Red Hat CERTIFICATE 7.3 RELEASE NOTES Manuale di istruzioni

Red Hat Certificate

System 7.3

Release Notes

The text of and illustrations in this document are licensed by Red Hat under a Creative

Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation

of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/. In

accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you

must provide the URL for the original version.

Red Hat, as the licensor of this document, waives the right to enforce, and agrees not

to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.

Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora,

the Infinity Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United

States and other countries.

Linux® is the registered trademark of Linus Torvalds in the United States and other

countries.

All other trademarks are the property of their respective owners.

1801 Varsity Drive

Raleigh, NC 27606-2072 USA

Phone: +1 919 754 3700

Phone: 888 733 4281

Fax: +1 919 754 3701

PO Box 13588

Research Triangle Park, NC 27709 USA

April 10, 2010 (update)

1. New Features in Red Hat Certificate System 7.3 ...................................................................... 2

1.1. Registration Authority ................................................................................................... 2

1.2. SCEP .......................................................................................................................... 3

1.3. Auto-enrollment Proxy .................................................................................................. 3

2. Platform Support ..................................................................................................................... 4

2.1. Server Support ............................................................................................................. 4

2.2. Client Support .............................................................................................................. 5

2.3. Other Required Software .............................................................................................. 5

2.4. Optional Server Hardware ............................................................................................ 5

2.5. Optional Client Hardware .............................................................................................. 6

3. Installation and Deployment Notes ........................................................................................... 6

Release Notes

3.1. Obtaining Packages ..................................................................................................... 6

3.2. Installation Notes .......................................................................................................... 6

3.3. Required JRE and JDK ................................................................................................ 7

3.4. TPS Subsystem Considerations .................................................................................... 9

3.5. Directory Server Information ........................................................................................ 10

3.6. Source RPMs ............................................................................................................. 10

4. Known Issues ....................................................................................................................... 10

4.1. Reconfiguring the Red Hat Certificate System Subsystems to Prevent a Potential TLS-

Related Man-in-the-Middle Attack ....................................................................................... 10

4.2. Manually Adding a New Port to the RA ....................................................................... 15

4.3. Viewing Enterprise Security Client Diagnostics Logs ..................................................... 16

4.4. Other Known Issues ................................................................................................... 17

5. Documentation ...................................................................................................................... 19

6. Copyright and Third-Party Acknowledgments ......................................................................... 19

7. Document History ................................................................................................................. 23

These release notes contain important information available at the time of release for Red Hat

Certificate System 7.3. New features, system requirements, installation notes, known problems,

resources, and other current issues are addressed here. Read this document before beginning to use

Red Hat Certificate System.

1. New Features in Red Hat Certificate System 7.3

1.1. Registration Authority

Red Hat Certificate System 7.3 supports a stand-alone Registration Authority (RA), which supports the

automatic issue of certificates to devices and servers.

The RA subsystem is a front-end subsystem to the Certificate Authority (CA), and it performs local

authentication, requestor information gathering and request validation. It is responsibile for fowarding

requests to the CA for signing.

The RA can be configured to authenticate incoming requests, or to route the request to appropriate

personnel for approval before forwarding the request to the CA for certificate creation. The RA is

typically set up outside of the firewall, while the CA is behind the firewall.

1.1.1. Enrollment Types

The RA currently provides the following enrollment types:

• SCEP enrollment

• Server certificate enrollment

• User certificate enrollment and renewal

• RA Agent enrollment

The RA also supports:

• Status checks of Certificate Requests

• Certificate retrieval

SCEP

• Email notification on Certificate Request creation and approval

1.1.2. RA Roles

The RA supports the following roles:

• End Users - people who submit enrollment requests

• RA Agents - privileged RA users who are responsible for daily operation such as request approval

• Administrators - people responsible for installing and configuring the RA. Administrators can also

create new users and assign them as Agents.

1.2. SCEP

SCEP (Simple Certificate Enrollment Protocol) is a protocol designed by Cisco. It specifies a way for

a router to communicate with RAs and CAs for enrollment. Red Hat Certificate System 7.3 enables

routers to enroll for a certificate from an RA using this protocol.

Routers can communicate with the RA using the SCEP protocol to:

• Retrieve CA certificates

• Submit a Certificate Request

• Retrieve the issued certificate

• Submit a status request if the Certificate Request is pending

SCEP specifies two modes of operation:

• RA mode

• CA mode

In RA mode, the enrollment request is encrypted with the RA signing certificate. In CA mode, the

request is encrypted with the CA signing certificate. The current Certificate System RA adn CA

subsystems are implement so that SCEP is only supported in CA mode.

