Oracle iplanet Web Server Integration Guide

Transcription

1 Oracle iplanet Web Server Integration Guide

2 Document Information Document Part Number (Rev C) Release Date November 2015 Trademarks All intellectual property is protected by copyright. All trademarks and product names used or referred to are the copyright of their respective owners. No part of this document may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, chemical, photocopy, recording, or otherwise, without the prior written permission of SafeNet, Inc. Limitations This document does not include the steps to set up the third-party software. The steps given in this document must be modified accordingly. Refer to Luna SA documentation for general Luna setup procedures. Disclaimer The foregoing integration was performed and tested only with the specific versions of equipment and software and only in the configuration indicated. If your setup matches exactly, you should expect no trouble, and Customer Support can assist with any missteps. If your setup differs, then the foregoing is merely a template and you will need to adjust the instructions to fit your situation. Customer Support will attempt to assist, but cannot guarantee success in setups that we have not tested. While multiple applications per partition is supported by the PKCS #11 standard, it is the customer s responsibility to validate that applications sharing a partition do so in a manner that does not result in conflicts between the applications. Gemalto/SafeNet strongly recommends customers implement frequent, high quality backups of the key material held within the HSM in a manner consistent with the value of the data being protected by them. It is critical to align this backup strategy to with the application s key management behavior. For example, backups must be refreshed immediately after the application performs any key rotation activities; backups should also be refreshed before any application or HSM upgrades are performed. This is particularly critical for data encryption applications, where loss of the keys renders the data inaccessible. Backups should be verified on a regular basis both to ensure they are usable and to ensure the team responsible for the system knows how to use them to perform a recovery. SafeNet also recommends users thoroughly test all application and HSM upgrades before deploying them on production systems. Depending on the customer s deployments behavior changes in the application or HSM may have an unexpected result. SafeNet makes no representations or warranties with respect to the contents of this document and specifically disclaims any implied warranties of merchantability or fitness for any particular purpose. Furthermore, SafeNet reserves the right to revise this publication and to make changes from time to time in the content hereof without the obligation upon SafeNet to notify any person or organization of any such revisions or changes. 2

3 We have attempted to make these documents complete, accurate, and useful, but we cannot guarantee them to be perfect. When we discover errors or omissions, or they are brought to our attention, we endeavor to correct them in succeeding releases of the product. SafeNet invites constructive comments on the contents of this document. These comments, together with your personal and/or company details, should be sent to the address or below. Contact Method Mail Contact Information SafeNet, Inc Millennium Drive Belcamp, Maryland 21017, USA Support Contacts If you encounter a problem while installing, registering or operating this product, please make sure that you have read the documentation. If you cannot resolve the issue, contact your supplier or SafeNet Customer Support. SafeNet Customer Support operates 24 hours a day, 7 days a week. Your level of access to this service is governed by the support plan arrangements made between SafeNet and your organization. Please consult this support plan for further information about your entitlements, including the hours when telephone support is available to you. Contact Method Address Contact Information SafeNet, Inc Millennium Drive Belcamp, Maryland USA Phone United States International Technical Support Customer Portal Existing customers with a Technical Support Customer Portal account can log in to manage incidents, get the latest software upgrades, and access the SafeNet Knowledge Base. 3

4 Contents Contents CHAPTER 1 Introduction... 5 Overview... 5 Scope... 5 Prerequisites... 6 CHAPTER 2 Installing Oracle iplanet Web Server... 8 CHAPTER 3 Configuring the Oracle iplanet Web Server with Luna SA... 9 Oracle iplanet Web Server 6.1 with Luna SA... 9 Oracle iplanet Web Server 7.0 with Luna SA

