security

.Net Core
Article

Using .NET Core in a "Disconnected" Environment

Rick Wagner

For added security, .NET Core applications that require access to external libraries can be run in a disconnected environment (one without internet access). Here's how.

Red Hat Summit logo
Article

Red Hat Summit 2018: Develop Secure Apps and Services

Mike Guerette

Red Hat Summit 2018 will focus on modern application development. Securing your applications and services is a critical part of modern applications. At Red Hat Summit 2018 developer-oriented sessions learn how to secure your applications and services, integrate single-sign on, and manage your APIs.

Red Hat OpenShift Container Platform
Article

Integrating Intercede RapID with Red Hat Mobile and OpenShift

Evan Shortiss

In this article, we’ll demonstrate how Red Hat Mobile v4 and OpenShift v3 enable customers to rapidly deploy and secure their mobile applications by integrating with a third party product provided by Intercede. We’ll be using Intercede’s RapID product to enable two-way TLS.

Open Virtual Network
Article

Non-root Open vSwitch in RHEL

Aaron Conole

In a few weeks, the Fast Datapath Production channel will update the Open vSwitch version from the 2.7 series to the 2.9 series. This is an important change, a wealth of new features and fixes all related to packet movement will come into play.

GNU C library
Article

Recommended compiler and linker flags for GCC

Florian Weimer

This article walks through a list of recommended build flags for when you compile your C or C++ programs with GCC. Do you know which build flags you need to specify in order to obtain the same level of security hardening that GNU/Linux distributions such as Fedora and Red Hat Enterprise Linux use?

3Scale by Red Hat
Article

3Scale by Red Hat Integration with ForgeRock using OpenID Connect

Vinay Bhalerao

This article shows Redhat 3Scale integration with ForgeRock using OpenID Connect. We will show how to integrate ForgeRock with 3scale by Red Hat. ForgeRock is one of the popular and growing identity management companies.

Red Hat Summit Logo
Article

Red Hat Summit 2018 to focus on Modern App Development

Mike Guerette

Following is a diverse set of developer-related breakouts, workshops, BoFs, and labs for Red Hat Summit 2018. With these 61+ sessions, we believe that every attending application developer will come away with a strong understanding of where Red Hat is headed in this app dev space.

Integrating WebSphere MQ with JBoss Enterprise Application Server
Article

New with JBoss EAP 7.1: Credential Store

Lucas Costi

In previous versions of JBoss EAP, the primary method of securely storing credentials and other sensitive strings was to use a password vault. A password vault stopped you from having to save passwords and other sensitive strings in plain text within the JBoss EAP configuration files. However, a password vault has a few drawbacks. For example, each JBoss EAP server can only use one password vault, and all management of the password vault has to be done with an external...

Video Thumbnail
Video

Ep. 1: Input Validation (2 of 2)

(Part 2)Learn about recommended practices for producing secure code with input validation in part one of this four-part video series.

Video Thumbnail
Video

Ep. 4: Security Mentality (2 of 2)

Learn how to start adopting a security-like mentality, also known as the "security mindset" in part four of this four-part video series.

Video Thumbnail
Video

Ep. 4: Security Mentality (1 of 2)

Learn how to start adopting a security-like mentality, also known as the "security mindset" in the first half of part four in this four-part video series.

Video Thumbnail
Video

Ep. 3: Authorization

Learn about authorization such as user privileges, levels of access, and how they're different in part three of this four-part video series.

Video Thumbnail
Video

Ep. 2: Numeric Errors

Learn about numeric errors and the dangers of using incorrect data types in part two of this four-part video series.

Video Thumbnail
Video

Ep. 1: Input Validation (1 of 2)

(Part 1)Learn about recommended practices for producing secure code with input validation in part one of this four-part video series.

RedHat logo
Article

Stack Clash Mitigation in GCC -- Background

Jeff Law

It has long been recognized that unconstrained growth of memory usage constitutes a potential denial of service vulnerability. Qualys has shown that such unconstrained growth can be combined with other vulnerabilities and exploited in ways that are more serious. Typically, the heap and stack of a process start at opposite ends of the unused address space and grow towards each other. This maximizes the flexibility to grow the regions over the course of execution of the program without apriori knowing...

Integrating PicketLink
Article

Integrating PicketLink with OKTA for SAML based SSO

Siddhartha De

JBoss Application Server ships with PicketLink module for enabling SAML based SSO. PicketLink is an open source module and it is SAML v2.0 complained, for more information about 'PicketLink' please visit picketlink.org . Now the requirement is to enable SAML based SSO in JBoss Application Server where IDP is OKTA . Before we start enabling this, one should have an OKTA organization, a free developer organization can be created here . If you already have an OKTA organization, you need...