1.3. Auto-enrollment Proxy

Red Hat Certificate System 7.3 supports an auto-enrollment proxy (AEP) for Windows®, which allows

users and computers in a Microsoft Windows® domain to automatically enroll for certificates issued

from Certificate System.

Designed to integrate seamlessly with an existing Windows® infrastructure, the AEP module

minimizes administration overhead:

• Users and computers registered in a Windows® domain can automatically discover the location of

the proxy on their network

• Computers in a domain can automatically compose a certificate request, and submit it to a Red Hat

Certificate System CA via the proxy

• The Kerberos authentication mechanism built into Windows® authenticates these certificate

requests

Release Notes

• When the CA issues a certificate, it is automatically installed into the requesting application

AEP can issue certificates for domain controllers (including backup controllers), web servers,

computers, and users.

For more information about this feature, see http://directory.fedoraproject.org/wiki/

Auto_Enroll_Documentation.

2. Platform Support

This section contains information related to installing Red Hat Certificate System 7.3, including

hardware and platform requirements and prerequisites.

2.1. Server Support

The Certificate System subsystems are supported on the following platforms:

• Red Hat Enterprise Linux AS and ES 4 for i386 AMD and Intel

• Red Hat Enterprise Linux AS and ES 4 for AMD64 and Intel EM64T

• Sun Solaris 9 for SPARC 64-bit

2.1.1. Server Requirements

Component Details

CPU Intel — 2.0 GHz Pentium 4 or faster

RAM 1 GB (required)

Hard disk storage space Total is approximately 5 GB

• Total transient space required during installation: 1 GB

• Hard disk storage space required for installation:

• Space required to set up, configure, and run the server:

approximately 2 GB

• Additional space for database growth in pilot deployment:

approximately 1 GB

• Total disk storage space for installation: approximately 1 GB

Table 1. Red Hat Enterprise Linux Server Requirements

2.1.2. Red Hat Enterprise Linux Considerations

Before installing the Certificate System packages, ensure that the proper dependencies are installed

on the Red Hat Enterprise Linux system.

The following package groups and packages must be installed on all Red Hat Enterprise Linux

systems:

• dialup (package group)

Client Support

• gnome-desktop (package group)

• compat-arch-support (package group)

• web-server (package group)

• kernel-smp (package)

• e2fsprogs (package)

• firefox (package)

On 64-bit Red Hat Enterprise Linux platforms, ensure that the 64-bit (x86_64) compat-libstdc

++ libraries are installed, and not only the 32-bit (i386) libraries. To confirm this, run the following

command as root:

rpm --qa ---queryformat -'compat-libstdc++-%{VERSION}-%{RELEASE}.%{ARCH}.rpm -| grep x86_64

Numerous libraries should be displayed.

2.2. Client Support

The Enterprise Security Client is supported on the following platforms:

• Apple Macintosh OS X 10.4.x (Tiger on Power PC and Intel)

• Microsoft Windows XP Professional (i386)

• Red Hat Enterprise Linux AS 4 (i386)

• Red Hat Enterprise Linux ES 4 (i386)

• Red Hat Enterprise Linux AS 4 for AMD64 and Intel EM64T

• Red Hat Enterprise Linux ES 4 for AMD64 and Intel EM64T

2.3. Other Required Software

•Red Hat Directory Server 7.1.

The source code and binaries for this component are available at https://rhn.redhat.com), through

the Red Hat Directory Server 7.1 channel.

•A web browser that supports SSL.

It is strongly recommended that users such as agents or administrators use Mozilla Firefox. End-

entities should use Mozilla Firefox or Microsoft Internet Explorer.

The only browser that is fully-supported for the HTML-based instance configuration wizard is Mozilla

Firefox.

2.4. Optional Server Hardware

Red Hat Certificate System supports Chrysalis-ITS LunaSA Hardware Security Module (HSM).

Release Notes

Architecture Version

Firmware 4.5.2

Appliance Software 3.2.4

Client Software 3.2.4

2.5. Optional Client Hardware

• Axalto Global Platform compatible Cyberflex eGate token

3. Installation and Deployment Notes

The following sections contain important installation, configuration, and deployment information for

Red Hat Certificate System 7.3.

