Java Security Class Couldn't be found - security

When launching my program the next error pops out
java.lang.NoClassDefFoundError: Could not initialize class javax.crypto.SunJCE_b
which means this class is missing although I've found this class manually, works via jar/ide but doesn't works prefectly via service.
Maybe I need to make a few modifications? but which?
Thanks in advance


I don't know if this is relevant to your problem but I was experiencing the exact same behavior due to versions of the JCE Policy files I was using.
Using the proper Unlimited Strength Cryptography Extenstions solved this issue for me. I believe I might have accidentally installed the extensions for Java 7 as opposed to 6. (I was using Java 6 for compilation)
For a windows machine, they should be installed in the jre/lib/security folder of your installed JDK, for example: c:\program files\Java\jdk1.6.0_33\jre\lib\security


The class should be located in the jce.jar file. This has to be on the classpath. Double check your classpath parameters which should be either the -cp parameter if you start the application without the -jar option xor the Class-Path entry in the jars manifest if you use java -jar myapp.jar to start you program
You found a common WTF ;) - that's a widely unknown rule: if you start you app with the -jar option, then the -cp option and the CLASSPATH environment are ignored. Then the classpath must specified inside the Manifest only.
Quick workaround - assuming, you "main class" is named com.example.App, then start the application like this:
java -cp jce.jar com.example.App


We had the permissions of our files only set to be read only by root and gave us a similar error.
Change permissions and things worked!
$ pwd
/usr/lib/jvm/java/jre/lib/security
$ ls -l
total 128
-rw-r--r--. 1 root root 2177 Mar 1 2013 blacklist
-rw-r--r--. 1 root root 84029 Sep 30 18:01 cacerts
-rw-r--r--. 1 root root 2253 Mar 1 2013 java.policy
-rw-r--r--. 1 root root 11804 Mar 1 2013 java.security
-rw-r--r--. 1 root root 109 Mar 1 2013 javaws.policy
-rw-r--r--. 1 root root 2481 Sep 16 16:50 local_policy.jar
-rw-r--r--. 1 root root 0 Mar 1 2013 trusted.libraries
-rw-r--r--. 1 root root 1924 Jul 18 17:42 truststore-epicinterbld.pem
-rw-r--r--. 1 root root 2465 Sep 16 16:50 US_export_policy.jar


Check which jre is being used when you're launching and make sure the jre/lib/ext folder contains sunjce_provider.jar


Make sure you aren't using the extensions directory option. In the past when I used the extensions directory option instead of a classpath it was no longer able to load the Security libraries and policies. When I went back to using an explicit classpath the Security functionality resumed working.


I deleted various older JDKs in /Library/Java/VirtualMachine (got osx) and after restarting android studio the error was gone, but I hat to set the jdk again. Maybe it helps others.


This is issue with the JRE version, it should point to the same jre version as being used by the program, it looks for "jre/lib/security" should be under the same jdk of your program