The Diamond in the Rough
Article

The Diamond in the Rough: Effective Vulnerability Management with OWASP DefectDojo

Tom Jackman

Managing the security of your projects applications can be an overwhelming and unmanageable task. In today's world, the number of newly created frameworks and languages is continuing to increase and they each have their own security drawbacks associated with them. The wide variety of security scanners available can help find vulnerabilities in your projects, but some scanners only work with certain languages and they each have different reporting output formats. Creating reports for customers or managers and viewing analytics using...

How to implement a new realm in Tomcat
Article

How to implement a new realm in Tomcat

Siddhartha De

Tomcat by default ships with a couple of Realm implementations like, JDBCRealm , DataSourceRealm , and JNDIRealm etc. But sometimes it is not sufficient for your organization's requirements and you are required to apply your own implementations. How to implement a custom realm in Tomcat? You can create your own realm by extending RealmBase class; here I am going to show an example of implementing a new Realm in Tomcat. Here is a sample code snip for implementing a new...

Video Thumbnail
Video

Keycloak: A New Open Source Authentication Server Video

Keycloak is a new open source authentication server for cloud, mobile and html5. With loads of features, including single-sign on, social login, account management console, account workflows, fully featured admin console, OAuth2 and OpenShift cartridge to name a few. The first alpha has recently been released, with loads more features planned for the future. Keycloak also provides support for role based authorization and supports granting access to third party applications. This talk gives a comprehensive introduction to Keycloak and its features, as well as discuss how easily you can add authentication to your applications. There will also be an extensive live demo. Stian Thorgersen is a Senior Software Engineer at Red Hat. He co-leads the Keycloak project together with Bill Burke, and is also the security lead on another new open source project. Stian also has many years of experience in cloud solutions.

Node.js logo
Article

Using Snyk, NSP and Retire.JS to Identify and Fix Vulnerable Dependencies in your Node.js Applications

Tom Jackman

Introduction Dependency management isn’t anything new, however, it has become more of an issue in recent times due to the popularity of frameworks and languages, which have large numbers of 3rd party plugins and modules. With Node.js, keeping dependencies secure is an ongoing and time-consuming task because the majority of Node.js projects rely on publicly available modules or libraries to add functionality. Instead of developers writing code, they end up adding a large number of libraries to their applications. The...

GNU C library
Article

Diagnosing Function Pointer Security Flaws with a GCC plugin

Aldy Hernandez +1

A few months ago, I had to write some internal GCC passes to perform static analysis on the GNU C Library (glibc). I figured I might as well write them as plugins since they were unlikely to see the light of day outside of my little sandbox. Being a long time GCC contributor, but having no experience writing plugins I thought it'd be a good way to eat our own dog food, and perhaps write about my experience. Unfortunately, I...

Using API keys securely in your OpenShift microservices and applications
Article

End To End Encryption With OpenShift Part 1: Two-Way SSL

Ron Sengupta

This is the first part of a 2 part article, part 2 (End To End Encryption With OpenShift Part 2: Re-encryption) will be authored by Matyas Danter, Sr Consultant with Red Hat, it will be published soon. This article aims to demonstrate use cases for Openshift routes to achieve end-to-end encryption. This is a desirable and sometimes mandated configuration for many verticals, which deal with strict regulations. For example, financial sectors often are extremely careful about their application security standards...

Migrating my iptables setup to nftables
Article

Migrating my iptables setup to nftables

Phil Sutter

Wanting to become familiar with nftables, I decided to jump in at the deep end and just use it on my local workstation. The goal was to replace the existing iptables setup, ideally without any drawbacks. The following essay will guide you through what I have done in order to achieve that. In order to be able to follow, you should already be familiar with iptables and at least have a rough idea of what nftables are. I don't see...

Using API keys securely in your OpenShift microservices and applications
Article

Understanding OpenShift Security Context Constraints

Alessandro Arrichiello

OpenShift gives its administrators the ability to manage a set of security context constraints (SCCs) for limiting and securing their cluster. Security context constraints allow administrators to control permissions for pods using the CLI. SCCs allow an administrator to control the following: Running of privileged containers. Capabilities a container can request to be added. Use of host directories as volumes. The SELinux context of the container. The user ID. The use of host namespaces and networking. Allocating an 'FSGroup' that...