Friday, March 9, 2012

EJBCA 5.0.4 released

We have released EJBCA 5.0.4 to our customers. This is a release that is delivered for, hopefully, final evaluation for Common Criteria EAL 4+. We keep our fingers crossed.

A few new minor features was also added during the development phase. These are customer requested OCSP features and a few usability improvement found during customer installations.

This is a maintenance release with a few bug fixes and new features. In all, 20 issues have been resolved.

Noteworthy changes:
  • OCSP: Possibility to only publish revoked certificates to Validation Authority.
  • OCSP: Possibility to treat "non existing is good" based on URI on the Validation Authority.
  • Do not allow creation of CAs using weak keys.
  • Add Kerberos extended key usages.
  • Add possibility to specify certificate profile to CA init CLI command.
  • Fix a few more tests on windows platform.
  • Fixed minor security issues in admin web.
  • Fixed a few cosmetic issues improving usability.

EJBCA 5.0.x, being a certified version, is not available for free download on the internet, as previous version has always been. Contact PrimeKey if you want access to EJBCA 5.0.

Saturday, February 11, 2012

Ubuntu GNU/Linux 12.04 (precise) on Sony Vaio SE15 (VPCSE1v9E)

Ubuntu GNU/Linux 12.04 (precise) on Sony Vaio SE15 (VPCSE1v9E), SandyBridge version.

Update 2013: This machine has very poor build quality. If you use it daily it will start falling apart after a year or so of use. Don't buy.

The findings here are not my own. All credits goes to the authors in the Ubuntu forums on vaio S compatibility.

Update Ubuntu 13.10:
Using Ubuntu 13.10  by now, and everything works basically flawless. Still starting to look for a new machine though, as the quality of this one is not so good. Casting eyes on the new Dell XP13 DE, with Linux pre-installed...

Update Ubuntu 12.10:
Using Ubuntu 12.10 I have changed my approach a little bit.
  • Use hacked BIOS with advanced menus. This enables me to permanently disable the Radeon in BIOS. Otherwise it will be re-activated after suspend/resume so power consumption will be high after resume.
  • Use the powersavings script below.
  • Use Kernel 3.7 from Ubuntu Mainline. This have some new power saving improvement.

With the above I can really get 4+ hours out of the battery, stable through suspend/resume cycles.

Update Ubuntu 12.04: In Ubuntu 12.04 no kernel parameters are needed. ASPM does not seem to work anyhow and the i915 parameters are enabled by default in the kernel.
I have also found a weak point of the laptop. The air intake fr cooling is located under the machine, exactly where your leg is if you have the laptop in your lap. When blocking the air intake with your leg the machine overheats and throttles the CPU to a crawl.

The Vaio SE15 is a very nice machine. It is easy to replace an existing HDD with an
SSD, it is very light and has good screen and keyboard.
Installing Ubuntu 12.04, precise pangolin from USB works like a charm, no issues.
Update: Due to inadequate cooling I would not buy this machine again. Extremely nice chassis, but overheats and throttles the CPU very easily.

I used the alternate installer in order to get full disk encryption. The alternate installer completed without any glitches, and boots me directly into Ubuntu.
A minor gotcha is that most times, but not always, I get a blank screen instead of the boot password screen (to unlock full disk encryption). It is not hung though, so just enter your password in the blank screen and it boots.

Using 12.04 everything works out of the box, trackpad (including two finger scrolling), wireless, screen, suspend and resume. I used wired network during install, but connected to wifi ince installed.

Using the Vaio the only thing that needs attention is the switchable graphics, and powersaving features. Powersaving is the area where GNU/Linux, by default, is not as good as the Mac, and requires some technical tweaking.

I use only the Stamina (Integrated Intel graphics) mode of the Vaio, and want Speed (Discrete ATI graphics) to be disabled at all times.
By default the ATI card is powered on even in Stamina mode (the physical switch does not physically power of the ATI graphics), so when booting Ubuntu the first time fans will be always on until you manage to power of the ATI card.

With the settings distilled from Ubuntu forums on vaio S compatibility everything works nice and I get the following results.

Battery drain between 9500 and 12500 mW when idling and doing light work (like writing this). This should give a standard battery life between 4-5 hours using the built in 52170mWh battery.
In reality I am a developer, and with some things open and doing some real work, power consumption is between 15 and 30W, giving battery times of say 2-3 hours.

I also added an instruction how to enable TRIM support if you are using an SSD, and also how to re-enable hibernate in Ubuntu 12.04 (precise).


On to the forum summary of settings.


* 1. Make sure Intel powersaving features are enabled
-----------------------------------------------
sudo vi /etc/default/grub

Add some items to the kernel boot parameters, use the following line

GRUB_CMDLINE_LINUX_DEFAULT="quite splash i915.i915_enable_fbc=1 i915.i915_enable_rc6=1 pcie_aspm=force"

update-grub

pcie_aspm=force does not work btw, if anyone can solve this that would be benefitial. Getting:
"ACPI _OSC control for PCIe not granted, disabling ASPM"
-----------------------------------------------

* 2. Disable (power off) Radeon discrete graphics at all times, and power of bluetooth on boot.
We use vgaswitcheroo for this. It is included by default in Ubuntu 12.04, no need to install anything
We also make sure bluetooth is disabled on boot hrer.

- Power of at boot
sudo vi /etc/rc.local

add the following before 'exit 0'
echo OFF > /sys/kernel/debug/vgaswitcheroo/switch
rfkill block bluetooth


- Install so it runs at resume from suspend
(not sure this is needed, but it does not hurt and does not take ant time)

sudo vi /etc/pm/sleep.d/10_disable_radeon

add the following to the file
#!/bin/sh
# Action script ensures that discrete graphics card is disabled after
# resuming from standby/hibernate
#
#
case "${1}" in
resume|thaw)
echo OFF > /sys/kernel/debug/vgaswitcheroo/switch
;;
esac


sudo chmod +x /etc/pm/sleep.d/10_disable_radeon
-----------------------------------------------


* 3. Add script to enable/disable powersavings in battery vs powered mode
-----------------------------------------------
sudo apt-get install ethtool
sudo vi /etc/pm/power.d/powersavings

add the following to the file

------ Start add from below -----
#!/bin/sh

# Shell script to reduce energy consumption when running battery. Place
# it in /etc/pm/power.d/ and give execution rights.

# This is a modified version of an original script of by Skumpic,
# available here: http://blog.liberailvoip.it/2010/04/27/
# ubuntu-lucid-lynx-acer-aspire-one-impostazioni-ottimizzate-
# autonomia-prestazioni/

# Disable Wake On Lan
ethtool -s eth0 wol d

if on_ac_power; then
# ----- Start AC powered settings #

# Disable laptop mode
echo 0 > /proc/sys/vm/laptop_mode

# Set SATA channel: max performance
for foo in /sys/class/scsi_host/host*/link_power_management_policy;
do echo max_performance > $foo;
done

# Set Max Power for wifi interface
# change value according to your hardware!
iwconfig wlan0 txpower 14   

# Disable wifi power saving
iwconfig wlan0 power off

# CPU Governor: Performance
for foo in /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor;
do echo performance > $foo;
done

# Disabile USB autosuspend
for foo in /sys/bus/usb/devices/*/power/control;
do echo on > $foo;
done

# Disable PCI autosuspend
for foo in /sys/bus/pci/devices/*/power/control;
do echo on > $foo;
done

# Disabile audio_card power saving
echo 0 > /sys/module/snd_hda_intel/parameters/power_save_controller
echo 0 > /sys/module/snd_hda_intel/parameters/power_save

# Set maximum display backlight
echo 15 > /sys/class/backlight/acpi_video0/brightness

# ----- End AC powered settings #

else

# ----- Start battery powered settings #

# Enable Laptop-Mode disk writing
echo 5 > /proc/sys/vm/laptop_mode

# Set SATA channel to power saving
for foo in /sys/class/scsi_host/host*/link_power_management_policy;
do echo min_power > $foo;
done

# Activate wifi power saving
iwconfig wlan0 power timeout 500ms

# Reduce wifi txpower
iwconfig wlan0 txpower 5

# Select Ondemand CPU Governor
for foo in /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor;
do echo ondemand > $foo;
done

# Activate USB autosuspend
echo auto > /sys/bus/usb/devices/1-1.1/power/control # Fingerprint sensor
echo auto > /sys/bus/usb/devices/1-1.3/power/control # Webcam

# Activate PCI autosuspend
for foo in /sys/bus/pci/devices/*/power/control;
do echo auto > $foo;
done

# Activate audio card power saving
# (sounds shorter than 5 seconds will not be played)
echo 5 > /sys/module/snd_hda_intel/parameters/power_save
echo 1 > /sys/module/snd_hda_intel/parameters/power_save_controller

# Set medium display backlight
echo 5 > /sys/class/backlight/acpi_video0/brightness


# ----- End battery powered settings #

fi

----- Stop add above -----

Make executable

sudo chmod +x /etc/pm/power.d/powersavings
-----------------------------------------------

* 4. Enable TRIM on SSD
-----------------------------------------------
(only if using an SSD)

sudo cp /etc/fstab /etc/fstab_bak-notrim
sudo vi /etc/fstab

look for the root partition entry, something like:
/dev/mapper/host-root / ext4 errors=remount-ro

add discard to the parameters, like
/dev/mapper/host-root / ext4 discard,errors=remount-ro

You can also add the noatime parameter to save some disc writes.

Reboot to enable
-----------------------------------------------

* 5. Re-enable hibernate in Ubuntu 12.04 (Precise)
-----------------------------------------------
In Ubuntu 12.04, Precise, Hibernate is not available by default. It is rather easy to enable though.
When enabled, both hibernate and suspend works well on the Vaio.

sudo vi /etc/polkit-1/localauthority/50-local.d/com.ubuntu.desktop.pkla

Add the following (probably creating the file)
[Re-enable hibernate by default]
Identity=unix-user:*
Action=org.freedesktop.upower.hibernate
ResultActive=yes

Credits for this tip goes to
Askubuntu


Reboot to enable
-----------------------------------------------



You can use acpi_call instead of vgaswitcheroo to disable the radeon video card.
acpi_call causes resume to take a long time, so therefore I recommend vgaswitcheroo,
which is also included by default in Ubuntu (12.04).

This is only kept for reference, don't use if you followed the guide above.

* Use acpi_call to turn of ATI card at all times.
-----------------------------------------------
(also disable bluetooth on boot)

- build and test
sudo apt-get install git
git clone https://github.com/mkottman/acpi_call.git
cd acpi_call
make
sudo insmod acpi_call.ko
lspci -vnnn | grep VGA
sudo chmod +x test_off.sh
./test_off.sh
(Trying \_SB.PCI0.PEG0.PEGP._OFF: works!)

- Install
sudo cp acpi_call.ko /lib/modules/`uname -r`/kernel/
sudo depmod
sudo modprobe acpi_call
sudo vi /etc/modules
- add the following after 'lp'
acpi_call

- Make sure it starts
sudo vi /usr/local/bin/radeon_off_sony_sa.sh

add the following to the file
#!/bin/sh
echo "\_SB.PCI0.PEG0.PEGP._OFF" > /proc/acpi/call

sudo chmod +x /usr/local/bin/radeon_off_sony_sa.sh

- Test
sudo /usr/local/bin/radeon_off_sony_sa.sh
sudo cat /proc/acpi/call

- Install so it runs at boot
sudo vi /etc/rc.local

add the following before 'exit 0'
/usr/local/bin/radeon_off_sony_sa.sh
rfkill block bluetooth

- Install so it runs at resume from suspend
(this can make resume be a little slow, with black screen for a few seconds when resuming)

sudo vi /etc/pm/sleep.d/10_disable_radeon

add the following to the file
#!/bin/sh
# Action script ensures that discrete graphics card is disabled after
# resuming from standby/hibernate
#
#
PATH=/usr/local/bin:/bin
case "${1}" in
resume|thaw)
radeon_off_sony_sa.sh
;;
esac

sudo chmod +x /etc/pm/sleep.d/10_disable_radeon
-----------------------------------------------

Wednesday, January 25, 2012

EJBCA 5.0.2 released, delivered for Common Criteria Certification

23 January 2011 - Stockholm, Sweden

Primekey proudly presents the 5.0.2 maintenance release of EJBCA. This release is the candidate for Common Criteria for Information Technology Security Evaluation (Common Criteria) certification, and a majority of the effort for this release has been devoted to addressing issues to meet Common Criteria's exacting standards.

Quite some effort was also put into stabilizing the 5.0.x release for production use, including improvements of performance and usability.

EJBCA 5.0.2 Release Notes

A maintenance release containing a couple of small features and many bug fixes. The following are a selection of the most noteworthy:

  • New features:

    • Support has been added for incorporating external plugins in the EJBCA EAR file at build time, allowing the addition of custom administrative capabilities and specialized RA systems.

  • Bug fixes:

    • The Web interface has been thoroughly audited and cleaned from XSS issues.

    • Authorization checks have tightened up in accordance to Common Criteria demands.

    • Audit logging has been improved and fixed where lacking.

Development continues beyond this version and all requests from the community are scheduled for EJBCA 5.0.3 or later releases.

More information is available at the project web site and the complete change log can be viewed in the issue tracker.