3.1. Obtaining Packages

Red Hat Network (http://rhn.redhat.com) is the software distribution mechanism for most Red Hat

customers. Account login information for Red Hat Network, including entitlements for the Red Hat

Certificate System 7.3 release, is required to download this software from Red Hat Network. After

logging into Red Hat Network, go to the appropriate Red Hat Certificate System 7.3 channel to

download the packages for the selected Red Hat Enterprise Linux platform.

NOTE

The source code for Red Hat Directory Server 7.1 is included with the ISO image

downloaded for the 32-bit Red Hat Enterprise Linux version. Red Hat Certificate System

itself is not yet open source.

Red Hat Enterprise Linux systems can upgrade or download Red Hat Certificate System using

up2date.

3.2. Installation Notes

• Packages are non-relocatable. The Red Hat Certificate System base packages can not be installed

to a user-designated location.

• Do not use the autorun feature of the CD drive. If you use the autorun feature with a CD created

from the ISO image, all subsystems (CA, DRM, OCSP, TKS, and TPS) as well as the Enterprise

Security Client are installed on the system by default.

The preferred alternative is to run the installation scripts provided for the server, or to follow the

installation instructions in the Red Hat Certificate System 7.3 Administration Guide.

• Ensure that you remove any existing installations of *sqlite* RPM files for the RA, specifically

libsqlite. The sqlite-XX RPM files that ship with RA will cause conflicts with those files.

Required JRE and JDK

3.3. Required JRE and JDK

IMPORTANT

To address security issues in both IBM and Solaris JDK and JRE, certain updates are

required for both Red Hat Enterprise Linux and Solaris systems. Certificate System

is not directly affected by the security issues in the JDK and JRE packages, but, as a

precautionary measure, make sure that the appropriate versions of these packages are

installed.

3.3.1. Required JRE and JDK for Red Hat Enterprise Linux 4

Red Hat Enterprise Linux 4 versions of Red Hat Certificate System require Java 1.5.0 Java Runtime

Environment (JRE). Certificate System does not support other versions of the JRE. This JRE is

required for running Tomcat, among other applications for the Certificate System.

Likewise, the IBM JDK must be present on Red Hat Enterprise Linux systems. See http://

kbase.redhat.com/faq/FAQ_54_4667.shtm for more information.

These packages are recommended for 32-bit Red Hat Enterprise Linux systems:

• java-1.5.0-ibm-1.5.0.11.1-1jpp.3.el4.i386.rpm (JRE)

• java-1.5.0-ibm-devel-1.5.0.11.1-1jpp.3.el4.i386.rpm (JDK)

These packages are recommended for 64-bit Red Hat Enterprise Linux systems:

• java-1.5.0-ibm-1.5.0.11.1-1jpp.3.el4:1.x86_64.rpm (JRE)

• java-1.5.0-ibm-devel-1.5.0.11.1-1jpp.3.el4:1.x86_64.rpm (JDK)

WARNING

Both the 32-bit xSeries (Intel-compatible) and 64-bit AMD/Opteron/EM64T versions of the

IBM J2SE JRE 5.0 RPM packages available through the IBM download site are packaged

in a format which is incompatible with Certificate System 7.3.

Both 32-bit and 64-bit Red Hat Enterprise Linux 4 packages are available. Make sure to install the

appropriate version for your system.

•Section 3.3.1.1, “Security Fixes in the Required Red Hat Enterprise Linux 4 JRE and JDK

Packages”

•Section 3.3.1.2, “Installing the Required JRE and JDK on Red Hat Enterprise Linux 4”

3.3.1.1. Security Fixes in the Required Red Hat Enterprise Linux 4 JRE and JDK

Packages

Certain security issues for the IBM JRE and JDK were released in two erratas. These changes are

listed in Table 2, “CVEs Fixed in JRE/JDK Errata Updates”. Although none of these problems directly

affect Red Hat Certificate System 7.3, the latest errata should be applied as a security precaution.

