Chapter 14. Securing & Hardening OpenIDM

1. Extract the certificate that is installed with OpenIDM.

   $ openssl s_client -showcerts -connect localhost:8443 </dev/null

   This command outputs the entire certificate to the terminal.

2. Using any text editor, create a file named server.crt. Copy the portion of the certificate from ­­­­­BEGIN CERTIFICATE­­­­­ to ­­­­­END CERTIFICATE­­­­­ and paste it into the server.crt file. Your server.crt file should now contain something like the following:

   $ more server.crt
   -----BEGIN CERTIFICATE-----
   MIIB8zCCAVygAwIBAgIETkvDjjANBgkqhkiG9w0BAQUFADA+MSgwJgYDVQQKEx9P
   cGVuSURNIFNlbGYtU2lnbmVkIENlcnRpZmljYXRlMRIwEAYDVQQDEwlsb2NhbGhv
   c3QwHhcNMTEwODE3MTMzNTEwWhcNMjEwODE3MTMzNTEwWjA+MSgwJgYDVQQKEx9P
   cGVuSURNIFNlbGYtU2lnbmVkIENlcnRpZmljYXRlMRIwEAYDVQQDEwlsb2NhbGhv
   c3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKwMkyvHS5yHAnI7+tXUIbfI
   nQfhcTChpWNPTHc/cli/+Ta1InTpN8vRScPoBG0BjCaIKnVVl2zZ5ya74UKgwAVe
   oJQ0xDZvIyeC9PlvGoqsdtH/Ihi+T+zzZ14oVxn74qWoxZcvkG6rWEOd42QzpVhg
   wMBzX98slxkOZhG9IdRxAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEASo4qMI0axEKZ
   m0jU4yJejLBHydWoZVZ8fKcHVlD/rTirtVgWsVgvdr3yUr0Idk1rH1nEF47Tzn+V
   UCq7qJZ75HnIIeVrZqmfTx8169paAKAaNF/KRhTE6ZII8+awst02L86shSSWqWz3
   s5xPB2YTaZHWWdzrPVv90gL8JL/N7/Q=
   -----END CERTIFICATE-----
                

3. Generate a private, self-signed key as follows:

   1. Generate an encrypted 1024-bit RSA key, and save it to a file named localhost.key. Enter a pass phrase for the key as requested.

      $ openssl genrsa -des3 -out localhost.key 1024
      Generating RSA private key, 1024 bit long modulus
      .........++++++
      .........................++++++
      e is 65537 (0x10001)
      Enter pass phrase for localhost.key:
      Verifying - Enter pass phrase for localhost.key:

   2. Generate a certificate request using the key you created in the previous step, and save it to a file named localhost.csr. Enter any required information to create the DN for the request.

      $ openssl req -new -key localhost.key -out localhost.csr

      This step creates a file, localhost.csr, that contains the details of the certificate request.

   3. Sign the certificate with the key you created in the previous step, and generate a certificate that is valid for one year in a file named localhost.crt. The x509 subcommand enables you to retrieve the information that is stored in the SSL certificate. Output will depend on the details that you entered in the certificate request.

      $ openssl x509 -req -days 365 -in localhost.csr -signkey localhost.key -out localhost.crt
      Signature ok
      subject=/C=FR/ST=Il-DE-FRANCE/L=Paris/O=example.com
      Getting Private key
      Enter pass phrase for localhost.key:
                           

      The contents of localhost.crt should now be something like this:

      $ more localhost.crt
      -----BEGIN CERTIFICATE-----
      MIIB/zCCAWgCCQD6VdiF6rX2czANBgkqhkiG9w0BAQUFADBEMQswCQYDVQQGEwJa
      QTELMAkGA1UECBMCV0MxEjAQBgNVBAcTCUNhcGUgVG93bjEUMBIGA1UEChMLZXhh
      bXBsZS5jb20wHhcNMTMwMTI1MTIzNzIyWhcNMTQwMTI1MTIzNzIyWjBEMQswCQYD
      VQQGEwJaQTELMAkGA1UECBMCV0MxEjAQBgNVBAcTCUNhcGUgVG93bjEUMBIGA1UE
      ChMLZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAONLO82s
      wKA0tWkbR66DajwQKNO9QlYwZvcK4X7MFOcwex+8j2vvG5HCB0BW2Gm72mFTWei8
      gVgQDP1oe/yTWDZRaiJ8rGWdvpgH1Cmxcd3N1AhhRya1I2j5wxrc9ZsyyTYCg2fd
      pFfULrUXSd9QlB2qQZz7kb4ksT/mSwPiGqvFAgMBAAEwDQYJKoZIhvcNAQEFBQAD
      gYEA3WrP8NKjXwQzE0vabYmdUhPHt3PF8EMMwVJ+h8G9Dwmtll0P/kLybXdHF1P/
      SvN8ofdaEKi4DrLvBifkJvHdTm9DgZJo+bROM6LM9kac6CxNvwj9m/4g6mhnjxEV
      63WQPzvAeriO51JC0ysMVe5vf+lO0t+J8W6SfPTKwoXDQhY=
      -----END CERTIFICATE-----
                           

4. Combine the contents of server.crt and localhost.crt to create a Privacy Enhanced Mail Certificate (.pem) file named CA.pem.

   $ cat server.crt localhost.crt > CA.pem

   The contents of CA.pem should be something like the following (a concatenation of server.crt and localhost.crt).

