How to disable SSL v3 for sun os 5.6 (OAS 4.0.8), I am facing POODLE vulnerability issue? - poodle-attack

My Website is hosted on Sun OS 5.06 (OAS 4.0.8) and using web server : Oracle_Web_Listener/4.0.8. Website is configured to use https for secure pages and it was working fine from last 10 years but suddenly i am getting complaints from my customers that they can not browse site on chrome version 40 and above and firefox 34 and above.
I searched for this issue and found that there is POODLE attack which may causing this issue. now the only solution i can see is to disable SSL v3 on server.
Can any help me out with the process or an idea, How to disable SSL V3 on this Olde server? Its sun microsystem server.

Related

Problems with Umbraco version 8.4.0 on Windows 2016 Standard Server

I'm trying to install an Umbraco version 8.4.0 on Windows 2016 Standard Server.
The dev machine is Windows 10 Pro on which the installation works fine.
But when I deploy to the Windows 2016 Standard Server the pages loaded do not format well - the footer, header and other compositions setup in the back-end do render.
There are no 500 server errors or Javascript errors in console. I'm clueless about whats going wrong?
Has anyone installed Umbraco v8 on windows 2016 server, are there any special considerations for installing it?
Please could someone help me, I'm really stuck on it and not sure how to go and resolve it.
We gave "Network Service" permissions to modify the website folders. That fixed it, not sure though why because Umbraco was already running without the "Network services" in the permissions. It was only the new release of the website that got affected, the previous release had no issues without Network Services having these permissions.
If anyone get stuck with something like this should check the permissions for the website folders.

ASP.net MVC 5 TLS 1.2 (chrome warning about TLS 1.0 deprecated)

after deploying an asp.net mvc5 website to a shared hosting (plesk panel) with let's encrypt ssl I see this warning in the chrome console:
The connection used to load resources from https://example.com used TLS 1.0 or TLS 1.1, which are deprecated and will be disabled in the future. Once disabled, users will be prevented from loading these resources. The server should enable TLS 1.2 or later. See https://www.chromestatus.com/feature/5654791610957824 for more information.
is this something that can be fixed in the code of the application, or is it server configuration ?
Copied from comment with some additional info.
The message from Chrome is clear enough,
Chrome attempts to use TLS 1.2 for security (TLS 1.0 and 1.1 are not considered secure).
The server side does not support TLS 1.2 handshakes as Chrome detects.
Therefore, only the server administrators (or service providers ISP) can diagnose and fix such issues.

Site rendering broken on iOS and Mac OSX after moving to JDK 10 and JSF 2.3 with WildFly

Good day
Issue below is solved on WildFly 13 by disabling HTTP/2 (while still keeping TLS for HTTPS).
Even the non effected browser and system combos (all the non Apple stuff) seem to load much faster now.
Follow instructions from this post on how to disable HTTP/2:
https://developer.jboss.org/message/984394?et=watches.email.thread#984394
From the ./jboss-cli.sh cli just run:
/subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=enable-http2,value=false)
And reload / restart the server. All devices render perfectly and fast.
I am leaving the below if somebody else runs into a similar error.
I updated my code and POM file to use the Java EE 8 dependencies for WildFly 13 based on the WildFly 13 BOM POM and the #Balusc JSF 2.3 Java EE 8 kickoff sample application.
So I set it to use:
JSF 2.3.5.Final
OmniFaces 3.1
PrimeFaces 6.2.7
On desktop (all operating systems with all of the latest browsers) the site works 100% and the war is deployed in half the time.
However the site fails to render correctly on my iPhone. I tried all browsers installable from the app store, and the one that looks the nearest to correct is Firefox.
However even with Firefox I can't get pass the login screen.
On Android and all non Apple based products the site works without any error logs.
Is anybody aware of issues rendering JSF 2.3 on Apple based products?
Any pointers on what to look for, add or change will be most appreciated.
See below for log file info:
The initial error only triggered from iOS / Mac OSX is an UNDERTOW error with OmniFaces info (we are using TLS for HTTPS, but before moving all to JSF 2.3 everything worked 100% with zero errors or warnings in logs)
2018-07-30 09:09:18,741 ERROR [io.undertow] (default task-3078) UT005085: Connection io.undertow.server.protocol.http2.Http2ServerConnection#7e55834 for exchange HttpServerExchange{ GET /edsnext/javax.faces.resource/omnifaces.js.xhtml request {accept=[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8], accept-language=[en-us], :authority=[edsnext.megchemsa.com:62543], accept-encoding=[gzip, deflate], :path=[/edsnext/javax.faces.resource/omnifaces.js.xhtml?ln=omnifaces&v=3.1], user-agent=[Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1], :scheme=[https], cookie=[JSESSIONID=U5X9u-A83bccAnpA1XUnEFzmngqI9iDJwuIiU_Qo], :method=[GET], Referer=[https://edsnext.megchemsa.com:62543/edsnext/], upgrade-insecure-requests=[1], Host=[edsnext.megchemsa.com:62543]} response {Expires=[Mon, 30 Jul 2018 09:57:18 GMT], ETag=[W/"5933-1532705069245"], Last-Modified=[Fri, 27 Jul 2018 15:24:29 GMT], Set-Cookie=[JSESSIONID=U5X9u-A83bccAnpA1XUnEFzmngqI9iDJwuIiU_Qo.edsnext; path=/edsnext], Content-Type=[application/javascript], Date=[Mon, 30 Jul 2018 07:09:18 GMT], :status=[200]}} was not closed cleanly, forcibly closing connection
Then the following PrimeFaces resource not found warnings (and login page is rendered incorrectly on iOS)
2018-07-30 09:09:21,056 WARNING [javax.enterprise.resource.webcontainer.jsf.application] (default task-3091) JSF1064: Unable to find or serve resource, fa/fontawesome-webfont.eot, from library, primefaces.
2018-07-30 09:09:21,056 WARNING [javax.enterprise.resource.webcontainer.jsf.application] (default task-3084) JSF1064: Unable to find or serve resource, fonts/lato-regular-webfont.svg, from library, primefaces-omega.
2018-07-30 09:09:21,056 WARNING [javax.enterprise.resource.webcontainer.jsf.application] (default task-3082) JSF1064: Unable to find or serve resource, fa/fontawesome-webfont.ttf, from library, primefaces.
2018-07-30 09:09:21,056 WARNING [javax.enterprise.resource.webcontainer.jsf.application] (default task-3100) JSF1064: Unable to find or serve resource, fa/fontawesome-webfont.svg, from library, primefaces.
2018-07-30 09:09:21,056 WARNING [javax.enterprise.resource.webcontainer.jsf.application] (default task-3103) JSF1064: Unable to find or serve resource, fonts/lato-bold-webfont.svg, from library, primefaces-omega.
2018-07-30 09:09:21,056 WARNING [javax.enterprise.resource.webcontainer.jsf.application] (default task-3091) : java.nio.channels.ClosedChannelException
EDIT: Added log file info pointing to UNDERTOW errors followed by lots of PrimeFaces missing resources.
EDIT 2:
Ok, I tested this with:
Server side:
CentOS 7.5 all updated
Oracle JDK 10.1
WildFly 13.0.0.Final
JSF 2.3.5.SP1
PrimeFaces 6.2.7
OmniFaces 3.1
The following setups renders the site perfectly with zero errors or warning at debug level:
CentOS GNOME 7.5 Chromium
CentOS GNOME 7.5 Firefox Developer Edition
Windows 10 Chrome
Windows 10 Firefox Developer Edition
Android Studio Nexus 5 AVD APK 28 Chrome
Samsung Galaxy S7 Chrome
Samsung Galaxy S7 Firefox
All browsers installable from the Apple app store including Safari fails to render the site. All have the UNDERTOW error.
Tested with Mac OSX - latest updated version - also fails with the UNDERTOW error.
I logged a bug report with Apple. Problem is though that a substantial amount of users are effected by this due to having to access the Web app via their iPhone or iPad.
What else can I do to expedite this?
To resolve this error disable HTTP/2 on WildFly 13 with:
Follow instructions from this post on how to disable HTTP/2:
https://developer.jboss.org/message/984394?et=watches.email.thread#984394
From the ./jboss-cli.sh cli just run:
/subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=enable-http2,value=false)
Restart / reload the server and all is well.

How to fix access forbidden error in Windows XP IIS?

ASP .NET MVC2 application is installed in Windows XP , IIS 5.1 .
After opening several pages or pressing F5 file requests like
GET http://1.1.1.1:81/apps/Scripts/jquery.form.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: http://1.1.1.1:81/app/Grid?_entity=Yksus6
return error
HTTP 403.9 - Access Forbidden: Too many users are connected
Internet Information Services
Browser (IE9 ) should limit max number of concurrent connections to 3 . So Windows XP 10 connection limit should not occur here.
I tried in localhost also and same 403.9 exception occurs. Localhost should not have XP 10 connection limit.
Ideas to resolve:
Can disabling http 1.1 in iis fixes this so that HTTP 1.0 is used:
I looked in IIS manager properties but havent found place where to disable 1.1
I Googled for "disable http 1.1 in iis" but havent found any information.
So I dont know how to disable http 1.1
XP supports also IIS 7 developemnt server. Should I try to install this ?
How to use asp .net mvc application in XP ?

IIS serve https GET, but fails POST

I'm setting up IIS 10 on Windows Server 2019. After I installed Let's Encrypt cert via win acme some url fails.
I've setup ApploccationPoolIdentity method for my web site. Here is my setup
So far I have most of paths are working. Fails:
account/login and account/logoff
some fonts (.woff2, woff, .ttf) see image below
All above fails with 403 Status code. But they working fine if
open localhost on my VPS
unbind hhtps (:443, ssl) and reach them using http
UPD
I found that ALL POST request fails (all forms), while all GET succeeded. Not Sure why fonts fails though.
UPD 2
POST methods work on postman and IE, but fails from Google Chrome.
Version 89.0.4389.114 (Official Build) (64-bit)
UPD 3
2021-04-05 05:44:18 10.129.0.3 POST /profile/edit - 443 user#e.mail xxx.xxx.xxx.xxx Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/89.0.4389.114+Safari/537.36 https://mymydomain.ru/profile/edit 403 0 0 93
UPD 4
Mime Types and Bindings are also attached
UPD 5
I found that everything works fine if I do request to subdomain, i.e. beta.mydomain.ru rather than mydomain.ru including http:// and https://.
FYI i've issued and tested with two certificates
*.mydomain.ru, mydomain.ru
mydomain.ru (without wildcard)
I after spending lots of hours I gave up fighting this issue. Setup new environment with new certificate and everything is working fine.
Very likely could made a mistake when issues cert first time.

Resources