5 CHAPTER 1: Introduction CHAPTER 1 Introduction Overview This document covers the necessary information to install, configure and integrate Oracle iplanet Web Server with SafeNet Luna SA Hardware Security Modules (HSM). The Luna HSMs integrates with the Oracle iplanet Web Server to provide significant performance improvements by off-loading cryptographic operations from the Oracle iplanet Web Server to the Luna HSMs. In addition, the Luna HSMs provides extra security by protecting and managing the server s high value SSL private key within a FIPS certified hardware security module. This integration between Luna SA and Oracle iplanet Web Server uses the industry standard PKCS#11 interface. Following are the procedure for installing and configuring the Luna SA Oracle iplanet Web Server on Solaris10 SPARC machine. The installation is performed in several steps: Install and configure the Luna SA Install the Oracle iplanet Web Server Configure the Oracle iplanet Web Server Scope 3rd Party Application Details Oracle iplanet Web Server 6.1 SP14 SPARC (64bit) Oracle iplanet Web Server 6.1 SP14 SPARC (32 bit) Oracle iplanet Web Server 7.0 SP15 RHEL 6.5 (64 bit) Supported Platforms The following platforms are supported for Luna SA 1U v4.5: Solaris 10 SPARC (64-bit) The following platforms are supported for Luna SA 1U v5.x (5.0, 5.2, 5.3 & 5.4): RHEL 6.5 (64-bit) 5

6 CHAPTER 1: Introduction The following platforms are supported for Luna 6.0: RHEL 6.5 (64-bit) The following platforms are supported for Luna 6.1: RHEL 6.5 (64-bit) HSMs and Firmware Version K5 HSM f/w (Luna SA v4.5) K6 HSM f/w (Luna SA v5.4.7) K6 HSM f/w (Luna SA v 6.0.0) Library and Driver Support PKCS#11 v2.01 dynamic library Distributions Luna SA Client s/w v4.5 (32/64 bit) Luna SA Client s/w v5.4 (64 bit) Luna SA Client s/w v6.0 (64 bit) Luna SA Client s/w v6.1 (64 bit) Prerequisites Luna SA Setup Please refer to the Luna SA documentation for installation steps and details regarding the configuration and setup of the box on UNIX systems. Before you get started ensure the following: Luna SA appliance and a secure admin password. Luna SA and a hostname, suitable for your network. Luna SA network parameters are set to work with your network. Initialize the HSM on the Luna SA appliance. Create a partition on the HSM and remember the partition password that will be later used for Oracle iplanet Web Server. Create and exchange certificates between the Luna SA and your "Client" system (registered the Client with the Partition). Run the command, vtl verify to display a partition from Luna SA. The general form of command is /usr/lunasa/bin/vtl verify. 6

7 CHAPTER 1: Introduction NOTE: For Solaris 10 SPARC, you need to export LD_LIBRARY_PATH. export LD_LIBRARY_PATH=/usr/lunasa/lib:$LD_LIBRARY_PATH. Enable Partition "Activation" and "Auto Activation" (Partition policy settings 22 and 23 (applies to Luna SA with Trusted Path Authentication [which is FIPS level 3] only). 7

8 CHAPTER 2: Installing Oracle iplanet Web Server CHAPTER 2 Installing Oracle iplanet Web Server To install Oracle iplanet Web Server, perform the following steps: 1. Login as the root user and unpack the.gz or.zip file to a temporary directory using gunzip filename or unzip filename. 2. Untar the unzipped file using tar xvf filename. This command unpacks the server files and creates a temporary directory structure under the current directory. Unpacking the file may take a little time. Change to the directory where the files have been unpacked. 3. Execute the command./setup to start web server installation. Refer the Oracle iplanet Web Server documentation for more details. After the installation follow the steps mentioned in the next Chapter for configuring Web Server with Luna SA. 8

9 CHAPTER 3 Configuring the Oracle iplanet Web Server with Luna SA Oracle iplanet Web Server 6.1 with Luna SA To configure the Web Server to recognize the Luna SA cryptographic device, perform the following steps: 1. Add the following in to the LD_LIBRARY_PATH: export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:<Path to Luna SA installation directory>/lib:<path to Web Server installation directory>/bin/https/lib 2. Change to the alias directory of the Web Server by using the command: cd <Path to Web Server installation directory>/alias Where the <Path to Web Server installation directory> is root directory of the Web Server. List the contents of the alias directory to see if the file secmod.db exists. If the file does not exist, follow the steps below. If the file exists go to step Create a security module database by using the modutil utility as below:../bin/https/admin/bin/modutil -create -nocertdb -dbdir. modutil displays the following warning: WARNING: Performing this operation while Communicator is running could cause corruption of your security databases. If Communicator is currently running, you should exit Communicator before continuing this operation. Type 'q <enter>' to abort, or <enter> to continue: Ensure that the web browser and communicator are not running and press Enter. 4. Disable the compliance with the FIPS in the Web Server. To do this use the modutil utility as below:../bin/https/admin/bin/modutil -fips false -nocertdb -dbdir. modutil displays the following warning: WARNING: Performing this operation while Communicator is running could cause corruption of your security databases. If Communicator is currently running, you should exit Communicator before continuing this operation. Type 'q <enter>' to abort, or <enter> to continue: Ensure that the web browser and communicator are not running and press Enter. 5. If FIPS mode has already been disabled, modutil displays the following message: (default) FIPS mode already disabled. Otherwise, modutil will display the following message: 9

