TYPES OF SECURITY

WEP (Wired Equivalent Privacy) = WEP is a security protocol for wireless networks. WEP aims to provide security by encrypting data over radio waves so that it is protected as it is transmitted from one end point to another. A shared key (similar to a password) is used to allow communication between the computers and the router. WEP offers a basic, but satisfactory level of security for wireless data transmission.
WPA (Wi-Fi Protected Access) = A security protocol for wireless networks that builds on the basic foundations of WEP. It secures wireless data transmission by using a key similar to WEP, but the added strength of WPA is that the key changes dynamically. The changing key makes it much more difficult for a hacker to learn the key and gain access to the network.
WPA2 (Wi-Fi Protected Access 2) = WPA2 is the second generation of WPA security and provides a stronger encryption mechanism through Advanced Encryption Standard (AES), which is a requirement for some government users.

Hi,
From my own reference... I do a lot of what you do on-line and at first just used the Mac built-in Firewall. All was well. Later, about a year, I opted to purchase a combo internet protection package from Intego as I went from dial-up to high-speed cable (always on if the computer is). Well, in the last year of logs with this Internet Barrier all that is recorded is 'Ping attacks'... which I have blocked now. What are they and what they do is anybody's guess, but some are from places other then where I went on-line, so I guess it's a good thing. I did get this software from the Apple Store after a long talk with the in-store personnel about going to cable internet. Dial-up is different, too slow for what the hackers want to do, where cable or broadband has the speed to do your bidding and another's without you even seeing it.
So, if your worried (like I was) you can put in "an ounce of prevention" to prevent "a pound of cure"... and monitor what happens. Who knows, the time may come when it is truly needed, but from what I have seen it is not yet. I believe the ping stuff is just the snooper, maybe the adds or something else seeing where you go and if you look at there banners, but that too bothers me.
Enjoy

Similar Messages

  • HT1222 how do i downlaod all itunes, pictures, etc. from Iphone4 to 5s.  I get some type of security issue

    How do download itunes and pictures from 4 to 5S.  I go through itunes and receive some type of security violation message

    What exactly does the message say?
    You don't download from one iphone to another.  You sync both to itunes on your computer.

  • I understand there is no virus protection needed for the lst iPad, but what type of security is there when going on the internet?

    I understand there is no virus protection needed for the lst ipad, but what type of security is needed when on the internet?

    Just put your faith in Apple.

  • I have to type my security code every time I turn on my ipad with ios6.0. I don' have to this with ios5.1. How can I solve this problem?

    I have two problems with IOS 6.0.
    1. I have to type my security code every time I turn on my ipad with ios6.0. I don' have to to his with ios5.1. How can I solve this problem?
    2. I can not send email via Yahoo as usual, Only Safari allow me to it.
    Accordingly, I am writting here to ask for to solve those problems.
    Thanks in advance.

    * Websites remembering you and automatically log you in is stored in a cookie.
    * You need an allow cookie exception (Tools > Options > Privacy > Cookies: Exceptions) to keep that cookie, especially for secure websites and if you let cookies expire when Firefox closes
    * Make sure that you do not use [[Clear Recent History]] to clear the "Cookies" and the "Site Preferences"
    See also http://kb.mozillazine.org/Cookies

  • HT201342 What type of security do the icloud accounts have?

    The same as gmail and yahoo? I am curious if it has anti virus and spam settings comparable to having paid for an email account.
    thanks.

    I do not know if iCloud uses the same type of security as Gmail and Yahoo, but as far as I can tell it accomplishes the same thing.

  • HT201304 Why is it not letting me download free apps on my iPad when ? It's asking for my bank details again and when I type my security number in its says its been declined from a previous purchase? Can u help me pls!

    Why is t not letting me download free apps on my iPad when it's asking for my security number and when I type it in my details on my iCloud account it's saying its been declined and asking for another payment card ? Can some1 help me pls!!

    You will need to contact iTunes support to get that sorted out: http://www.apple.com/support/itunes/contact/

  • Is there any way to change what type of security on the wrt110 router

    i just got a new router and i was trying to connect a laptop to it. but the laptop is so old it can only connect to the wep security and the router has wpa/wpa2 security. does anybody know how to change the security type?
    Message Edited by Diego806 on 07-17-2009 06:51 PM
    Message Edited by Diego806 on 07-17-2009 06:54 PM

    Yes, you can change the Security on your Router -Also change the SSID to avoid extra troubleshooting...
    Open an Internet Explorer browser page on your wired computer(desktop).In the address bar type - 192.168.1.1 and press Enter...Leave username blank & in password use admin in lower case...
    For Wireless Settings, please do the following : -
    Click on the Wireless tab
    - Here select manual configuration...Wireless Network mode should be mixed...
    - Provide a unique name in the Wireless Network Name (SSID) box in order to differentiate your network from your neighbours network...
    - Set the Radio Band to Standard-20MHz and change the Standard channel to 11-2.462GHz...Wireless SSID broadcast should be Enabled and then click on Save Settings...
    Please make a note of Wireless Network Name (SSID) as this is the Network Identifier...
    For Wireless Security : -
    Click on the Sub tab under Wireless > Wireless Security...
    Change the Wireless security mode to WEP, Encryption should be 64 bit.Leave the passphrase blank, don't type in anything...
    Under WEP Key 1 type in any 10 numbers please(numbers only and no letters eg: your 10 digit phone number) and click on save settings...
    Please make a note of WEP Key 1 as this is the Security Key for the Wireless Network...
    Click on Advanced Wireless Settings
    Change the Beacon Interval to 75 >>Change the Fragmentation Threshold to 2304, Change the RTS Threshold to 2304 >>Click on "Save Settings"...
    Now see if you can locate your Wireless Network and attempt to connect...

  • Different Types of Secure Messaging

    There are different variants of Secure Messaging for smart cards. I know there are SM by Global Platforms, ISO 7816 and ICAO. Is the implementation by ISO 7816 same as ICAO SM?

    Not a question. Locking. Will remove tomorrow. If you have a question, ask it, but don't post drivel thanks.

  • I can't see any characters when it asks to type them in for security reasons.

    For example:When I try to buy tickets in Ticketmaster, I can never see the characters to type for security. Same thing when setting up a new Hotmail account. Where do I go to enable the character feature? Is this a Firefox issue or a MAC issue?