Release Notes

Bug Description

Errata RHSA-2007-08291

Bug #239660 CVE-2007-2435 javaws vulnerabilities

Bug #250725 CVE-2007-2788 Integer overflow in the

embedded ICC profile image parser in Sun Java

Development Kit

Bug #250729 CVE-2007-2789 BMP image parser vulnerability

Bug #242595 CVE-2007-3004 Integer overflow in IBM JDK's

ICC profile parser

Bug #250733 CVE-2007-3005 Unspecified vulnerability in Sun

JRE

Bug #246765 CVE-2007-3503 HTML files generated with

Javadoc are vulnerable to a XSS

Bug #248864 CVE-2007-3655 A buffer overflow vulnerability in

Java Web Start URL parsing code

Bug #249533 CVE-2007-3922 Vulnerability in the Java

Runtime Environment May Allow an Untrusted

Applet to Circumvent Network Access

Restrictions

Errata RHSA-2010-01302

Bug #533125 CVE-2009-3555 TLS: MITM attacks via session

renegotiation

Table 2. CVEs Fixed in JRE/JDK Errata Updates

3.3.1.2. Installing the Required JRE and JDK on Red Hat Enterprise Linux 4

1. Download the java-1.5.0-ibm-1.5.0.11.1-1jpp.3.el4 and java-1.5.0-ibm-

devel-1.5.0.11.1-1jpp.3.el4 packages from the latest errata update, Errata

RHSA-2010-01303.

2. Install the packages. For example, for the 32-bit packages:

rpm --Uvh java-1.5.0-ibm-1.5.0.11.1-1jpp.3.el4.i386.rpm java-1.5.0-ibm-

devel-1.5.0.11.1-1jpp.3.el4.i386.rpm

3. Make sure that the IBM Java 1.5.0 is selected as the default JRE and the the IBM 5.0 JDK is

available:

/usr/sbin/alternatives ---config java

There are 2 programs which provide -'java'.

Selection Command

-----------------------------------------------

*+ 1 -/usr/lib/jvm/jre-1.5.0-ibm/bin/java

2 -/usr/lib/jvm/jre-1.4.2-sun/bin/java

Enter to keep the current selection[+], or type selection number: 1

/usr/sbin/alternatives ---config javac

TPS Subsystem Considerations

There are 2 programs which provide -'javac'.

Selection Command

-----------------------------------------------

1 -/usr/lib/jvm/java-1.5.0-bea/bin/javac

*+ 2 -/usr/lib/jvm/java-1.5.0-ibm/bin/javac

3.3.2. Required JRE and JDK for Sun Solaris

The recommended version is Sun JDK and JRE 5.0 Update 24. This is available from http://java.com/

en/download/manual.jsp#sol.

Red Hat Certificate System 7.3 uses the native JRE and JDK packages on Solaris to operate. Certain

security issues for the Sun JRE and JDK have been addressed in several recent erratas. These

changes are listed in Table 3, “CVEs Fixed in JRE/JDK Errata Updates”. Although none of these

problems directly affect Red Hat Certificate System 7.3, the latest errata should be applied as a

security precaution.

Other vulnerabilities to the Sun JDK and JRE are summarized at "Advance notification of Security

Updates for Java SE"4 page from Sun Microsystems.

Bug Description

Errata RHSA-2007-09635

Bug #321951 CVE-2007-5232 Security Vulnerability in Java

Runtime Environment With Applet Caching

Bug #321961 CVE-2007-5238 Vulnerabilities in Java Web Start

allow to determine the location of the Java Web

Start cache

Bug #321981 CVE-2007-5239 Untrusted Application or Applet

May Move or Copy Arbitrary Files

Bug #321991 CVE-2007-5240 Applets or Applications are

allowed to display an oversized window

Bug #324351 CVE-2007-5273 Anti-DNS Pinning and Java

Applets with HTTP proxy

Bug #324361 CVE-2007-5274 Anti-DNS Pinning and Java

Applets with Opera and Firefox

Table 3. CVEs Fixed in JRE/JDK Errata Updates

3.4. TPS Subsystem Considerations

• TPS subsystems installed on a Red Hat Enterprise Linux system require a local installation of the

Apache 2.0.x web server.

• The TPS subsystem cannot be cloned.

4 http://blogs.sun.com/security/entry/advance_notification_of_security_updates7

Release Notes

3.5. Directory Server Information

All subsystems require access to Red Hat Directory Server 7.1 on either the local machine (if it is also

a 32-bit Red Hat Enterprise Linux platform) or a remote machine (acceptable platforms are 32-bit Red

Hat Enterprise Linux 4, 32-bit Solaris 9 for SPARC, or 64-bit Solaris 9 for SPARC).

3.6. Source RPMs

Red Hat Certificate System 7.3 is not an open-source product. Consequently, source RPMs are only

available for third-party packages.

NOTE

Several of these third-party packages may issue warnings when they are installed

because they may contain the UID and GID of their original packager.