   $ more CA.pem
   -----BEGIN CERTIFICATE-----
   MIIB8zCCAVygAwIBAgIETkvDjjANBgkqhkiG9w0BAQUFADA+MSgwJgYDVQQKEx9P
   cGVuSURNIFNlbGYtU2lnbmVkIENlcnRpZmljYXRlMRIwEAYDVQQDEwlsb2NhbGhv
   c3QwHhcNMTEwODE3MTMzNTEwWhcNMjEwODE3MTMzNTEwWjA+MSgwJgYDVQQKEx9P
   cGVuSURNIFNlbGYtU2lnbmVkIENlcnRpZmljYXRlMRIwEAYDVQQDEwlsb2NhbGhv
   c3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKwMkyvHS5yHAnI7+tXUIbfI
   nQfhcTChpWNPTHc/cli/+Ta1InTpN8vRScPoBG0BjCaIKnVVl2zZ5ya74UKgwAVe
   oJQ0xDZvIyeC9PlvGoqsdtH/Ihi+T+zzZ14oVxn74qWoxZcvkG6rWEOd42QzpVhg
   wMBzX98slxkOZhG9IdRxAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEASo4qMI0axEKZ
   m0jU4yJejLBHydWoZVZ8fKcHVlD/rTirtVgWsVgvdr3yUr0Idk1rH1nEF47Tzn+V
   UCq7qJZ75HnIIeVrZqmfTx8169paAKAaNF/KRhTE6ZII8+awst02L86shSSWqWz3
   s5xPB2YTaZHWWdzrPVv90gL8JL/N7/Q=
   -----END CERTIFICATE-----
   -----BEGIN CERTIFICATE-----
   MIIB/zCCAWgCCQD6VdiF6rX2czANBgkqhkiG9w0BAQUFADBEMQswCQYDVQQGEwJa
   QTELMAkGA1UECBMCV0MxEjAQBgNVBAcTCUNhcGUgVG93bjEUMBIGA1UEChMLZXhh
   bXBsZS5jb20wHhcNMTMwMTI1MTIzNzIyWhcNMTQwMTI1MTIzNzIyWjBEMQswCQYD
   VQQGEwJaQTELMAkGA1UECBMCV0MxEjAQBgNVBAcTCUNhcGUgVG93bjEUMBIGA1UE
   ChMLZXhhbXBsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAONLO82s
   wKA0tWkbR66DajwQKNO9QlYwZvcK4X7MFOcwex+8j2vvG5HCB0BW2Gm72mFTWei8
   gVgQDP1oe/yTWDZRaiJ8rGWdvpgH1Cmxcd3N1AhhRya1I2j5wxrc9ZsyyTYCg2fd
   pFfULrUXSd9QlB2qQZz7kb4ksT/mSwPiGqvFAgMBAAEwDQYJKoZIhvcNAQEFBQAD
   gYEA3WrP8NKjXwQzE0vabYmdUhPHt3PF8EMMwVJ+h8G9Dwmtll0P/kLybXdHF1P/
   SvN8ofdaEKi4DrLvBifkJvHdTm9DgZJo+bROM6LM9kac6CxNvwj9m/4g6mhnjxEV
   63WQPzvAeriO51JC0ysMVe5vf+lO0t+J8W6SfPTKwoXDQhY=
   -----END CERTIFICATE-----
                

5. Test REST access on the HTTPS port, using the certificate that you created in the previous step. For example:

   $ curl
    --header "X-OpenIDM-Username:openidm-admin"
    --header "X-OpenIDM-Password:openidm-admin"
    --cacert CA.pem
    --request GET
    "https://localhost:8443/openidm/managed/user/?_queryId=query-all-ids"
   {
       "conversion-time-ms": 0,
       "result": [
           {
               "_rev": "0",
               "_id": "8afd44a7-13be-449e-9c47-7a310e675c00"
           }
       ],
       "query-time-ms": 1
   }
                

   Note

   If you receive the response curl: (52) Empty reply from server, check that you have, in fact, used https and not http in the URL.

By default, OpenIDM uses an symmetric encryption key with alias openidm-sym-default. Change this default key before deploying OpenIDM in production.

1. Add the new key to the key store.

   $ cd /path/to/openidm/
   $ keytool
    -genseckey
    -alias new-sym-key
    -keyalg AES
    -keysize 128
    -keystore security/keystore.jceks
    -storetype JCEKS
   Enter keystore password:
   Enter key password for <new-sym-key>
     (RETURN if same as keystore password):
   Re-enter new password:
   $ 

   Also see openidm/samples/security/keystore_readme.txt.

2. Change the alias used in openidm/conf/boot/boot.properties.

After changing the default encryption key, change at least the default user password.

1. Use the encrypt command to obtain the encrypted version of the new password.

   $ cd /path/to/openidm/
   $ cli.sh encrypt newpwd
   ...
   -----BEGIN ENCRYPTED VALUE-----
   {
     "$crypto" : {
       "value" : {
         "iv" : "TCoC/YrmiRmINw6jCPB5LQ==",
         "data" : "nCFvBIApIQ7C6k+UPzosaA==",
         "cipher" : "AES/CBC/PKCS5Padding",
         "key" : "openidm-sym-default"
       },
       "type" : "x-simple-encryption"
     }
   }
   ------END ENCRYPTED VALUE------

2. Replace the user object in the openidm/db/scripts/mysql/openidm.sql script before setting up MySQL as a repository for OpenIDM.

   Alternatively, replace the user in the internal user table.