10 Using database directory... FIPS mode disabled. 6. Add the Luna SA PKCS #11 library to the security database by using the command: For (32-bit):../bin/https/admin/bin/modutil -add lunasa -libfile /usr/lunasa/lib/libcryptoki2.so -nocertdb -dbdir. For (64-bit):../bin/https/admin/bin/modutil -add lunasa -libfile /usr/lunasa/lib/libcryptoki2_64.so -nocertdb - dbdir. modutil displays the following warning: WARNING: Performing this operation while Communicator is running could cause corruption of your security databases. If Communicator is currently running, you should exit Communicator before continuing this operation. Type 'q <enter>' to abort, or <enter> to continue: Ensure that the web browser and communicator are not running and press Enter. The following message will be displayed: Module "lunasa" added to database. 7. Ensure that the module has been added by executing the modutil utility as below:../bin/https/admin/bin/modutil -list -nocertdb -dbdir. Listing of PKCS #11 Modules NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services slot: NSS User Private Key and Certificate Services token: NSS Certificate DB 2. lunasa library name: /usr/lunasa/lib/libcryptoki2.so slots: 1 slot attached status: loaded slot: LunaNet Slot token: part Start the web server using the following command:../startconsole 9. Open the browser with the following URL: or IP Address>:port If you have selected the default port then type or IP Address>:

11 10. Enter the username and password to log in to the server with the administrator password provided during the installation of the web server. 11. Select the web server, click on Manage button and select the Security tab. 12. Click on Create Database and provide the Database Password, click OK button. The following message will be displayed, click OK: Success! Trust database has been successfully initialized. 13. Click Apply and then click on Apply Changes button, the following message will be displayed, click OK: Success! The server has started up. 14. Select Request a Certificate and enter the following details: In the Cryptographic Module field, select Luna SA token. In the Key Pair File Password, enter the Luna SA partition password. Enter the details to generate certificate request. 15. Copy the certificate request and submit the request to CA, after receiving the response from CA save the response. 16. Select Install Certificate and enter the following details and click OK: In the Cryptographic Module field, select Luna SA token. In the Key Pair File Password, enter the Luna SA partition password. Enter the Certificate Name. Copy and paste the received CA response in the Message Text (with headers) 17. Verify the certificate details at the Add Server Certificate page and click Add Server Certificate button, the following message will be displayed, click OK. Warning: Security Changes require Shutdown Although the certificate database has been updated, you must shutdown the server and start it up again to ensure that the changes take effect. 18. The following message will be displayed, click OK: Success Your certificate has been added You may now turn on encryption for your server Click on Apply and Apply Changes button to ensure that the changes take effect. 19. Select the Administration Server and click on Manage button. 20. Select Preferences tab and click on Edit Listen Sockets. 21. Click on the Listen Socket ID and Enter the Luna SA partition password and click OK. 22. Enter the details on the Edit Listen Socket page: 11

12 In the Security section, select security Enabled in the drop down list, click OK and click the Apply. Select Server Certificate Name for the listen socket, select the certificate which you have installed and click OK. 23. Click on Apply and Apply Changes button to ensure that the changes take effect, it will ask password for listed Modules. Provide password and click OK to start the server. Once the SSL enabled on the server open the browser and enter the URL that points the documents on an SSL-Enabled server: or IP Address>:port If the SSL is enabled for the existing port number i.e., 80, type or IP Address>: Accept the certificate. Oracle iplanet Web Server 7.0 with Luna SA To configure the Web Server to recognize the Luna SA cryptographic device, perform the following steps: 1. Add the following in to the LD_LIBRARY_PATH: export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:<Path to Luna SA installation directory>/lib:<path to Web Server installation directory>/lib 2. Change to the alias directory of the Web Server by using the command: cd <Path to Web Server installation directory>/admin-server/config Where the <Path to Web Server installation directory> is root directory of the Web Server. List the contents of the alias directory to see if the file secmod.db exists. If the file does not exist, follow the steps below. If the file exists go to step Create a security module database by using the modutil utility as below: /opt/oracle/webserver7/bin/modutil -create -nocertdb -dbdir. modutil displays the following warning: WARNING: Performing this operation while Communicator is running could cause corruption of your security databases. If Communicator is currently running, you should exit Communicator before continuing this operation. Type 'q <enter>' to abort, or <enter> to continue: Ensure that the web browser and communicator are not running and press Enter. 4. Disable the compliance with the FIPS in the Web Server. To do this use the modutil utility as below: /opt/oracle/webserver7/bin/modutil -fips false -nocertdb -dbdir. modutil displays the following warning: WARNING: Performing this operation while Communicator is running could cause corruption of your security databases. If Communicator is currently running, you should exit Communicator before continuing this operation. Type 'q <enter>' to 12

