Re: LDAP Key Store Password and GSK7capicmd Password

Hi Gregory,

if you did not solve your problems yet, I'm attaching a script that will
probably help you to manage keystores for agents. It creates a new
keystore, removes all public CA certificates, puts only your CA public
certifcate to the keystore. Then it generates CSR and after you've received
signed certificate from your CA, it puts the certificate into keystore and set
the default certificate. Actually it was inspired by the ITM Certificate
Authentication Configuration Guide:
https://www.ibm.com/developerworks/mydeveloperworks/wikis/home/wiki/Tivoli%20Monitoring/page/ITM%20Certificate%20Authentication%20Configuration%20Guide%20for%20ITM%206.2.2%20and%20newer%20releases?lang=en

I assume you are using ITM with GSkit version 7 (for version 8 you have to
replace the command to gsk8capicmd, and comment out the removal of standard CA
certificates).  You need to have the gsk7capicmd command in your path.

First obtain you CA public certificate and put it to ITMRoot.arm (or another
file and change script value CACERTFILE). Next edit the script and set
two variables:
DN - to the DN you want to use for the certificates (normally you organization DN)
CACERTNAME - to the label you want your CA to appear in the keystore.

then:

./agentkeystore.sh request <name>

will generate a new keystore for server named <name> in a newly created
directory (<name>) and tell you the filename you will have to send to your CA
for signing.

After you have received you signed request, put this file to <name>-signed.arm
file in the directory and run

./agentkeystore.sh generate <name>

This will include the signed certificate to keystore. Now you can copy
keyfile.kdb, keyfile.rdb and keyfile.sth to the $CANDLEHOME/keyfiles and restart all your
agent(s).

My script generates random password for each keystore and it's stored in the keyfile.kdb-password file.

So long story short - for each agent peform first
./agentkeystore.sh request <name>
# get the CSR signed and run
./agentkeystore.sh generate <name>
# copy files to agent

You can do this procedure before the OS agent will be installed (just crate the
$CANDLEHOME/keyfiles directory and put the files before). You need to copy the
KAES256.ser file too. KAES256.ser contains the password for AES encryption.
This is used for AES encrypted configuration properties such as passwords. You
can take this file from TEMS as it NEEDS be the same across your environment.

Don't forget to tell your CA to have the certification signed for a long time,
so you won't get issues with expired certificates in your environment. Based on
my experience I'd suggest to avoid changing the certificates at all.