    See:
    * http://kb.mozillazine.org/Images_or_animations_do_not_load
    * You can see the permissions for the domain in the current tab in Tools > Page Info > Permissions
    * You can check the exceptions in [http://kb.mozillazine.org/Menu_differences Firefox > Preferences] > Content: Load Images > Exceptions
    * You can check the Tools > Page Info > Media tab for blocked images (scroll through all the images)
    There are also extensions (Tools > Add-ons > Extensions) that can block images.
    See:
    * [[Troubleshooting extensions and themes]]

  • Servicegen:  unable to load type library from classloader weblogic.utils.cl

    Hi,
    I am new to weblogic. I am encountering an error on trying to run the 'servicegen' command from my ant build scripts, on weblogic 9.2.
    Please find the build.xml snapshot, and the stack trace given below.
    Please help me out with this.
    Points to be noted are:-
    1) The ejb-jar.xml specifies the bean class, which is very much present in the classpath. The ejb-jar.xml is generated by xdoclet. Snapshot is given below:-
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE ejb-jar PUBLIC "-//Sun Microsystems, Inc.//DTD Enterprise JavaBeans 2.0//EN" "http://java.sun.com/dtd/ejb-jar_2_0.dtd">
    <ejb-jar >
    <description><![CDATA[No Description.]]></description>
    <display-name>Generated by XDoclet</display-name>
    <enterprise-beans>
    <!-- Session Beans -->
    <session >
    <description><![CDATA[NorthBound Interface]]></description>
    <ejb-name>ArcorNBIService</ejb-name>
    <home>com.alcatel.hdm.arcoril.webservice.ejb.ArcorNBIServiceHome</home>
    <remote>com.alcatel.hdm.arcoril.webservice.ejb.ArcorNBIService</remote>
    <local-home>com.alcatel.hdm.arcoril.webservice.ejb.ArcorNBIServiceLocalHome</local-home>
    <local>com.alcatel.hdm.arcoril.webservice.ejb.ArcorNBIServiceLocal</local>
    <ejb-class>com.alcatel.hdm.arcoril.webservice.ejb.ArcorNBIServiceBean</ejb-class>
    <session-type>Stateless</session-type>
    <transaction-type>Container</transaction-type>
    </session>
    </enterprise-beans>
    </ejb-jar>
    2) When I replace the "ejbJar" attribute in the 'service' command with "javaClassComponents" attribute, I am able to run the servicegen command successfully. Not sure why the ejbJar is creating problems.
    3) Build.xml snapshot:-
         <target name="gen-webservice" depends="init">
              <copy todir="${work.dir}" file="${export.dir}/lib/arcor-il-service-ejb.jar"/>
              <autotype javatypes="${javatypes}" targetNamespace="${targetNamespace}" destDir="${work.dir}/classes" keepGenerated="${keepGenerated}" classpathref="webservice.client.classpath"/>
              <autotype javaComponents="com.alcatel.hdm.arcoril.webservice.ejb.ArcorNBIService" targetNamespace="com.alcatel.hdm.service.nbi.dto.holders" destDir="${work.dir}/classes" keepGenerated="true" classpathref="webservice.client.classpath"/>
              <servicegen destEar="${earfile}" warName="${warname}" contextURI="${contextURI}" keepGenerated="${keepGenerated}" classpathref="webservice.client.classpath">
                   <service ejbJar="${ejbLocation}" targetNamespace="${targetNamespace}" serviceName="${serviceName}" serviceURI="/${serviceName}" generateTypes="false" expandMethods="${expandMethods}" ignoreAuthHeader="false" protocol="https" style="rpc" useSOAP12="${useSOAP12}" typeMappingFile="${work.dir}/classes/types.xml">
                        <security enablePasswordAuth="true"/>
                   </service>
              </servicegen>
         </target>
    4) Exception stacktrace:-
    --- Nested Exception ---
    java.lang.AssertionError: java.io.IOException
    at weblogic.descriptor.DescriptorManager$DefaultMarshallerFactorySingleton.<clinit>(DescriptorManager.java:42)
    at weblogic.descriptor.DescriptorManager.getDefaultMF(DescriptorManager.java:116)
    at weblogic.descriptor.DescriptorManager.getMarshallerFactory(DescriptorManager.java:125)
    at weblogic.descriptor.DescriptorManager.getDescriptorFactory(DescriptorManager.java:153)
    at weblogic.descriptor.DescriptorManager.createDescriptor(DescriptorManager.java:277)
    at weblogic.descriptor.DescriptorManager.createDescriptor(DescriptorManager.java:248)
    at weblogic.descriptor.DescriptorManager.createDescriptor(DescriptorManager.java:309)
    at weblogic.descriptor.EditableDescriptorManager.createDescriptor(EditableDescriptorManager.java:99)
    at weblogic.application.descriptor.AbstractDescriptorLoader.createDescriptor(AbstractDescriptorLoader.java:344)
    at weblogic.application.descriptor.CachingDescriptorLoader.createDescriptor(CachingDescriptorLoader.java:188)
    at weblogic.application.descriptor.AbstractDescriptorLoader.createDescriptor(AbstractDescriptorLoader.java:328)
    at weblogic.application.descriptor.AbstractDescriptorLoader.getDescriptor(AbstractDescriptorLoader.java:237)
    at weblogic.application.descriptor.AbstractDescriptorLoader.getRootDescriptorBean(AbstractDescriptorLoader.java:217)
    at weblogic.ejb.spi.EjbJarDescriptor.getEjbJarBean(EjbJarDescriptor.java:141)
    at weblogic.ejb.spi.EjbJarDescriptor.getEditableEjbJarBean(EjbJarDescriptor.java:182)
    at weblogic.ejb.container.dd.xml.DDUtils.processEjbJarXMLWithSchema(DDUtils.java:519)
    at weblogic.ejb.container.dd.xml.DDUtils.createDescriptorFromJarFile(DDUtils.java:182)
    at weblogic.ejb.container.dd.xml.DDUtils.createDescriptorFromJarFile(DDUtils.java:126)
    at weblogic.ejb.container.dd.xml.DDUtils.createDescriptorFromJarFile(DDUtils.java:154)
    at weblogic.ejb.container.dd.xml.DDUtils.createDescriptorFromJarFile(DDUtils.java:147)
    at weblogic.ejb.spi.DDUtils.createDescriptorFromJarFile(DDUtils.java:30)
    at weblogic.webservice.dd.EJBJarIntrospector.<init>(EJBJarIntrospector.java:52)
    at weblogic.ant.taskdefs.webservices.autotype.EJBAutoTyper.<init>(EJBAutoTyper.java:68)
    at weblogic.ant.taskdefs.webservices.servicegen.ServiceGenTask.runAutoTyper(ServiceGenTask.java:339)
    at weblogic.ant.taskdefs.webservices.servicegen.ServiceGenTask.generateService(ServiceGenTask.java:313)
    at weblogic.ant.taskdefs.webservices.servicegen.ServiceGenTask.execute(ServiceGenTask.java:181)
    at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:275)
    at org.apache.tools.ant.Task.perform(Task.java:364)
    at org.apache.tools.ant.Target.execute(Target.java:341)
    at org.apache.tools.ant.Target.performTasks(Target.java:369)
    at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1216)
    at org.apache.tools.ant.Project.executeTarget(Project.java:1185)
    at org.apache.tools.ant.helper.DefaultExecutor.executeTargets(DefaultExecutor.java:40)
    at org.apache.tools.ant.Project.executeTargets(Project.java:1068)
    at org.apache.tools.ant.Main.runBuild(Main.java:668)
    at org.apache.tools.ant.Main.startAnt(Main.java:187)
    at org.apache.tools.ant.launch.Launcher.run(Launcher.java:246)
    at org.apache.tools.ant.launch.Launcher.main(Launcher.java:67)
    Caused by: java.io.IOException
    at weblogic.descriptor.internal.MarshallerFactory.<init>(MarshallerFactory.java:50)
    at weblogic.descriptor.DescriptorManager$DefaultMarshallerFactorySingleton.<clinit>(DescriptorManager.java:40)
    ... 37 more
    Caused by: com.bea.xml.XmlException: unable to load type library from classloader weblogic.utils.classloaders.ClasspathClassLoader@1cc0a7f f
    inder: weblogic.utils.classloaders.CodeGenClassFinder@c52200 annotation:
    at com.bea.staxb.runtime.internal.BindingContextFactoryImpl.createBindingContext(BindingContextFactoryImpl.java:50)
    at weblogic.descriptor.internal.MarshallerFactory.<init>(MarshallerFactory.java:48)
    ... 38 more
    Total time: 5 seconds

    Hi,
    I am new to weblogic. I am encountering an error on trying to run the 'servicegen' command from my ant build scripts, on weblogic 9.2.
    Please find the build.xml snapshot, and the stack trace given below.
    Please help me out with this.
    Points to be noted are:-
    1) The ejb-jar.xml specifies the bean class, which is very much present in the classpath. The ejb-jar.xml is generated by xdoclet. Snapshot is given below:-
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE ejb-jar PUBLIC "-//Sun Microsystems, Inc.//DTD Enterprise JavaBeans 2.0//EN" "http://java.sun.com/dtd/ejb-jar_2_0.dtd">
    <ejb-jar >
    <description><![CDATA[No Description.]]></description>
    <display-name>Generated by XDoclet</display-name>
    <enterprise-beans>
    <!-- Session Beans -->
    <session >
    <description><![CDATA[NorthBound Interface]]></description>
    <ejb-name>ArcorNBIService</ejb-name>
    <home>com.alcatel.hdm.arcoril.webservice.ejb.ArcorNBIServiceHome</home>
    <remote>com.alcatel.hdm.arcoril.webservice.ejb.ArcorNBIService</remote>
    <local-home>com.alcatel.hdm.arcoril.webservice.ejb.ArcorNBIServiceLocalHome</local-home>
    <local>com.alcatel.hdm.arcoril.webservice.ejb.ArcorNBIServiceLocal</local>
    <ejb-class>com.alcatel.hdm.arcoril.webservice.ejb.ArcorNBIServiceBean</ejb-class>
    <session-type>Stateless</session-type>
    <transaction-type>Container</transaction-type>
    </session>
    </enterprise-beans>
    </ejb-jar>
    2) When I replace the "ejbJar" attribute in the 'service' command with "javaClassComponents" attribute, I am able to run the servicegen command successfully. Not sure why the ejbJar is creating problems.
    3) Build.xml snapshot:-
         <target name="gen-webservice" depends="init">
              <copy todir="${work.dir}" file="${export.dir}/lib/arcor-il-service-ejb.jar"/>
              <autotype javatypes="${javatypes}" targetNamespace="${targetNamespace}" destDir="${work.dir}/classes" keepGenerated="${keepGenerated}" classpathref="webservice.client.classpath"/>
              <autotype javaComponents="com.alcatel.hdm.arcoril.webservice.ejb.ArcorNBIService" targetNamespace="com.alcatel.hdm.service.nbi.dto.holders" destDir="${work.dir}/classes" keepGenerated="true" classpathref="webservice.client.classpath"/>
              <servicegen destEar="${earfile}" warName="${warname}" contextURI="${contextURI}" keepGenerated="${keepGenerated}" classpathref="webservice.client.classpath">
                   <service ejbJar="${ejbLocation}" targetNamespace="${targetNamespace}" serviceName="${serviceName}" serviceURI="/${serviceName}" generateTypes="false" expandMethods="${expandMethods}" ignoreAuthHeader="false" protocol="https" style="rpc" useSOAP12="${useSOAP12}" typeMappingFile="${work.dir}/classes/types.xml">
                        <security enablePasswordAuth="true"/>
                   </service>
              </servicegen>
         </target>
    4) Exception stacktrace:-
    --- Nested Exception ---
    java.lang.AssertionError: java.io.IOException
    at weblogic.descriptor.DescriptorManager$DefaultMarshallerFactorySingleton.<clinit>(DescriptorManager.java:42)
    at weblogic.descriptor.DescriptorManager.getDefaultMF(DescriptorManager.java:116)
    at weblogic.descriptor.DescriptorManager.getMarshallerFactory(DescriptorManager.java:125)
    at weblogic.descriptor.DescriptorManager.getDescriptorFactory(DescriptorManager.java:153)
    at weblogic.descriptor.DescriptorManager.createDescriptor(DescriptorManager.java:277)
    at weblogic.descriptor.DescriptorManager.createDescriptor(DescriptorManager.java:248)
    at weblogic.descriptor.DescriptorManager.createDescriptor(DescriptorManager.java:309)
    at weblogic.descriptor.EditableDescriptorManager.createDescriptor(EditableDescriptorManager.java:99)
    at weblogic.application.descriptor.AbstractDescriptorLoader.createDescriptor(AbstractDescriptorLoader.java:344)
    at weblogic.application.descriptor.CachingDescriptorLoader.createDescriptor(CachingDescriptorLoader.java:188)
    at weblogic.application.descriptor.AbstractDescriptorLoader.createDescriptor(AbstractDescriptorLoader.java:328)
    at weblogic.application.descriptor.AbstractDescriptorLoader.getDescriptor(AbstractDescriptorLoader.java:237)
    at weblogic.application.descriptor.AbstractDescriptorLoader.getRootDescriptorBean(AbstractDescriptorLoader.java:217)
    at weblogic.ejb.spi.EjbJarDescriptor.getEjbJarBean(EjbJarDescriptor.java:141)
    at weblogic.ejb.spi.EjbJarDescriptor.getEditableEjbJarBean(EjbJarDescriptor.java:182)
    at weblogic.ejb.container.dd.xml.DDUtils.processEjbJarXMLWithSchema(DDUtils.java:519)
    at weblogic.ejb.container.dd.xml.DDUtils.createDescriptorFromJarFile(DDUtils.java:182)
    at weblogic.ejb.container.dd.xml.DDUtils.createDescriptorFromJarFile(DDUtils.java:126)
    at weblogic.ejb.container.dd.xml.DDUtils.createDescriptorFromJarFile(DDUtils.java:154)
    at weblogic.ejb.container.dd.xml.DDUtils.createDescriptorFromJarFile(DDUtils.java:147)
    at weblogic.ejb.spi.DDUtils.createDescriptorFromJarFile(DDUtils.java:30)
    at weblogic.webservice.dd.EJBJarIntrospector.<init>(EJBJarIntrospector.java:52)
    at weblogic.ant.taskdefs.webservices.autotype.EJBAutoTyper.<init>(EJBAutoTyper.java:68)
    at weblogic.ant.taskdefs.webservices.servicegen.ServiceGenTask.runAutoTyper(ServiceGenTask.java:339)
    at weblogic.ant.taskdefs.webservices.servicegen.ServiceGenTask.generateService(ServiceGenTask.java:313)
    at weblogic.ant.taskdefs.webservices.servicegen.ServiceGenTask.execute(ServiceGenTask.java:181)
    at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:275)
    at org.apache.tools.ant.Task.perform(Task.java:364)
    at org.apache.tools.ant.Target.execute(Target.java:341)
    at org.apache.tools.ant.Target.performTasks(Target.java:369)
    at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1216)
    at org.apache.tools.ant.Project.executeTarget(Project.java:1185)
    at org.apache.tools.ant.helper.DefaultExecutor.executeTargets(DefaultExecutor.java:40)
    at org.apache.tools.ant.Project.executeTargets(Project.java:1068)
    at org.apache.tools.ant.Main.runBuild(Main.java:668)
    at org.apache.tools.ant.Main.startAnt(Main.java:187)
    at org.apache.tools.ant.launch.Launcher.run(Launcher.java:246)
    at org.apache.tools.ant.launch.Launcher.main(Launcher.java:67)
    Caused by: java.io.IOException
    at weblogic.descriptor.internal.MarshallerFactory.<init>(MarshallerFactory.java:50)
    at weblogic.descriptor.DescriptorManager$DefaultMarshallerFactorySingleton.<clinit>(DescriptorManager.java:40)
    ... 37 more
    Caused by: com.bea.xml.XmlException: unable to load type library from classloader weblogic.utils.classloaders.ClasspathClassLoader@1cc0a7f f
    inder: weblogic.utils.classloaders.CodeGenClassFinder@c52200 annotation:
    at com.bea.staxb.runtime.internal.BindingContextFactoryImpl.createBindingContext(BindingContextFactoryImpl.java:50)
    at weblogic.descriptor.internal.MarshallerFactory.<init>(MarshallerFactory.java:48)
    ... 38 more
    Total time: 5 seconds