13 abort, or <enter> to continue: Ensure that the web browser and communicator are not running and press Enter. 5. If FIPS mode has already been disabled, modutil displays the following message: (default) FIPS mode already disabled. Otherwise, modutil will display the following message: Using database directory... FIPS mode disabled. 6. Add the Luna SA PKCS #11 library to the security database by using the command: For (32-bit): /opt/oracle/webserver7/bin/modutil -add lunasa -libfile /usr/safenet/lunaclient/lib/libcryptoki2.so - nocertdb -dbdir. For (64-bit): /opt/oracle/webserver7/bin/modutil -add lunasa -libfile /usr/safenet/lunaclient/lib/libcryptoki2_64.so -nocertdb -dbdir. modutil displays the following warning: WARNING: Performing this operation while Communicator is running could cause corruption of your security databases. If Communicator is currently running, you should exit Communicator before continuing this operation. Type 'q <enter>' to abort, or <enter> to continue: Ensure that the web browser and communicator are not running and press Enter. The following message will be displayed: Module "lunasa" added to database. 7. Ensure that the module has been added by executing the modutil utility as below: /opt/oracle/webserver7/bin/modutil -list -nocertdb -dbdir. [root@localhost config]# /opt/oracle/webserver7/bin/modutil -list -nocertdb -dbdir. Listing of PKCS #11 Modules NSS Internal PKCS #11 Module slots: 2 slots attached status: loaded slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services slot: NSS User Private Key and Certificate Services token: NSS Certificate DB 2. lunasa library name: /usr/safenet/lunaclient/lib/libcryptoki2_64.so slots: 4 slots attached status: loaded 13

14 slot: Net Token Slot token: manjari slot: Luna UHD Slot token: slot: Luna UHD Slot token: slot: Luna UHD Slot token: Start the web server using the following command: cd /opt/oracle/webserver7/admin-server/bin./startserv 9. Open the browser with the following URL: or IP Address>:port If you have selected the default port then type or IP Address>: Enter the username and password to log in to the server with the administrator password provided during the installation of the web server. 11. Click on Server Certificates. 14

15 12. Click on Set Password button. And provide Luna SA partition/token password. Click OK. 15

16 13. On Server Certificate tab client on Request button and follow the wizard. At step 2 select Luna SA token, provide password and click on Next button 14. On step 3 provide all information for certificate request. Click on Next button. 16

17 15. Provide Key Type details in step Select CA Signed Certificate as Certificate Type. Click Next. It will return certificate request. Get it signed from third party CA. 17

18 17. Once you receive signed certificate go to Server Certificates tab click on Install button. Provide token details and paste certificate data or select signed certificate file. Click on Next. 18. Provide Nick Name for your certificate and select http listener 18

19 19. Verify the certificate details and click on Finish. 19

20 20. The following message will be displayed, click Close. 21. Go to Configuration tab click on your configuration. 22. Go to HTTP Listener tab and click on listed listener. Select Enabled check box for SSL and make sure that certificate that was installed in step 18 is listed as RSA Certificates. Click on Apply button. 20

21 23. Deployment pending message will get displayed. Click on Deploy button. 21

22 24. Result will be displayed that Configuration has been deployed successfully. 25. Once the SSL is enabled on the server open the browser and enter the URL that points the documents on an SSL-Enabled server: or IP Address>:port If the SSL is enabled for the existing port number i.e., 80, type or IP Address>: Accept the certificate. 22