For more information, please contact:

Tomas Gustavsson, CTO, PrimeKey Solutions AB, tel: +46(0)707 42 10 96, e-mail: tomas@primekey.se

PrimeKey Solutions AB

PrimeKey is the world's leading open source PKI (public key infrastructure) company, and founders and commercial force behind some of the most downloaded open source PKI projects – EJBCA and SignServer.

An open source security software pioneer, PrimeKey provides enterprise class solutions to key public and commercial sector clients worldwide. Organizations turn to PrimeKey's open source software platforms to implement security solutions (such as e-passports, product authenticity, document signing, digital signatures, unified digital identities) and their associated high speed and high availability validation.

PrimeKey's enterprise class integration, training and support services and dedication to open standards help customers achieve their organizational goals. www.primekey.se

The EJBCA Project

EJBCA PKI is a Certification Authority and a complete enterprise PKI management system, delivered either as an integrable part or as a turnkey solution. EJBCA OCSP and EAC are sub functions of EJBCA PKI, and are used for on-line validation and ePassports.

EJBCA offers great advantages such as excellent cost-effectiveness, unmatched flexibility, complete integration – and full professional maintenance and support by PrimeKey. www.ejbca.com



Tuesday, December 27, 2011

EJBCA 4.0.7 released

EJBCA PKI 4.0.7 was released as a Christmas gift on the 25th of December 2011.

A maintenance release containing 6 bug fixes and 4 new features or improvements.
New features
  • Documented EJBCA integration with the secure email server Djigzo.
  • Added a plug-in build system.
Bug fixes
  • Fixed an error reading large OCSP requests in some cases.
  • Fixed a few minor XSS issues.
  • Fixed a build issue of the Validation Authority on some platforms.
  • Improved support for Chinese in the admin console.

Development continues beyond this version and all requests from the community are scheduled for EJBCA 4.0.8 or later releases.

More information is available at the project web site and the complete changelog can be viewed in the issue tracker.

Wednesday, December 21, 2011

SignServer 3.2.1 released

SignServer v 3.2.1 was recently released. The server side (PKI) document signature server gained a lot of improvements to PDF digital signing.
Secure PDF documents are a lot more complex than you'd think at first. There are a lot of security options, and several passwords and mechanisms to protect the various security aspects.

Major new features and improvements
  • Improved servlet error handling.

  • Deploy documentation with application.

  • Improved API for archiving.

  • Support for signing PDFs with document restrictions.

  • Support for: PDF permissions enforcement; modification of PDF permissions; setting PDF permission passwords.

  • Refuse to certify PDFs already certified and refuse to sign when signing is not
    allowed.

Bug fixes
  • Remote EJB worker interface could not be used with ECC with explicit parameters.

  • Warnings printed on STDERR.

  • Web service interface did not log XFORWARDEDFOR headers.

  • Typo in sample configuration for PDFSigner.

  • Setting healthcheck properties had no effect.

  • CRL download should close streams correctly and allow for caching.

  • Supplied username and password ignored in SigningAndValidationWS.

  • Unit tests failed in certain situations.

  • Ant target for testing individual tests did not work.

  • Switching application server type did not update jndi.properties.

  • JavaDoc failed to build.

SignServer 3.2.1 is a great tool to digitally sign and secure different types of documents. And of course it integrates well with EJBCA.

Thursday, December 1, 2011

EJBCA - Djigzo integration

The Djigzo email encryption gateway has a new release out with easy integration with EJBCA.

Basically it allows an email encryption gateway to automatically connect to EJBCA for certificate management. This makes it possible for a truly transparent, for users, email encryption solution.

For more info see the Guide at EJBCA.org.

You can also read the full EJBCA Setup Guide over at Djigzo.com.

EJBCA 4.0.6 released

Old news by now, but I'm travelling in Asia...

It is only a minor release, but it's good to have the blog complete :-)

The PrimeKey EJBCA team is happy to announce that EJBCA 4.0.6 has been released! This is a maintenance release — 4 issues have been resolved. The most noteworthy changes can be seen below.
EJBCA 4.0.6 release notes

A maintenance release containing 3 bug fixes and 1 new feature.

New features:
  • CMP, Implement message type KeyUpdateRequest.
Bug fixes:
  • Fixed importing empty CRL via CLI.
  • Fixed minor CMP and XSS issues.

Development continues beyond this version and all requests from the community are scheduled for EJBCA 4.0.7 or later releases.

More information is available at the project web site and the complete changelog can be viewed in the issue tracker.