  • Using container managed form-based security in JSF

    h1. Using container managed, form-based security in a JSF web app.
    A Practical Solution
    h2. {color:#993300}*But first, some background on the problem*{color}
    The Form components available in JSF will not let you specify the target action, everything is a post-back. When using container security, however, you have to specifically submit to the magic action j_security_check to trigger authentication. This means that the only way to do this in a JSF page is to use an HTML form tag enclosed in verbatim tags. This has the side effect that the post is not handled by JSF at all meaning you can't take advantage of normal JSF functionality such as validators, plus you have a horrible chimera of a page containing both markup and components. This screws up things like skinning. ([credit to Duncan Mills in this 2 years old article|http://groundside.com/blog/DuncanMills.php?title=j2ee_security_a_jsf_based_login_form&more=1&c=1&tb=1&pb=1]).
    In this solution, I will use a pure JSF page as the login page that the end user interacts with. This page will simply gather the input for the username and password and pass that on to a plain old jsp proxy to do the actual submit. This will avoid the whole problem of having to use verbatim tags or a mixture of JSF and JSP in the user view.
    h2. {color:#993300}*Step 1: Configure the Security Realm in the Web App Container*{color}
    What is a container? A container is basically a security framework that is implemented directly by whatever app server you are running, in my case Glassfish v2ur2 that comes with Netbeans 6.1. Your container can have multiple security realms. Each realm manages a definition of the security "*principles*" that are defined to interact with your application. A security principle is basically just a user of the system that is defined by three fields:
    - Username
    - Group
    - Password
    The security realm can be set up to authenticate using a simple file, or through JDBC, or LDAP, and more. In my case, I am using a "file" based realm. The users are statically defined directly through the app server interface. Here's how to do it (on Glassfish):
    1. Start up your app server and log into the admin interface (http://localhost:4848)
    2. Drill down into Configuration > Security > Realms.
    3. Here you will see the default realms defined on the server. Drill down into the file realm.
    4. There is no need to change any of the default settings. Click the Manage Users button.
    5. Create a new user by entering username/password.
    Note: If you enter a group name then you will be able to define permissions based on group in your app, which is much more usefull in a real app.
    I entered a group named "Users" since my app will only have one set of permissions and all users should be authenticated and treated the same.
    That way I will be able to set permissions to resources for the "Users" group that will apply to all users that have this group assigned.
    TIP: After you get everything working, you can hook it all up to JDBC instead of "file" so that you can manage your users in a database.
    h2. {color:#993300}*Step 2: Create the project*{color}
    Since I'm a newbie to JSF, I am using Netbeans 6.1 so that I can play around with all of the fancy Visual Web JavaServer Faces components and the visual designer.
    1. Start by creating a new Visual Web JSF project.
    2. Next, create a new subfolder under your web root called "secure". This is the folder that we will define a Security Constraint for in a later step, so that any user trying to access any page in this folder will be redirected to a login page to sign in, if they haven't already.
    h2. {color:#993300}*Step 3: Create the JSF and JSP files*{color}
    In my very simple project I have 3 pages set up. Create the following files using the default templates in Netbeans 6.1:
    1. login.jsp (A Visual Web JSF file)
    2. loginproxy.jspx (A plain JSPX file)
    3. secure/securepage.jsp (A Visual Web JSF file... Note that it is in the sub-folder named secure)
    Code follows for each of the files:
    h3. {color:#ff6600}*First we need to add a navigation rule to faces-config.xml:*{color}
        <navigation-rule>
    <from-view-id>/login.jsp</from-view-id>
            <navigation-case>
    <from-outcome>loginproxy</from-outcome>
    <to-view-id>/loginproxy.jspx</to-view-id>
            </navigation-case>
        </navigation-rule>
    NOTE: This navigation rule simply forwards the request to loginproxy.jspx whenever the user clicks the submit button. The button1_action() method below returns the "loginproxy" case to make this happen.
    h3. {color:#ff6600}*login.jsp -- A very simple Visual Web JSF file with two input fields and a button:*{color}
    <?xml version="1.0" encoding="UTF-8"?>
    <jsp:root version="2.1"
    xmlns:f="http://java.sun.com/jsf/core"
    xmlns:h="http://java.sun.com/jsf/html"
    xmlns:jsp="http://java.sun.com/JSP/Page"
    xmlns:webuijsf="http://www.sun.com/webui/webuijsf">
        <jsp:directive.page
    contentType="text/html;charset=UTF-8"
    pageEncoding="UTF-8"/>
        <f:view>
            <webuijsf:page
    id="page1">
    <webuijsf:html id="html1">
    <webuijsf:head id="head1">
    <webuijsf:link id="link1"
    url="/resources/stylesheet.css"/>
    </webuijsf:head>
    <webuijsf:body id="body1" style="-rave-layout: grid">
    <webuijsf:form id="form1">
    <webuijsf:textField binding="#{login.username}"
    id="username" style="position: absolute; left: 216px; top:
    96px"/>
    <webuijsf:passwordField binding="#{login.password}" id="password"
    style="left: 216px; top: 144px; position: absolute"/>
    <webuijsf:button actionExpression="#{login.button1_action}"
    id="button1" style="position: absolute; left: 216px; top:
    216px" text="GO"/>
    </webuijsf:form>
    </webuijsf:body>
    </webuijsf:html>
            </webuijsf:page>
        </f:view>
    </jsp:root>h3. *login.java -- implent the
    button1_action() method in the login.java backing bean*
        public String button1_action() {
            setValue("#{requestScope.username}",
    (String)username.getValue());
    setValue("#{requestScope.password}", (String)password.getValue());
            return "loginproxy";
        }h3. {color:#ff6600}*loginproxy.jspx -- a login proxy that the user never sees. The onload="document.forms[0].submit()" automatically submits the form as soon as it is rendered in the browser.*{color}
    {code}
    <?xml version="1.0" encoding="UTF-8"?>
    <jsp:root xmlns:jsp="http://java.sun.com/JSP/Page"
    version="2.0">
    <jsp:output omit-xml-declaration="true" doctype-root-element="HTML"