4. Known Issues

4.1. Reconfiguring the Red Hat Certificate System Subsystems to

Prevent a Potential TLS-Related Man-in-the-Middle Attack

Transport Layer Security (TLS) is a protocol which establishes a secure connection between a client

and a server. Marsh Ray of PhoneFactor discovered a flaw in the TLS protocol itself which could allow

an attack to insert plain text into an existing session during a TLS renegotiation operation.

The Educated Guesswork blog has a good description of this kind of attack at http://

www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html.

Either a client or a server may request a renegotiation of an existing TLS/SSL session (for instance,

to renew session encryption keys or to use different cipher suite). When TLS/SSL is used to secure

access to an HTTP service and a client attempts to access some protected resource, server-initiated

renegotiation asks client to authenticate with a certificate.

However, the TLS/SSL protocols did not use any mechanism to verify that session peers do not

change during the session renegotiation. Therefore, a man-in-the-middle attacker could use this flaw

to open TLS/SSL connections to the server, send attacker-chosen request to the server, trigger the

renegotiation (either by directly requesting it or by attempting to access protected resource, resulting

in server-initiated renegotiation) and splice victim's initial connection attempt to an existing TLS/

SSL session. Depending on the application-layer protocol, this may lead to attacker request being

performed by the server as if authenticated using victim's credentials or using data from victim's

request. After the renegotiation, attacker can no longer decrypt communication between the client and

the victim, so this attack is also referred to as a "blind prefix injection" attack. Eric Rescorla's blog post

"Understanding the TLS Renegotiation Attack" provides additional details about this flaw.

In Certificate System, this kind of session renegotiation occurs if a user connects to an end-entity port

that doesn't require client authentication, but then attempts to submit a certificate enrollment form for

an enrollment profile that requires client authentication. The Certificate System server requests and

then parses a client certificate for the user.

For both client-initiated and server-initiated renegotiation to be fixed, then both the client and server

need to be updated to apply the resolution in RFC 5746. For Certificate System subsystems, this

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali Red Hat Software

Red Hat

Red Hat CLUSTER MANAGER - INSTALLATION AND Manuale di istruzioni

Red Hat

Red Hat NETWORK 2.6 - BASIC Scheda informativa del prodotto

Red Hat

Red Hat ENTERPRISE LINUX 5.3 - RELEASE MANIFEST Manuale utente

Red Hat

Red Hat DEVICE-MAPPER MULTIPATH 5.2 Manuale di istruzioni

Red Hat

Red Hat LINUX ADVANCED SERVER 2.1 - Manuale utente

Red Hat

Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION Manuale utente

Red Hat

Red Hat NETWORK SATELLITE 5.1.0 - CHANNEL MANAGEMENT Manuale utente

Red Hat

Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER... Guida all'installazione

Red Hat

Red Hat APPLICATION SERVER - JONAS Manuale utente

Red Hat

Red Hat SATELLITE 5.1 RELEASE NOTES Manuale di istruzioni

Red Hat

Red Hat NETWORK SATELLITE 5.2 - CHANNEL MANAGEMENT Manuale utente

Red Hat

Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION Manuale di istruzioni

Red Hat

Red Hat NETWORK 3.5 - PROVISIONING Manuale utente

Red Hat

Red Hat CLUSTER SUITE FOR ENTERPRISE LINUX 5.1 Guida all'installazione

Red Hat

Red Hat CLUSTER SUITE 4.7 - CLUSTER LVM... Manuale utente

Red Hat

Red Hat APPLICATION SERVER - JONAS Istruzioni operative

Red Hat

Red Hat NETWORK SATELLITE 5.1.0 - CHANNEL MANAGEMENT Manuale utente

Red Hat

Red Hat NETWORK PROXY 5.3.0 - Manuale utente

Red Hat

Red Hat CERTIFICATE SYSTEM 7.0 - MIGRATION GUIDE Manuale utente

Red Hat

Red Hat ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE Manuale utente

Red Hat

Red Hat NETWORK BASIC - USER REFERENCE GUIDE 3.3 Scheda informativa del prodotto

Red Hat

Red Hat ENTERPRISE LINUX 4 - DEVELOPER TOOLS GUIDE Manuale di istruzioni

Red Hat

Red Hat NETWORK SATELLITE 5.2 - CHANNEL MANAGEMENT Manuale di programmazione

Red Hat

Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER... Manuale utente

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuale utente

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente