bugzilla and Usenet.

Still causing minor problems are the following bugs. Vote for or fix them!

Does Google know math?

2007-04-26T16:07:00.000-04:00

According to Google Calculator, 0^0=1. What else would you expect from a Stanford dropout son of a professor of mathematics... ;) At least Google has no opinion on 0/0

Encrypt your email

2007-04-24T17:35:00.000-04:00

Everyone should be able to encrypt their email and assure others of their identity. Get your free Thawte email certificate and join Thawte web of trust. Do it even if your company gives you an email certificate. If you are in Central Massachusetts, Boston, or Manhattan, I may be able to assure your identity and help you join the web of trust.

Find all tables missing a primary key in an Oracle database

2007-04-20T09:51:00.000-04:00

Typically all tables in a database have primary keys. For some reason in ours some primary keys have disappeared. It must've been a botched export re-import operation. Anyway, here is an Oracle data dictionary query returning all tables in the current schema without a primary key.

select table_name 
from user_tables 
where table_name not in
(
  select distinct table_name 
  from user_constraints 
  where constraint_type='P'
)
order by table_name;

Windows for Professional Users

2007-04-17T21:51:00.000-04:00

Sam Gentile, a windows programmer wishes for a Windows Edition for Power Users. He's so good - he has been using Windows in Administrator mode for 25 years and is not going to change. My guess is that if he browsed with Internet Explorer in Administrator mode, he's been rooted so deeply, his antivirus does not know it. He also looked at Unix in the 80s, so he does not want to hear about Linux. Poor chap, he does not have much choice between grandmommy's Vista and geek's Linux.

Account Lockout Realm in Tomcat

2007-03-27T23:33:00.000-04:00

(Quick links: SourceForge, CVS)

I am describing here a way to implement Account Lockout. We want to lock out those users who within a short period of time made multiple authentication attempts and failed. The Account Lockout feature is commonly used in Tomcat hardening and requested in security audit.

I derive my AccountLockoutDatasourceRealm from Tomcat's DataSourceRealm to include account lockout logic and return the reason for authentication failure. Finally, I modify login failure JSP to show a message specifying if the account is locked or password is merely incorrect.

To keep track of the password failures, I add two columns to the User table: LoginFailures number and LastLoginFailure date/time.

alter table User add (
 LoginFailures number default 0,
 LastLoginFailure date
);

comment on column User.LoginFailures is
  'Number of consecutive login failures for the purposes of implementing Account Lockout';
comment on column User.LastLoginFailure is
  'Date/time of the last login failure for the purposes of implementing Account Lockout';

The new AccountLockoutDatasourceRealm provides getters and setters for properties configuring account lockout, overrides authenticate() method using logic described below, and implements setExtendedStatus method of ExtendedStatusSetter interface.

New Realm Properties

failedAttemptsBeforeLockout

The maximum number of login failure attempts before the accounts is locked out or zero to disable lockout

lockoutDuration

The duration of lockout in minutes or zero for permanent lockout

getLoginStatsForUserStatement

SQL statement with one JDBC parameter (?) returning three values: the number of login failures, the date/time of the last login failure, and the current database date/time for the user whose id is specified by the parameter. For example,

 SELECT LoginFailures, LastLoginFailure, SYSDATE FROM User WHERE Id = ?

resetAccountLockoutForUserStatement

SQL update statement with one JDBC parameter (?) resetting the number of login failures for the user whose id is specified by the parameter. For example,

 UPDATE User SET LoginFailures = 0 WHERE Id = ?

recordFailureForUserStatement

SQL update statement with one JDBC parameter (?) incrementing the number of login failures and updating the date/time of the last login for the user whose id is specified by the parameter. For example,

 UPDATE User SET LoginFailures = NVL(LoginFailures, 0) + 1, LastLoginFailure = SYSDATE where Id = ?

Account Lockout Logic

Lockout feature is enabled if failedAttemptsBeforeLockout is greater than 0.
If lockout is enabled, read login stats (LoginFailures, LastLoginFailure, and DatabaseDate) from the database.
Lockout is considered expired, when
1. lockout feature is not enabled, or
2. lockout is not permanent and LastLoginFailure is more than lockoutDuration minutes before DatabaseDate.
Account is considered locked, when the lockout is enabled and the LoginFailures is equal to or greater then failedAttemptsBeforeLockout.
If lockout is enabled, account IS NOT locked, and lockout has expired, reset the lockout and reread the login stats.
If lockout is enabled, account IS locked, lockout has expired, and the lockout is not permanent, reset the lockout and reread the login stats.
If lockout is enabled and account IS locked, fail the login without checking the password and return.
Otherwise (if lockout is not enabled or account is not locked), user check the password against the database.
If password is not correct, increment LoginFailures and set LastLoginFailure to DatabaseDate in the database.
Reread login stats. If account lockout enabled and account is locked according to the rules above, fail the login due to account lockout and return.
If password is correct, reset the lockout and return login success.