    doctype-system="http://www.w3.org/TR/html4/loose.dtd"
    doctype-public="-W3CDTD HTML 4.01 Transitional//EN"/>
    <jsp:directive.page contentType="text/html"
    pageEncoding="UTF-8"/>
    <html>
    <head> <meta
    http-equiv="Content-Type" content="text/html;
    charset=UTF-8"/>
    <title>Logging in...</title>
    </head>
    <body
    onload="document.forms[0].submit()">
    <form
    action="j_security_check" method="POST">
    <input type="hidden" name="j_username"
    value="${requestScope.username}" />
    <input type="hidden" name="j_password"
    value="${requestScope.password}" />
    </form>
    </body>
    </html>
    </jsp:root>
    {code}
    h3. {color:#ff6600}*secure/securepage.jsp -- A simple JSF{color}
    target page, placed in the secure folder to test access*
    {code}
    <?xml version="1.0" encoding="UTF-8"?>
    <jsp:root version="2.1"
    xmlns:f="http://java.sun.com/jsf/core"
    xmlns:h="http://java.sun.com/jsf/html"
    xmlns:jsp="http://java.sun.com/JSP/Page" xmlns:webuijsf="http://www.sun.com/webui/webuijsf">
    <jsp:directive.page
    contentType="text/html;charset=UTF-8"
    pageEncoding="UTF-8"/>
    <f:view>
    <webuijsf:page
    id="page1">
    <webuijsf:html id="html1">
    <webuijsf:head id="head1">
    <webuijsf:link id="link1"
    url="/resources/stylesheet.css"/>
    </webuijsf:head>
    <webuijsf:body id="body1" style="-rave-layout: grid">
    <webuijsf:form id="form1">
    <webuijsf:staticText id="staticText1" style="position:
    absolute; left: 168px; top: 144px" text="A Secure Page"/>
    </webuijsf:form>
    </webuijsf:body>
    </webuijsf:html>
    </webuijsf:page>
    </f:view>
    </jsp:root>
    {code}
    h2. {color:#993300}*_Step 4: Configure Declarative Security_*{color}
    This type of security is called +declarative+ because it is not configured programatically. It is configured by declaring all of the relevant parameters in the configuration files: *web.xml* and *sun-web.xml*. Once you have it configured, the container (application server and java framework) already have the implementation to make everything work for you.
    *web.xml will be used to define:*
    - Type of security - We will be using "form based". The loginpage.jsp we created will be set as both the login and error page.
    - Security Roles - The security role defined here will be mapped (in sun-web.xml) to users or groups.
    - Security Constraints - A security constraint defines the resource(s) that is being secured, and which Roles are able to authenticate to them.
    *sun-web.xml will be used to define:*
    - This is where you map a Role to the Users or Groups that are allowed to use it.
    +I know this is confusing the first time, but basically it works like this:+
    *Security Constraint for a URL* -> mapped to -> *Role* -> mapped to -> *Users & Groups*
    h3. {color:#ff6600}*web.xml -- here's the relevant section:*{color}
    {code}
    <security-constraint>
    <display-name>SecurityConstraint</display-name>
    <web-resource-collection>
    <web-resource-name>SecurePages</web-resource-name>
    <description/>
    <url-pattern>/faces/secure/*</url-pattern>
    <http-method>GET</http-method>
    <http-method>POST</http-method>
    <http-method>HEAD</http-method>
    <http-method>PUT</http-method>
    <http-method>OPTIONS</http-method>
    <http-method>TRACE</http-method>
    <http-method>DELETE</http-method>
    </web-resource-collection>
    <auth-constraint>
    <description/>
    <role-name>User</role-name>
    </auth-constraint>
    </security-constraint>
    <login-config>
    <auth-method>FORM</auth-method>
    <realm-name/>
    <form-login-config>
    <form-login-page>/faces/login.jsp</form-login-page>
    <form-error-page>/faces/login.jsp</form-error-page>
    </form-login-config>
    </login-config>
    <security-role>
    <description/>
    <role-name>User</role-name>
    </security-role>
    {code}
    h3. {color:#ff6600}*sun-web.xml -- here's the relevant section:*{color}
    {code}
    <security-role-mapping>
    <role-name>User</role-name>
    <group-name>Users</group-name>
    </security-role-mapping>
    {code}
    h3. {color:#ff6600}*Almost done!!!*{color}
    h2. {color:#993300}*_Step 5: A couple of minor "Gotcha's"_ *{color}
    h3. {color:#ff6600}*_Gotcha #1_*{color}
    You need to configure the "welcome page" in web.xml to point to faces/secure/securepage.jsp ... Note that there is *_no_* leading / ... If you put a / in there it will barf all over itself .
    h3. {color:#ff6600}*_Gotcha #2_*{color}
    Note that we set the <form-login-page> in web.xml to /faces/login.jsp ... Note the leading / ... This time, you NEED the leading slash, or the server will gag.
    *DONE!!!*
    h2. {color:#993300}*_Here's how it works:_*{color}
    1. The user requests the a page from your context (http://localhost/MyLogin/)
    2. The servlet forwards the request to the welcome page: faces/secure/securepage.jsp
    3. faces/secure/securepage.jsp has a security constraint defined, so the servlet checks to see if the user is authenticated for the session.
    4. Of course the user is not authenticated since this is the first request, so the servlet forwards the request to the login page we configured in web.xml (/faces/login.jsp).
    5. The user enters username and password and clicks a button to submit.
    6. The button's action method stores away the username and password in the request scope.
    7. The button returns "loginproxy" navigation case which tells the navigation handler to forward the request to loginproxy.jspx
    8. loginproxy.jspx renders a blank page to the user which has hidden username and password fields.
    9. The hidden username and password fields grab the username and password variables from the request scope.
    10. The loginproxy page is automatically submitted with the magic action "j_security_check"
    11. j_security_check notifies the container that authentication needs to be intercepted and handled.
    12. The container authenticates the user credentials.
    13. If the credentials fail, the container forwards the request to the login.jsp page.
    14. If the credentials pass, the container forwards the request to *+the last protected resource that was attempted.+*
    +Note the last point! I don't know how, but no matter how many times you fail authentication, the container remembers the last page that triggered authentication and once you finally succeed the container forwards your request there!!!!+
    +The user is now at the secure welcome page.+
    If you have read this far, I thank you for your time, and I seriously question your ability to ration your time pragmatically.
    Kerry Randolph

    If you want login security on your web app, this is one way to do it. (the easiest way i have seen).
    This method allows you to create a custom login form and error page using JSF.
    The container handles the actual authentication and protection of the resources based on what you declare in web.xml and sun-web.xml.
    This example uses a statically defined user/password, stored in a file, but you can also configure JDBC realm in Glassfish, so that that users can register for access and your program can store the username/passwrod in a database.
    I'm new to programming, so none of this may be a good practice, or may not be secure at all.
    I really don't know what I'm doing, but I'm learning, and this has been the easiest way that I have found to add authentication to a web app, without having to write the login modules yourself.
    Another benefit, and I think this is key ***You don't have to include any extra code in the pages that you want to protect*** The container manages this for you, based on the constraints you declare in web.xml.
    So basically you set it up to protect certain folders, then when any user tries to access pages in that folder, they are required to authenticate.
    --Kerry                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   

  • Security when wireless and how to do wi-fi on an iPod Touch

    Please be patient with me. I'm new at this and not very tech savvy. My husband and I have been thinking about buying an iPod Touch. I am not at all interested in having an iPhone (We have a Track Phone which I barely use and barely know how to use beyond making a call.) Two things I would like help understanding before we lay out all this money.
    1) What are the security issues when trying to do email from a wi-fi hot spot? How easy is it for someone to capture my 'signal' and get information from me (like passwords etc.)?
    2) How easy is it to actually make a connection from a wi-fi hot spot? I read that there are certain businesses like MacDonalds that have free wi-fi connections. I thought it would be handy to have an iPod touch when we are traveling, especially for the maps and the internet. I want to know what you have to do to actually get connected from one of these hot spots.
    Thanks for your help.

    1. As long as you use a email account, or web page who's servers use ssl encryption, then your information is as safe as it ever was.
    2. Fairly easy to make a connection, as long as you are familiar with wifi and its settings. I say this because if you plan on using different access points, with different types of security on them, and different setups, you are bound to run into problems. I say you meaning "you", being that you aren't very tech savvy. This device is primarily a music/video player that has some nice additions. I would not rely on having maps or internet when you want/need them on the premise of finding a random free wifi hotspot.

  • How to disable the annoying security warning for all users in Windows Server 2008 R2

    Hi,
    The employees from the administration complain all the time about the different types of security warning that they get when trying to run some applications which are used frequently.
    Since the number of the users is too big it is unfeasible to go through all the users and disable the User Access Control at their account settings.
    Is it possible to achieve this through given account policy settings. I want to perform the changes on the server so it applies to *all* (or maybe those of Administration department) users.
    One useful information here can be the following: we use 2 different severs, the application which cause the errors are in the terminal server, and the users are in the main server. Where should I perform the changes?
    Best,
    D

    Hiya,
    It could sound like that one indeed. There are a few options to go for, however it should be fairly easy to find out :)
    Create a test GPO and apply to a limited amount of users. GPUpdate and verify that the GPO has been applied using rsop.msc
    Then open the application to test and see if it has the desired effect. You might need to change more than one setting, depending on the application and desired behavior.

  • How can you maintain security settings with the pornographic sites are already on your computer and an 8 year old is using it. Please contact me and tell me ho

    My 8 yr old granddaughter uses this computer and while I was looking for a way to get rid of yahoo after deciding to dump Firefox because it is constantly quiting I was in the registry and found Yahoo in an area that is filled with pornographic sites. Not knowing how to get rid of this site I deleted the entire section. Looking at your browser doesn't do anything to address this problem and I WILL NOT use a web browser that does not have some type of security for sites that I DON'T WANT MY 8 YR OLD GDAUGHTER LOOKING AT! So buck up and get it done to prevent this.

    See:
    * https://support.mozilla.org/kb/Parental+controls
    * http://kb.mozillazine.org/Parental_controls

  • Java Security Model: Java Protection Domains

    1.     Policy Configuration
    Until now, security policy was hard-coded in the security manager used by Java applications. This gives us the effective but rigid Java sandbox for applets.A major enhancement to the Java sandbox is the separation of policy from mechanism. Policy is now expressed in a separate, persistent format. The policy is represented in simple ascii, and can be modified and displayed by any tools that support the policy syntax specification. This allows:
    o     Configurable policies -- no longer is the security policy hard-coded into the application.
    o     Flexible policies -- Since the policy is configurable, system administrators can enforce global polices for the enterprise. If permitted by the enterprise's global policy, end-users can refine the policy for their desktop.
    o     Fine-grain policies -- The policy configuration file uses a simple, extensible syntax that allows you to specify access on specific files or to particular network hosts. Access to resources can be granted only to code signed by trusted principals.
    o     Application policies -- The sandbox is generalized so that applications of any stripe can use the policy mechanism. Previously, to establish a security policy for an application, an developer needed to implement a subclass of the SecurityManager, and hard-code the application's policies in that subclass. Now, the application can make use of the policy file and the extensible Permission object to build an application whose policy is separate from the implementation of the application.
    o     Extensible policies -- Application developers can choose to define new resource types that require fine-grain access control. They need only define a new Permission object and a method that the system invokes to make access decisions. The policy configuration file and policy tools automatically support application-defined permissions. For example, an application could define a CheckBook object and a CheckBookPermission.
    2.     X.509v3 Certificate APIs
    Public-key cryptography is an effective tool for associating an identity with a piece of code. JavaSoft is introducing API support in the core APIs for X.509v3 certificates. This allows system administrators to use certificates from enterprise Certificate Authorities (CAs), as well as trusted third-party CAs, to cryptographically establish identities.
    3.     Protection Domains
    The central architectural feature of the Java security model is its concept of a Protection Domain. The Java sandbox is an example of a Protection Domain that places tight controls around the execution of downloaded code. This concept is generalized so that each Java class executes within one and only one Protection Domain, with associated permissions.
    When code is loaded, its Protection Domain comes into existence. The Protection Domain has two attributes - a signer and a location. The signer could be null if the code is not signed by anyone. The location is the URL where the Java classes reside. The system consults the global policy on behalf of the new Protection Domain. It derives the set of permissions for the Protection Domain based on its signer/location attributes. Those permissions are put into the Protection Domain's bag of permissions.
    4.     Access Decisions
    Access decisions are straightforward. When code tries to access a protected resource, it creates an access request. If the request matches a permission contained in the bag of permissions, then access is granted. Otherwise, access is denied. This simple way of making access decisions extends easily to application-defined resources and access control. For example, the banking application allows access to the CheckBook only when the executing code holds the appropriate CheckBookPermission.
    Sandbox model for Security
    Java is supported in applications and applets, small programs that spurred Java's early growth and are executable in a browser environment. The applet code is downloaded at runtime and executes in the context of a JVM hosted by the browser. An applet's code can be downloaded from anywhere in the network, so Java's early designers thought such code should not be given unlimited access to the target system. That led to the sandbox model -- the security model introduced with JDK 1.0.
    The sandbox model deems all code downloaded from the network untrustworthy, and confines the code to a limited area of the browser -- the sandbox. For instance, code downloaded from the network could not update the local file system. It's probably more accurate to call this a "fenced-in" model, since a sandbox does not connote strict confinement.
    While this may seem a very secure approach, there are inherent problems. First, it dictates a rigid policy that is closely tied to the implementation. Second, it's seldom a good idea to put all one's eggs in one basket -- that is, it's unwise to rely entirely on one approach to provide overall system security.
    Security needs to be layered for depth of defense and flexible enough to accommodate different policies -- the sandbox model is neither.
    java.security.ProtectionDomain
    This class represents a unit of protection within the Java application environment, and is typically associated with a concept of "principal," where a principal is an entity in the computer system to which permissions (and as a result, accountability) are granted.
    A domain conceptually encloses a set of classes whose instances are granted the same set of permissions. Currently, a domain is uniquely identified by a CodeSource, which encapsulates two characteristics of the code running inside the domain: the codebase (java.net.URL), and a set of certificates (of type java.security.cert.Certificate) for public keys that correspond to the private keys that signed all code in this domain. Thus, classes signed by the same keys and from the same URL are placed in the same domain.
    A domain also encompasses the permissions granted to code in the domain, as determined by the security policy currently in effect.
    Classes that have the same permissions but are from different code sources belong to different domains.
    A class belongs to one and only one ProtectionDomain.
    Note that currently in Java 2 SDK, v 1.2, protection domains are created "on demand" as a result of class loading. The getProtectionDomain method in java.lang.Class can be used to look up the protection domain that is associated with a given class. Note that one must have the appropriate permission (the RuntimePermission "getProtectionDomain") to successfully invoke this method.
    Today all code shipped as part of the Java 2 SDK is considered system code and run inside the unique system domain. Each applet or application runs in its appropriate domain, determined by its code source.
    It is possible to ensure that objects in any non-system domain cannot automatically discover objects in another non-system domain. This partition can be achieved by careful class resolution and loading, for example, using different classloaders for different domains. However, SecureClassLoader (or its subclasses) can, at its choice, load classes from different domains, thus allowing these classes to co-exist within the same name space (as partitioned by a classloader).
    jarsigner and keytool
    example : cd D:\EicherProject\EicherWEB\Web Content jarsigner -keystore eicher.store source.jar eichercert
    The javakey tool from JDK 1.1 has been replaced by two tools in Java 2.
    One tool manages keys and certificates in a database. The other is responsible for signing and verifying JAR files. Both tools require access to a keystore that contains certificate and key information to operate. The keystore replaces the identitydb.obj from JDK 1.1. New to Java 2 is the notion of policy, which controls what resources applets are granted access to outside of the sandbox (see Chapter 3).
    The javakey replacement tools are both command-line driven, and neither requires the use of the awkward directive files required in JDK 1.1.x. Management of keystores, and the generation of keys and certificates, is carried out by keytool. jarsigner uses certificates to sign JAR files and to verify the signatures found on signed JAR files.
    Here we list simple steps of doing the signing. We assume that JDK 1.3 is installed and the tools jarsigner and keytool that are part of JDK are in the execution PATH. Following are Unix commands, however with proper changes, these could be used in Windows as well.
    1. First generate a key pair for our Certificate:
    keytool -genkey -keyalg rsa -alias AppletCert
    2. Generate a certification-signing request.
    keytool -certreq -alias AppletCert > CertReq.pem
    3. Send this CertReq.pem to VeriSign/Thawte webform. Let the signed reply from them be SignedCert.pem.
    4. Import the chain into keystore:
    keytool -import -alias AppletCert -file SignedCert.pem
    5. Sign the CyberVote archive �TeleVote.jar�:
    jarsigner TeleVote.jar AppletCert
    This signed applet TeleVote.jar can now be made available to the web server. For testing purpose we can have our own test root CA. Following are the steps to generate a root CA by using openssl.
    1. Generate a key pair for root CA:
    openssl genrsa -des3 -out CyberVoteCA.key 1024
    2. Generate an x509 certificate using the above keypair:
    openssl req -new -x509 -days key CyberVoteCA.key -out CyberVoteCA.crt
    3. Import the Certificate to keystore.
    keytool -import -alias CyberVoteRoot -file CyberVoteCA.crt
    Now, in the step 3 of jar signing above, instead of sending the request certificate to VeriSign/Thawte webform for signing, we 365 - can sign using our newly created root CA using this command:
    openssl x509 -req -CA CyberVoteCA.crt -CAkey CyberVoteCA.key -days 365 -in CertReq.pem -out SignedCert.pem �Cacreateserial
    However, our test root CA has to be imported to the keystore of voter�s web browser in some way. [This was not investigated. We used some manual importing procedure which is not recommended way]
    The Important Classes
    The MessageDigest class, which is used in current CyberVote mockup system (see section 2), is an engine class designed to provide the functionality of cryptographically secure message digests such as SHA-1 or MD5. A cryptographically secure message digest takes arbitrary-sized input (a byte array), and generates a fixed-size output, called a digest or hash. A digest has the following properties:
    � It should be computationally infeasible to find two messages that hashed to the same value.
    � The digest does not reveal anything about the input that was used to generate it.
    Message digests are used to produce unique and reliable identifiers of data. They are sometimes called the "digital fingerprints" of data.
    The (Digital)Signature class is an engine class designed to provide the functionality of a cryptographic digital signature algorithm such as DSA or RSA with MD5. A cryptographically secure signature algorithm takes arbitrary-sized input and a private key and generates a relatively short (often fixed-size) string of bytes, called the signature, with the following properties:
    � Given the public key corresponding to the private key used to generate the signature, it should be possible to verify the authenticity and integrity of the input.
    � The signature and the public key do not reveal anything about the private key.
    A Signature object can be used to sign data. It can also be used to verify whether or not an alleged signature is in fact the authentic signature of the data associated with it.
    ----Cheers
    ---- Dinesh Vishwakarma

    Hi,
    these concepts are used and implemented in jGuard(www.jguard.net) which enable easy JAAS integration into j2ee webapps across application servers.
    cheers,
    Charles(jGuard team).

Maybe you are looking for

  • Found iLife loop in a real Song

    Hi i used an ilife loop in one of my Videos and i found out now that this loop is part of a real song. Its about the stepping out medium.caf from ilife an this the song Lori Jenaire Stay Strong from the album Fruition https://itunes.apple.com/de/albu

  • Transfer Adobe Programs to Another Computer

    I bought Photoshop CS6 in high school and Illustrator CS6 in college and installed it on my old laptop which had Windows 7. I got a new laptop with Windows 8 and don't have the income to pay for the Cloud. If I uninstall both programs on my old lapto

  • Installed JDK but still error message when running java class

    Hello Can you please help me somebody? I installed everything how it was in the book. So I created my first script. I ran "javac HelloUser.java" which created the class. And then when I want to run the "java HelloUser " I always get this message: exe

  • Error -8 - There was a communication error....

    Hi Trying to set up ichat for my Dad (My ichat set up with out a problem). I have been trying to get my own answer from reading the forum - but I am not making any progress... I think that i turned the firewall on??? Following is the error log... I w

  • Does a DSL really need a ISP?

    I have a Login/pass for Qwest and for MSN. Do I need MSN to access the net? I've only logged in once on MSN during setup. My modem uses the qwest login to connect not MSN's. I would like to drop MSN to save a few $$.