Julius



On Thu, Mar 21, 2013 at 06:21:57AM -0500, Gregory Mendes <[email protected]> wrote:
> 
> Hey Frank, Thanks alot for that great information.  My question is how do I use that .cer Public key as the certificate that the hub_TEMS will use for user authentication?  Is that possible?  Regards,
> 
> 
> 
> Gregory R. Mendes
> 770-317-8593
> 
>  Date: Wed, 20 Mar 2013 23:52:32 -0400
> Subject: RE: [TME10] LDAP Key Store Password and GSK7capicmd Password
> From: frank.tate-9LkaxTQlAnxWk0Htik3J/[email protected]
> To: [email protected]
> 
> You can't make a .cer certificate the default because it's NOT  a PRIVATE certificate (which is what the error is telling you). That .cer file is normally the public key for the CA (so clients can verify that the CA signed a certificate). An actual PRIVATE key/certificate will almost always be in a .pks file (or similar) and will have a password that's needed to import or read it (the .cer file does not require a password because it's a PUBLIC certificate). You can have multiple CA public certs in a keystore, and that has the effect that any one of those CAs is "trusted" to sign certificates that are either atored in this keystore or received by the client that is using this keystore. You can also (separately) have multiple personal (private) certs in the keystore that can be presented by the client rhat is using this keyatore. To tell the client exactly which personal/private key to present, tou have to specify the label of that certificate as it appears in the keystore. But tou just about NEVER have to spe
> cify the label of any CA certificate.
> 
> I realize it's confusing, but that's just how it is. You may need to do some generic research on SSL, certificates and keystores before you ever try to get LDAP involved, since that adsitional layer REQUIRES a REALLY firm understanding of PKI.
> 
> Frank - from my phone
> On Mar 20, 2013 8:35 PM, "Gregory Mendes" <[email protected]> wrote:
> 
> 
> 
> 
> 
> Hey Toben,
>  
> Here's the problem.  By default the configuration for LDAP at the hub_TEMS creates a CA called IBM_Tivoli_Monitoring_Certificate that is set to the default private key CA (!-*).  When I import the CA certificate that the customer wants to use, it's listed in the keyfile.kdb but I can make it the default.  It give me the error GSKKM_ERR_KEYREC_PRIVATE_KEY_NULL when trying to run the gsk7capicmd -cert -setdefault  -db /opt/IBM/ITM/keyfiles/keyfile.kdb -label "goes CA".  It's really making me want to shoot a round through the screen.  :)
> 
>  
> Regards,
> 
> 
> 
> Gregory R. Mendes
> Tivoli Architect/Tools Specialist
> Mendes, Inc.
> Tivoli Monitoring 6.2.3 Certified
> 770-317-8593
> 
>  
> 
> Date: Wed, 20 Mar 2013 18:32:40 -0500
> Subject: Re: [TME10] LDAP Key Store Password and GSK7capicmd Password
> From: [email protected]
> To: [email protected]
> 
> 
> Private keys, keystores, password encryption of said keystores and/or keys: all interchangable relative to OS.  But I hear you, not apt in the perfect sense for Linux
> On Mar 20, 2013 4:34 PM, "[email protected]" <[email protected]> wrote:
> 
> 
> So if you are talking about creating a new keystore, then you can give it any password you want and that password has nothing to do with SSL encryption at all--it just serves as your credential to open the keystore database (*.kdb) file.  Once you have a keystore database opened, you can then import/export certificates of types both "personal" and "signer" to/from it.  Sometimes these certificates themselves were password protected when they were exported, and so to import them into your keystore you'll need to have the password used when they were exported.
> 
> 
> 
> 
> I know that isn't an explicit answer to the error you're seeing below, but I'm just providing enough info to get moving in a progressive direction.  Also, the attached file, while germane on its surface to MS's IE, has some good info int he 7 sections at the beginning that can shed some light on the relationships and concepts here.
> 
> 
> 
> 
> Toben
>  
> On Wed, Mar 20, 2013 at 2:07 PM, Gregory Mendes <[email protected]> wrote:
> 
> 
> 
> 
> 
> 
> Hello All,
>  
> Are these two passwords the same?
>  
> So, when I configure the h_tems for LDAP support it asks me for LDAP Key store and I give it a password.  Should this password be the IBM61TIV or can you make it anything?  Or, does this password need to be the same for both the LDAP configuration and the CA certificate install to the keyfile.kdb?
> 
> 
> 
>  
> I get this error in my TEMS logfile:
>  
> LDAP client is Success.
> LDAP SSL initialization (113), SSL failure reason code (102):  LDP1_Keyring /opt/IBM/ITM/keyfiles, password xxxxxxxx.
>  
> Any ideas?
>  
> 
> 
> 
> Regards,
> 
> 
> 
> Gregory R. Mendes
> Tivoli Architect/Tools Specialist
> Mendes, Inc.
> Tivoli Monitoring 6.2.3 Certified
> 770-317-8593
> 
>  		 	   		  
> 
> 
> 
> _______________________________________________
> 
> TME10 mailing list
> 
> [email protected]
> 
> Unsubscribe:[email protected]
> 
> 
> 
> 
> -- 
> "Sometimes I think that's the only right thing to do:
> To dream. to live in the world of dreams.
> But it doesn't last forever--wakefulness always comes to take me back..."
> 
> 
> _______________________________________________
> TME10 mailing list
> [email protected]
> Unsubscribe:[email protected] 		 	   		  
> 
> _______________________________________________
> 
> TME10 mailing list
> 
> [email protected]
> 
> Unsubscribe:[email protected]
> 
> 
> 
> 
> _______________________________________________
> TME10 mailing list
> [email protected]
> Unsubscribe:[email protected] 		 	   		  

> _______________________________________________
> TME10 mailing list
> [email protected]
> Unsubscribe:[email protected]


-- 

[ Julius Loman ][ [email protected] ][ http://lomo.kyberia.net ][ icq:35732873 ]

_______________________________________________
TME10 mailing list
[email protected]
Unsubscribe:[email protected]

#!/bin/sh

# Script for managing ITM keystore certificates

# Put DN base of your organization here - this will be appened to the CN of certificate request
DN="OU=IT Division,O=XXXX,C=SK"
# File name of the CA certificate file that will be added to the keystore
CACERTFILE="`dirname $0`/ITMRoot.arm"
# Label name of the CA certificate entry
CACERTNAME="My Certification Authority"

NAME=$2
ACTION=$1

usage() {
	echo
	echo "Usage: `basename $0` [request|keyfile] <name>"
	echo 
	echo "       request - generate Certificate Signing Request file"
	echo "       keyfile - generate keyfile.kdb and related files (signed CSR must be present)"
	echo 
	echo "Command gsk7capicmd must be in the \$PATH variable"
	exit 1
}

if [ -z "$NAME" ]; 
then
	echo "Error Name cannot be empty."
	usage
fi

if [ "$ACTION" != "request" -a  "$ACTION" != "keyfile"  ];
then
	echo "Error: Only request and generate actions are recognized."
	usage
fi

if [ ! `which gsk7capicmd 2>/dev/null` ];
then
	echo "Error: gsk7capicmd not found in the \$PATH."
	usage
	exit 1
fi

AGENTDIR="`dirname $0`/${NAME}"