Returning Login Failure Reason

We use code described in the post returning reason from a Tomcat Realm. In setExtendedStatus method we check if account is locked and if it is, we pass the message using a request attribute as follows.

if (isLockoutEnabled() && isAccountLocked(failureStats))
{
  setMessage(request, "Account locked");
}

protected void setMessage(HttpServletRequest request, String message)
{
  containerLog.debug("Setting extended status message to " + message);
  request.setAttribute(ExtendedStatusSetter.LOGIN_FAILURE_MESSAGE_ATTR, message);
}

Displaying Login Failure Reason

Tomcat form authentication configures an error JSP, which is displayed when login fails. To display extended login failure reason, we check for the existence of our request attribute with the following code:

   <p class="error">Access Denied:
    <c:choose>
      <c:when test="${!(empty requestScope['com.ofc.tomcat.LOGIN_FAILURE_MESSAGE'])}">
        <c:out value="${requestScope['com.ofc.tomcat.LOGIN_FAILURE_MESSAGE']}"/>
      </c:when>
      <c:otherwise>Invalid username and/or password</c:otherwise>
    </c:choose>
  </p>

To build the code, compile AccountLockoutDatasourceRealm below and ExtendedStatusFormAuthenticator and ExtendedStatusSetter from dzone snippet. Package the code and the mbeans-descriptor.xml into a jar, place the jar into Tomcat's server/lib, and restart tomcat.

Configuration

To configure your application, add the following lines to your context.xml

  <!-- Override Pragma:no-cache to work around the IE bug when app is served via SSL.
 See http://www.mail-archive.com/tomcat-user%40jakarta.apache.org/msg151294.html
-->
<Valve className="com.ofc.tomcat.ExtendedStatusFormAuthenticator"
      disableProxyCaching="false" />
<Realm className="com.ofc.tomcat.AccountLockoutDatasourceRealm"
   dataSourceName="realm.datasource"
   userTable="User"
   userRoleTable="UserRole"
   userNameCol="ID"
   userCredCol="PASSWORD"
   roleNameCol="ROLEID"
   failedAttemptsBeforeLockout="3"
   lockoutDuration="30"
   getLoginStatsForUserStatement=
   "SELECT LoginFailures, LastLoginFailure, SYSDATE FROM User where Id = ?"
   resetAccountLockoutForUserStatement=
   "UPDATE User SET LoginFailures = 0 WHERE Id = ?"
   recordFailureForUserStatement=
   "UPDATE User SET LoginFailures = NVL(LoginFailures, 0) + 1, LastLoginFailure = SYSDATE where Id = ?"
   />

Documentation and Source

I published source code in sourceforge lockout-realm project. Instructions are forthcoming.

Credits

This work was sponsored by Open Finance - a leading enabler of data consolidation for the financial services industry and Wealth Information Exchange - A Consolidated View of Wealth

Shell script to locate a Java class

2007-03-23T12:50:00.000-04:00

The following shell script will locate a Java class in CLASSPATH and additional jars, zip files, or directories specified on the command line. For example,

$ CLASSPATH= findClass DataSourceRealm /usr/local/tomcat/server/lib/*.jar
---- Searching for DataSourceRealm
---- Searching in /usr/local/tomcat/server/lib/catalina-ant.jar
---- Searching in /usr/local/tomcat/server/lib/catalina.jar
org/apache/catalina/realm/DataSourceRealm.class
---- Searching in /usr/local/tomcat/server/lib/commons-beanutils.jar
...
**** DataSourceRealm found in /usr/local/tomcat/server/lib/catalina.jar

Source

#!/bin/bash
#****h* bin/findClass
# NAME
#   findClass - searches for a Java class in directories, jars, zip files, and CLASSPATH
# ARGUMENTS
#   * 1 - Java class name or substring
#   * ... - additional directories, jars, zip files
# RETURN VALUE
#   * exit code 0, if the class is found
#   * exit code 1, if the class is not found
# SOURCE
if [ $# -eq 0 ]; then
    echo "Usage: findClass <CLASSNAME> [ FILE ... ]"
    exit
fi
class=`echo $1| tr . /`
shift
allDirs="$(echo "$@" $CLASSPATH| perl -F: -ane 'print join(" ",@F);')"
printf -- "---- Searching for %s\n" "$class" >&2
foundIn=()
for dir in $allDirs; do
    printf -- "---- Searching in %s\n" "$dir" >&2
    case $dir in
        *.zip)
            unzip -v "$dir" | grep $class && foundIn[${#foundIn}]="$dir"
            ;;
        *.jar)
            jar -tf "$dir" | grep $class && foundIn[${#foundIn}]="$dir"
            ;;
        *)
            find "$dir" -print | grep $class && foundIn[${#foundIn}]="$dir"
            ;;
    esac
done
if [ ${#foundIn} -eq 0 ]; then
    printf -- "**** %s not found\n" "$class" >&2
    exit 1
else
    printf -- "**** %s found in %s\n" "$class" "${foundIn[*]}" >&2
fi
#****

I am glad I am not using Windows

2007-03-22T11:31:00.000-04:00

Just read a scary and fascinating story about Gozi Windows trojan, which sees through SSL and steals bank passwords, security questions, and the newfangled security pictures. I am so glad my desktop machine runs Linux, in which malware will not be able to install itself as a layer between the browser and the SSL code. More details.

Returning login failure reason in a Tomcat Realm

2007-03-22T09:46:00.000-04:00

When Tomcat Realm authenticates a user via its Realm, there is no way for the Realm to tell the application the exact reason of a failure. The realm either succeeds and returns a Principal object or fails and returns null. So, when I needed to implement account lockout after several unsuccessful logins, I couldn't show the user the difference between a wrong password and account being locked out.

Digging deeper into Tomcat code, I found that the Realm is being invoked from FormAuthenticator Valve. It is possible to extend the Valve so that in case of authentication failure, the Valve adds failure reason as an HttpServletRequest attribute. More details in ExtendedStatusFormAuthenticator code.