Skip to Main Content
Forums

Java SE (Java Platform, Standard Edition)

Announcement

For appeals, questions and feedback about Oracle Forums, please email oracle-forums-moderators_us@oracle.com. Technical questions should be asked in the appropriate category. Thank you!

Interested in getting your voice heard by members of the Developer Marketing team at Oracle? Check out this post for AppDev or this post for AI focus group information.

Java SE Ver 7 Uxx locking out domain user account failing Kerberos PreAuth

mxm323Jun 4 2013 — edited Oct 28 2013
Java SE Ver 7 all updates are failing Kerberos Pre_Auth and locking domain user accounts because of truncated UDP packets.

When a user opens a page that uses JavaScript their domain account gets a bad password, subsequent openings in the lockout threshold window (5 in 30 minutes for us) results in a domain account lockout.

I have done extensive troubleshooting of this issue and have root caused and been able to prevent it with a less desirable solution. Oracle fixes for the bug below (basically same issue) do not work for me or i'm implementing them incorrectly.

This effects XP\Win7 (32Bit browsers with IE 8 and 9).

Java SE Ver 7 U21 and lesser updates are failing Kerberos Pre_Auth (KRB5KDC_ERR_PREAUTH_FAILED)due to the use of UDP instead of TCP. Starting with the SRV request, UDP exceeds MTU and gets truncated enroute to the KDC. This results in the eventual response from the KDC as bad credential and eventual account lockout if user repeats call for Java.

We have been able to force TCP by blocking UDP 88 on a test station's windows firewall. This prevents the bad password, but injects a delay while kerberos times out UDP and fails to TCP.

Java BUG 8009875 lists the "udp_preference_limit=1" value that forces Java to use TCP, but i can't get this working with a KRB5.config or KRB5.ini file in the c:\windows directory. Even utilizing an environment variable KRB5_CONFIG does not work.

Our expected result is to force Java 7 to use TCP for Kerberos transactions and not UDP. This will be a stop gap until the release of Version 8 next year, which BUG 8009875 says corrects the default UDP call to TCP.

Comments

SPS

I was using Google Chrome and got this error. I got initially misled by this error as I was not very confident about the public key.

I however do not get it in Firefox. 

Cheers!!

Samar

John Edward Scott

Hi Samar,

This is a change in the Google Chrome (and others) browser, essentially to plug a security hole in the Diffie-Hellman Key Exchange protocol.

My understating is that Google took the decision to prevent accepting ciphers which were susceptible to the security hole, which is great in one sense, but in doing that they rendered many sites unaccessible (until the website operators fixed the issue on their side).

For us - this means (I believe) that we need to either -

1) Use a different browser (such as IE), which has not yet blocked the affected keys

2) Update the DBaaS console / Glassfish etc to not use those ciphers

3) Wait for Oracle to fix and release new images

I had a go at doing 2 last week and thought I had it working, but then found I'd broken it under certain circumstances - if I get it working I'll do a blog post on what I had to change.

Hope this helps

John

--------------------------------------------

Blog: http://jes.blogs.shellprompt.net

Work: http://www.apex-evangelists.com

as the opc user

cd /u01/app/oracle/product/glassfish3/bin

./asadmin set 'configs.config.server-config.network-config.protocols.protocol.http-listener-2.ssl.ssl3-tls-ciphers=+TLS_RSA_WITH_AES_256_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA'

./asadmin set 'configs.config.server-config.network-config.protocols.protocol.sec-admin-listener.ssl.ssl3-tls-ciphers=+TLS_RSA_WITH_AES_256_CBC_SHA,+TLS_RSA_WITH_AES_128_CBC_SHA'

then bounce glassfish using the dbaascli tool

fixed by the end of the month in the new base images.

2 people found this helpful
jschrap

The above fix does work.

Just one note:

bounce glassfish using dbaascli tool  - with user root only.

Otherwise error:

-bash-4.1$ dbaascli glassfish stop

mkdir: cannot create directory `/var/opt/oracle/log/dbaascli/': Permission denied

DBAAS CLI version 1.0.0

Executing command glassfish stop

Unable to run command. This command should be run as user: oracle or root. Currently: opc

dbaascli glassfish stop and start commands appear to work under root, but dbaascli glassfish status fails:

bash-4.1# dbaascli glassfish status

DBAAS CLI version 1.0.0

Executing command glassfish status

Calculating the status and metrics:

Authentication failed for user: admin

with password from password file: /u01/app/oracle/product/glassfish3/bin/statuspwd.txt

(Usually, this means invalid user name and/or password)

Authentication failed for user: admin

with password from password file: /u01/app/oracle/product/glassfish3/bin/statuspwd.txt

(Usually, this means invalid user name and/or password)

domain1 running

Command list-domains executed successfully.

Command list-http-listeners failed.

Command uptime failed.

I wonder what the reason is for using the dbaascli tool instead of bouncing via init.d ? 

/etc/init.d/glassfish start/stop/restart

John Edward Scott

Running it as the Oracle user worked for me -

[oracle@OC1 ~]$ dbaascli glassfish stop

DBAAS CLI version 1.0.0

Executing command glassfish stop

Starting the GlassFish domain1

Environment variable GLASSFISH_HOME not set

Waiting for the domain to stop ..

Command stop-domain executed successfully.

[oracle@OC1 ~]$ dbaascli glassfish start

DBAAS CLI version 1.0.0

Executing command glassfish start

Starting the GlassFish domain1

Environment variable GLASSFISH_HOME not set

Waiting for domain1 to start ...........

Successfully started the domain : domain1

domain  Location: /u01/app/oracle/product/glassfish3/glassfish/domains/domain1

Log File: /u01/app/oracle/product/glassfish3/glassfish/domains/domain1/logs/server.log

Admin Port: 4848

Command start-domain executed successfully.

1 person found this helpful
user444805-Oracle

in firefox

Go to about:config

search for

security.ssl3.dhe_rsa_aes_128_sha and

security.ssl3.dhe_rsa_aes_256_sha

change to false

brian_spendolini-Oracle

DO NOT ALTER THE SECURITY SETTINGS IN YOUR BROWSER


This is a VERY bad idea for it opens you up to multiple attack vectors.

I have given you the solution and can provide a UI way as well if needed.

1 person found this helpful
1 - 7
Locked Post
New comments cannot be posted to this locked post.

Post Details

Locked on Nov 25 2013
Added on Jun 4 2013
#java-runtime-environment-jre
11 comments
17,316 views