Related

Tomcat is not getting started: Permission denied

I am getting below error when trying to start the tomcat using systemd service
systemd[1]: tomcat.service: Failed to execute command: Permission denied
systemd[1]: tomcat.service: Failed at step EXEC spawning /opt/tomcat/bin/startup.sh: Permission denied
Below is my tomcat.service configuration
[Unit]
Description=Apache Tomcat Web Application Container
After=syslog.target network.target
[Service]
Type=forking
Environment=JAVA_HOME=/usr/lib/jvm/jre
Environment=CATALINA_PID=/opt/tomcat/temp/tomcat.pid
Environment=CATALINA_HOME=/opt/tomcat
Environment=CATALINA_BASE=/opt/tomcat
Environment='CATALINA_OPTS=-Xms512M -Xmx1024M -server -XX:+UseParallelGC'
Environment='JAVA_OPTS=-Djava.awt.headless=true -Djava.security.egd=file:/dev/./urandom'
ExecStart=/opt/tomcat/bin/startup.sh
ExecStop=/bin/kill -15 $MAINPID
User=tomcat
Group=tomcat
[Install]
WantedBy=multi-user.target
These are my permission on files in the bin directory
drwxrwx---. 2 tomcat tomcat 4096 Mar 22 05:56 .
drwx------. 9 tomcat tomcat 276 Mar 22 05:58 ..
-rw-r-----. 1 tomcat tomcat 35071 Mar 11 09:33 bootstrap.jar
-rw-r-----. 1 tomcat tomcat 15953 Mar 11 09:33 catalina.bat
-rwxr-x--x. 1 tomcat tomcat 23792 Mar 11 09:33 catalina.sh
-rw-r-----. 1 tomcat tomcat 1664 Mar 11 09:36 catalina-tasks.xml
-rw-r-----. 1 tomcat tomcat 2123 Mar 11 09:33 ciphers.bat
-rwxr-x--x. 1 tomcat tomcat 1997 Mar 11 09:33 ciphers.sh
-rw-r-----. 1 tomcat tomcat 25197 Mar 11 09:33 commons-daemon.jar
-rw-r-----. 1 tomcat tomcat 206895 Mar 11 09:33 commons-daemon-native.tar.gz
-rw-r-----. 1 tomcat tomcat 2040 Mar 11 09:33 configtest.bat
-rwxr-x--x. 1 tomcat tomcat 1922 Mar 11 09:33 configtest.sh
-rwxr-x--x. 1 tomcat tomcat 8675 Mar 11 09:33 daemon.sh
-rw-r-----. 1 tomcat tomcat 2091 Mar 11 09:33 digest.bat
-rwxr-x--x. 1 tomcat tomcat 1965 Mar 11 09:33 digest.sh
-rw-r-----. 1 tomcat tomcat 3606 Mar 11 09:33 makebase.bat
-rwxr-x--x. 1 tomcat tomcat 3382 Mar 11 09:33 makebase.sh
-rw-r-----. 1 tomcat tomcat 3460 Mar 11 09:33 setclasspath.bat
-rwxr-x--x. 1 tomcat tomcat 3708 Mar 11 09:33 setclasspath.sh
-rw-r-----. 1 tomcat tomcat 2020 Mar 11 09:33 shutdown.bat
-rwxr-x--x. 1 tomcat tomcat 1902 Mar 11 09:33 shutdown.sh
-rw-r-----. 1 tomcat tomcat 2022 Mar 11 09:33 startup.bat
-rwxr-x--x. 1 tomcat tomcat 1904 Mar 11 09:33 startup.sh
-rw-r-----. 1 tomcat tomcat 49372 Mar 11 09:33 tomcat-juli.jar
-rw-r-----. 1 tomcat tomcat 419428 Mar 11 09:33 tomcat-native.tar.gz
-rw-r-----. 1 tomcat tomcat 4574 Mar 11 09:33 tool-wrapper.bat
NOTE: I am able to start the tomcat using sudo ./startup.sh command by navigating to bin directory

Can you check your /opt and /opt/bin permissions
Looks like
chmod a+rx /opt /opt/tomcat/ /opt/tomcat/bin
should help

I suppose you followed one of the many copied online tutorials where the tomcat user is made with /opt/tomcat/ as its home directory by using something similar like:
sudo useradd -d /opt/tomcat -s /sbin/nologin tomcat
SELinux is preventing applications from being launched from a home directory, with a message like the following in /var/log/audit/audit.log
type=AVC msg=audit(1614250994.710:33614): avc: denied { execute } for pid=60244 comm="(artup.sh)" name="startup.sh" dev="dm-3" ino=19000615 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file permissive=0
I don't believe the tomcat user needs a home folder, so either remove it from an existing user with:
sudo usermod -d / tomcat
Or create your new user with the following instead:
sudo useradd -M -s /sbin/nologin tomcat
Reset the SELinux properties with the following afterwards:
sudo restorecon -rv /opt/tomcat

I encountered same problem and fix it by restorecon.
I don't know if the reason why the problem happened is same as the original question but I think it depends on how to install tomcat.
In general, we download the tar.gz onto a temp directory and tar xzvf at the temp directory. Next, we move it to /opt or /usr/local. At that time, if we use mv, SELinux context is not changed then permission denied happens. But you can change it by restorecon. If we use cp -R, SELinux context is changed then permission denied does not happen.

In case someone follows the google links to get here, there were three problems in my case that prevented Tomcat 9 (installed from TAR file) from starting on a RHEL 8 system that has CIS recommended security lock-downs on it. I think the DoD STIGs are similar, but not sure. I had the exact same messages in the system journal that the OP did.
First, our security folks went overboard and added the "noexec" option to the mount that the Tomcat was on, which is a separate partition and LVM volume for both security and organizational reasons. I had to modify the mount by removing the "noexec" option in the "/etc/fstab" file, to whit:
Before:
/dev/mapper/vg01-mymount /mymount xfs defaults,nodev,noexec 0 0
After:
/dev/mapper/vg01-mymount /mymount xfs defaults,nodev 0 0
Second, I found they had installed the "fapolicyd" daemon, and that acts like an application allow-listing for execution and access to files. Instead of using the standard method of adding individual binaries to a list in "/etc/fapolicyd/fapolicyd.trust", or creating files in "/etc/fapolicyd/trust.d/" directory, I followed recommendations from this reply on a blog entry here:https://computingforgeeks.com/install-apache-tomcat-9-on-linux-rhel-centos/#comment-7841 . This is the coward's way out, by adding all policy permissions for the tomcat user to access the whole tomcat directory, and depending on file-level permissions to do the security from there:
allow perm=any uid=tomcat gid=tomcat : dir=/mymount/tomcat/
I'm not really sure this will pass scrutiny with any security policies where you work, but it gets the thing running. Individual rules for fapolicyd can be made to run specific files, certain MIME types, read-only on whole directories, etc. The major flaw I found is that the logging from the daemon is less than stellar (or non-existent in my case), and left me scratching my head for a couple days as to what was blocking Tomcat starting. Just knowing fapolicyd is installed is half the battle won.
Third, checking SELinux reports (aureport binary) showed that the systemd binary context of "init_t" did not have permission to execute files in the Tomcat dir because they had the wrong context ("default_t"). Here I only changed the context of the script files in /tomcat/bin/ to "initrc_exec_t", which also may be bad, but it worked without disabling SELinux or doing weird things like compile a new SELinux policy file that allowed that access (i.e. allow init_t to execute default_t files, which seems like it would be much worse). I used a similar command set to the below:
semanage fcontext --add --type initrc_exec_t /mymount/tomcat/bin/startup.sh
semanage fcontext --add --type initrc_exec_t /mymount/tomcat/bin/shutdown.sh
semanage fcontext --add --type initrc_exec_t /mymount/tomcat/bin/catalina.sh
semanage fcontext --add --type initrc_exec_t /mymount/tomcat/bin/setclasspath.sh
semanage fcontext --add --type initrc_exec_t /mymount/tomcat/bin/setenv.sh
restorecon -rv /mymount/tomcat/
I don't know if it needed the last three (catalina.sh, setclasspath.sh, setenv.sh), but I added them to be sure. This fixed my issue with systemd.

How to fix SolrException: Error loading solr config?

So, my current setup looks like this:
Solr 4.10.4 with Tomcat7. Solr by itself is woring under localhost:8080/solr but as it wants to create a core it gets the following failure:
SolrCore Initialization Failures
atalanda_development: org.apache.solr.common.SolrException:org.apache.solr.common.SolrException: Could not load conf for core atalanda_development: Error loading solr config from /usr/share/solr/example/solr/development/conf/solrconfig.xml
So the first thought of mine was to check if the file is even there:
ll /usr/share/solr/example/solr/development/conf/solrconfig.xml
-rw-rw-r-- 1 tomcat7 gbeschbacher 71K Mar 16 13:56 /usr/share/solr/example/solr/development/conf/solrconfig.xml
So after this i knew the file was there and tomcat7 has the permission on it. I tried two versions of solrconfig.xml - a default one and a custom one. The error occured with both of these.
My Tomcat7 has the following solr.xml file which is pretty straight forward:
cat /etc/tomcat7/Catalina/localhost/solr.xml
<Context docBase="/usr/share/solr/example/solr/solr.war" debug="0" crossContext="true">
<Environment name="solr/home" type="java.lang.String" value="/usr/share/solr/example/solr" override="true" />
</Context>
All it does it to tell tomcat7 where my docbase and my environment of solr is. For more understanding i show you the folder-structure with the permissions of my usr/share/solr/example/solr folder:
/u/s/s/e/solr ❯❯❯
drwxr-xr-x 2 tomcat7 gbeschbacher 4.0K Sep 8 2014 bin
drwxr-xr-x 3 tomcat7 gbeschbacher 4.0K Mar 18 23:06 collection1
drwxr-xr-x 2 tomcat7 root 4.0K Mar 19 00:53 development
-rw-r--r-- 1 tomcat7 gbeschbacher 2.5K Sep 8 2014 README.txt
-rw-r--r-- 1 tomcat7 gbeschbacher 29M Mar 19 00:13 solr.war
-rw-r--r-- 1 tomcat7 gbeschbacher 333 Mar 19 00:52 solr.xml
-rw-r--r-- 1 tomcat7 gbeschbacher 501 Sep 8 2014 zoo.cfg
In here, the solr.xml contains the following code:
/u/s/s/e/solr ❯❯❯ cat solr.xml
<?xml version="1.0" encoding="UTF-8" ?>
<solr persistent="false">
<cores adminPath="/admin/cores" host="${host:}" hostPort="${jetty.port:}">
<core name="atalanda_development" instanceDir="development" dataDir="development/data"/>
</cores>
</solr>
So, at the moment i really have no clue anymore what i still could try to get my setup to work because i don't know what i am doing wrong in here. Any suggestions or try-out solutions are appreciated even it's only a comment on what i could change.
If someone needs any more information to be able to give some hints, please tell me so and I'll provide it!

IDE crashes daily - is it Ubuntu , is it Android-studio or something else?

--EDIT-- following #siva advice, i switched over to Oracle JDK from OpenJDK.
also updated a bunch of recently added stuff in the SDK 'manager'...
--END EDIT --
At random, UI event in the IDE like ( open edit on android proj file ) results in very long UI freeze then app crash.
Env:
Android studio 1.0 Prod
Ubuntu 12.04 - 3.8.13-03081328-generic
Random crashes ( daily in Android-studio IDE ) that produce large , 'apport' crash dump in :
-rw-r----- 1 rob whoopsie 177030197 Dec 9 20:14 _usr_lib_jvm_java-7-openjdk-amd64_jre_bin_java.1000.crash
NOTE - im still using the 'openJDK' with AS despite the warning in AS about issues with JVM's other than oracle. Maybe , after all this time on ubuntu/OpenjavaJSK , i need to switch JVM's
.
Ubuntu reports a crash dialog error in a pop-up box similar to this one
Pretty sure the abend is within a shared lib in folder:
/home/user/.AndroidStudio/system/tmp/native-platform-nnn-dir/libnative-platform.so
Where to report this?
ubuntu apport crash dump
OR
Android-studio forums
IMO - its within a shared lib installed by the app ( AS ) but i dont see anything in the Android-studio forum space mentioning this type of crash??
PS - what are all these Shared libs under /home/user/.Androidstudio/system/tmp
drwxrwxr-x 2 rob rob 4096 Nov 28 06:56 native-platform2953326984648443135dir
drwxrwxr-x 2 rob rob 4096 Dec 8 18:03 native-platform5404575141685110828dir
drwxrwxr-x 2 rob rob 4096 Dec 5 13:28 native-platform5488604906885341235dir
drwxrwxr-x 2 rob rob 4096 Dec 9 09:29 native-platform5969166866748048826dir
drwxrwxr-x 2 rob rob 4096 Dec 9 20:25 native-platform6032919435567587484dir
drwxrwxr-x 2 rob rob 4096 Dec 2 07:16 native-platform800088999941561401dir

If you are using OpenJDK, switch to Oracle JRE. Put it somewhere and set STUDIO_JDK to point to it.

CentOS and fontconfig: Cannot load default config file

I'm getting following error when using imagick:
Fontconfig error: Cannot load default config file
My script is working but i would like to fix this (is filling up log file).
OS is:
# cat /etc/redhat-release
CentOS release 5.10 (Final)
I was looking trough internet little bit and this is causing problem:
access("/etc/fonts/fonts.conf", R_OK) = -1 ENOENT (No such file or directory)
Folder exists:
# ls /etc/fonts/ -all
total 64
drwxr-xr-x 4 root root 4096 Jul 9 2010 ./
drwxr-xr-x 86 root root 12288 Jan 13 00:48 ../
drwxr-xr-x 2 root root 4096 Jan 3 2012 conf.avail/
drwxr-xr-x 2 root root 4096 Apr 14 2013 conf.d/
-rw-r--r-- 1 root root 5239 Jan 12 2008 fonts.conf
-rw-r--r-- 1 root root 6907 Jan 12 2008 fonts.dtd
But i see only this folder via root account, other account under with script is run doesn't see this folder. Permissions looks fine for me, but not so experienced with linux.
Account under with script is run is created with WHM.
Please help :)

I manage to solve my problem. chroot was making trouble.
I need to:
log with root account
find jailed environment of account on with i run script (in my case /home/virtfs/[username])
to create folder where i will mount real stuff mkdir /home/virtfs/[username]/etc/fonts
to mount /etc/fonts to this folder: mount --bind /etc/fonts /home/virtfs/[username]/etc/fonts

Posting an answer for CentOS 7 in 2021:
yum install fontconfig
More info here:
https://centos.pkgs.org/7/centos-x86_64/fontconfig-2.13.0-4.3.el7.x86_64.rpm.html

Juniper Netscreen Log Files

I am trying to find a way to copy the log files from a Juniper SSG5 so that I can programmatically analyse them.
I know that it is possible to scp files from the Juniper but I have been unable to find where the logs are saved on the device.
Any help on locating these logs (all of them) would be great!

It seems that there is no simple way to access the log files on the Juniper Netscreen however it does provide options for configuring remote logging using syslog.
This can be configured to point to a syslog server on the network which can in turn be configured to log these remote messages to a local file (or pass them on to another syslog server)

show log command will give you filenames.
show log
user#host> show log
total 57518
-rw-r--r-- 1 root bin 211663 Oct 1 19:44 dcd
-rw-r--r-- 1 root bin 999947 Oct 1 19:41 dcd.0
-rw-r--r-- 1 root bin 999994 Oct 1 17:48 dcd.1
-rw-r--r-- 1 root bin 238815 Oct 1 19:44 rpd

Resources