Category: Technology

SSO In Apache HTTPD — ADFS

Active Directory Federated Services (ADFS) can be used by servers inside or outside of the company network. This makes it an especially attractive authentication option for third party companies as no B2B connectivity is required to just authenticate the user base. Many third-party vendors are starting to support ADFS authentication in their out-of-the-box solution (in which case they should be able to provide config documentation), but anything hosted on Apache HTTPD can be configured using these directions:

This configuration uses the https://github.com/UNINETT/mod_auth_mellon module — I’ve built this from the repo. Once mod_auth_mellon is installed, create a directory for the configuration

mkdir /etc/httpd/mellon

Then cd into the directory and run the config script:

/usr/libexec/mod_auth_mellon/mellon_create_metadata.sh urn:samplesite:site.example.com "https://site.example.com/auth/endpoint/"

 

You will now have three files in the config directory – an XML file along with a cert/key pair. You’ll also need the FederationMetadata.xml from the IT group – it should be

Now configure the module – e.g. a file /etc/httpd/conf.d/20-mellon.conf – with the following:

MellonCacheSize 100
MellonLockFile /var/run/mod_auth_mellon.lock
MellonPostTTL 900
MellonPostSize 1073741824
MellonPostCount 100
MellonPostDirectory "/var/cache/mod_auth_mellon_postdata"

To authenticate users through the ADFS directory, add the following to your site config

MellonEnable "auth"
Require valid-user
AuthType "Mellon"
MellonVariable "cookie" 
MellonSPPrivateKeyFile /etc/httpd/mellon/urn_samplesite_site.example.com.key
MellonSPCertFile /etc/httpd/mellon/urn_samplesite_site.example.com.cert
MellonSPMetadataFile /etc/httpd/mellon/urn_samplesite_site.example.com.xml
MellonIdPMetadataFile /etc/httpd/mellon/FederationMetadata.xml
MellonMergeEnvVars On ":"
MellonEndpointPath /auth/endpoint

 

Provide the XML file and certificate to the IT team that manages ADFS to configure the relying party trust.

Fortify on Demand Remediation: Cookie Security: Cookie not Sent Over SSL

This is another one that might be a false positive or might be legit. If you look at the documentation for PHP’s setcookie function, you will see the sixth parameter sets a restriction so cookies are only sent over secure connections. If you are not setting this restriction, the vulnerability is legitimate and you should sort that. But … if you followed PHP’s documentation and passed 1 to the parameter? FoD is falsely reporting that the parameter is not set to true.

In this case, the solution is easy enough. Change your perfectly valid 1

to say true

And voila, the vulnerability has been remediated.

Porkbun DDNS API

I’ve been working on a script that updates our host names in Porkbun, but the script had a problem with the example.com type A records. Updating host.example.com worked fine, but example.com became example.com.example.com

Now, in a Bind zone, you just fully qualify the record by post-pending the implied root dot (i.e. instead of “example.com”, you use “example.com.”, but Porkbun didn’t understand a fully qualified record. You cannot say the name is null (or “”). You cannot say the name is “example.com” or “example.com.”

In what I hope is my final iteration of the script, I now identify cases where the name matches the zone and don’t include the name parameter in the JSON data. Otherwise I include the ‘name’ as the short hostname (i.e. the fully qualified hostname minus the zone name). This appears to be working properly, so (fingers crossed, knock on wood, and all that) our ‘stuff’ won’t go offline next time our IP address changes.

Idea – AR in Store App

Use augmented reality in company app — customers use the apps as they shop to find discounts on in-store products and retailers can track where shoppers are (how long individuals stop at which section, what path they take). Customers could use the app to search the store, navigate around, and maybe even  find Easter eggs / bonus deals exclusive to the app.

Scraping Google Calendar Data, take 2

I had written a script that uses the Google Calendar API to pull records from the Township’s calendar. Unfortunately, the pickle / token / whatever has started expiring every week. Which means manual intervention is required for my automated process to run. Which made me wonder … for a private calendar, it makes sense to use the API. I need to authenticate in order to read my private appointments. I can get the token to last for a year, but then I’ve got to go through whatever to be a real / approved application. Which is a lot of effort for something that I’m using to read my own data. Which made me wonder why I need to authenticate to read events on a public calendar!?

Turns out I don’t. I just need to use the iCal feed for the calendar. Using requests to pull data from a URL and then parsing out the iCal data is simple enough. So now I have a script that pulls the iCal file to populate my Exchange calendar. Since it’s unauthenticated, I shouldn’t have to do anything to get it working again next week 🙂

Facebook Whistle-Blower

What I get from the Facebook whistle-blower’s interview and testimony is that social media has the same problem I see with commercialized news. To make money and secure “customers”, news agencies have basically taken a side. And they tailor their news toward engaging their target demo — get people outraged, reinforce how right people are in their opinion. It’s the adrenaline junkie approach to news.

And social media does the exact same thing. The platform isn’t there to make you a more informed citizen, give you access to awesome new sewing patterns or soap recipes, or make sure you know about the PTO’s next meeting. The platform exists to suck up info about you and deliver ads to you based on that data. Thing about AI is that it performs better as it gets more data. Someone who logs in once a week and checks out a few things is a “bad customer” much the same way that someone who pays off their credit card bill each month is a bad customer. Not doing anything wrong, but losing money for the company that provides the service. They want users who are checking the platform every hour. They want people who they know will come back tomorrow, people who will share things with other people so the algorithms can build out connections. The way to achieve those goals is to get people fired up about what they’re reading. Commercialized news being spread via social media algorithms is a compounded problem.

It’s Not A DNS Problem

I used to work at a company where everything was called an Exchange problem — not that Exchange 2000 didn’t have it’s share of problems (store.exe silent exit failures? Yes, that’s absolutely an Exchange problem) … but the majority of the time, the site had lost their connectivity back to the corporate data center. Or, when I’d see the network guys sprinting down the hallway as the first calls started to come in … the corporate data center had some sort of meltdown.

I’m reminded of this as I see people calling the Facebook outage a “DNS problem”. Facebook’s networks dropped out of BGP routing. That means there’s no route to their DNS server, so you get a resolution failure. It doesn’t mean there’s a DNS problem. Any more than it means there’s an IP or power problem — I’m sure it’s all working as designed and either someone screwed up a config change or someone didn’t screw up and was trying to drop them off the Internet.

Saw much the same thing back when Egypt dropped off of the Internet back in 2011 — their routes were withdrawn from the routing tables. That’s an initiated process — maybe accidental, but it’s not the same as a bunch of devices losing power or a huge fiber cut.

And, when there’s no route you can use to get there … if DNS, web servers, databases, etc are working or not becomes moot.

Did you know … You can (kinda) pin Microsoft Teams messages?

You can pin messages … but I wouldn’t say pinning a message has the result I’d expect. First, how to do it. On any channel message, you can click the ellipsis to access a menu. Select “Pin”.

You’ll get a warning that the message will be pinned for everyone … sounds good, right? If you want everyone to read the rules of the Teams space or to read the “NDA Applies To These Discussions” notice, you want the message pinned for everyone. Click “Pin” to continue.

Aaaand … everyone sees the message highlighted (and a little pin icon). The message is not, however, pinned to the bottom of the conversation list where everyone is sure to notice it. It is not displayed at the top of the current page where everyone is sure to notice it.

But there is a way to quickly view pinned messages in a channel. In the upper right-hand corner of the channel’s conversation list, find the little info icon. It’s the one you’ve never noticed because it didn’t do anything too useful … right next to the ‘meet’ button. Click it.

Scroll past the ‘About’ and ‘Members’ section of the info, and you will see any pinned posts.

 

Diffing two strings

Yes, I know md5sum has a “-c” option for checking the checksum in a file … but, if I was going to screw with a file, I’d have the good sense to edit the checksum file in the archive!

 

#!/bin/bash
#STRFILE=dead.letter
#STRCHECKMD5=5f3748d9c653b78c9ee7559acd423652
#STRMD5=`md5sum $STRFILE`

STRFILE=$1
STRCHECKMD5=$2

STRMD5=`md5sum $STRFILE`

diff -s <( printf '%s\n' "$STRCHECKMD5 $STRFILE" ) <( printf '%s\n' "$STRMD5" )

It’ll either output the file hash and the hash to match (a problem) or indicate the files are identical (a good thing)