KEYDBFILE="${AGENTDIR}/keyfile.kdb"
KEYCSR="${AGENTDIR}/${NAME}-request.arm"
KEYCSRSIGN="${AGENTDIR}/${NAME}-signed.arm"
KEYDBPASSWORDFILE="${AGENTDIR}/keyfile.kdb-password"


if [ ! -d "${AGENTDIR}" ];
then
	mkdir -p "${AGENTDIR}"
fi

if [ ! -e "${KEYDBPASSWORDFILE}" ];
then
	# We recommend using random to generate a random password
	# for each Agent. The password will be saved as part of
	# the stash file for each new keystore.
	# you may adjust the length as needed. The escaped version is useful so the shell
	# doesn't balk at shell-specific characters when used as a parameter

	#gsk7capicmd -random -create -length 32 -strong -fips > ${NAME}-password.txt
	echo "12345678901234567890123456789012" | perl -pi -e "s/([()\\ \~\?\;|&\!<>\`\'\*\"\\$])/\\\\\1/g" > ${KEYDBPASSWORDFILE}
fi
export PASSWORD="`cat ${KEYDBPASSWORDFILE}`"

case "$ACTION" in
"request")
	# Create a certificate keystore for each ITM agent, TEMS, TEPS

	
	# Create the agent's key database
	gsk7capicmd -keydb -create -db "${KEYDBFILE}" -pw "${PASSWORD}" -expire 365 -fips -stash
	
	# Cleanup the old CAs
	gsk7capicmd -cert -list -db "${KEYDBFILE}" -pw "${PASSWORD}" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "Thawte Personal Premium CA" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "Thawte Personal Freemail CA" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "Thawte Personal Basic CA" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "Thawte Premium Server CA" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "Thawte Server CA" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "VeriSign Class 3 Secure Server CA" -fips
	#gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "VeriSign International Server CA - Class 3" -fips 
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "VeriSign Class 3 Public Primary Certification Authority - G5" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "VeriSign Class 4 Public Primary Certification Authority - G3" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "VeriSign Class 3 Public Primary Certification Authority - G3" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "VeriSign Class 2 Public Primary Certification Authority - G3" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "VeriSign Class 1 Public Primary Certification Authority - G3" -fips 
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "VeriSign Class 4 Public Primary Certification Authority - G2" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "VeriSign Class 3 Public Primary Certification Authority - G2" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "VeriSign Class 2 Public Primary Certification Authority - G2" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "VeriSign Class 1 Public Primary Certification Authority - G2" -fips 
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "VeriSign Class 3 Public Primary Certification Authority" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "VeriSign Class 2 Public Primary Certification Authority" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "VeriSign Class 1 Public Primary Certification Authority" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "Entrust.net Global Secure Server Certification Authority" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "Entrust.net Global Client Certification Authority" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "Entrust.net Client Certification Authority" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "Entrust.net Certification Authority (2048)" -fips
	gsk7capicmd -cert -delete -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "Entrust.net Secure Server Certification Authority" -fips
	gsk7capicmd -cert -list -db "${KEYDBFILE}" -pw "${PASSWORD}" -fips
	
	# Create a new certificate request for this agent to be signed by the CA
	gsk7capicmd -certreq -create -db "${KEYDBFILE}" -pw "${PASSWORD}" -label "IBM_Tivoli_Monitoring_Certificate" -size 2048 -file "${KEYCSR}" -dn "CN=${NAME},$DN" -fips
	
	echo "Now send the file ${KEYCSR} to certificate authority for signing."
	echo ""

	;;
"generate")
	if [ ! -e "${KEYCSRSIGN}" ];
	then
		echo "Signed CSR (${KEYCSRSIGN}) does not exists. Have the certificate signing request signed first"
		exit 2
	fi
	if [ ! -e "${CACERTFILE}" ];
	then
		echo "CA Certificate not found in (${CACERTNAME})"
		echo 3
	fi
	# Send the certificate to the CA to be signed
	#gsk7capicmd -cert -sign -db ITMRoot.kdb -pw $CAPASSWORD -expiry 365 -label "Tivoli ITM Certificate Authority" -file ${NAME}Req.arm -target ./${NAME}Signed.arm

	# Import the CA Cert into the agent's key database so the signer is recognized when the agent cert is imported
	gsk7capicmd -cert -add -file "${CACERTFILE}" -trust enable -label "${CACERTNAME}" -db "${KEYDBFILE}" -pw "${PASSWORD}" -fips

	# Receive the now signed certificate
	gsk7capicmd -cert -receive -file "${KEYCSRSIGN}" -db "${KEYDBFILE}" -pw "${PASSWORD}" -fips

	# Make the new imported signed certificate the default certificate in the database using the
	# established ITM key name
	gsk7capicmd -cert -setdefault -db "${KEYCSRSIGN}" -pw "${PASSWORD}" -label "IBM_Tivoli_Monitoring_Certificate" -fips

	# List the keystore
	gsk7capicmd -cert -list -db "${KEYDBFILE}" -pw "${PASSWORD}" -fips
	
	echo "Keystore "${KEYDBFILE}" is now ready."
	echo "Transfer appropriate files into \$CANDLEHOME/keyfiles on target system and restart agent."
	echo ""
	;;
esac

exit 0