Archive

Archive for the ‘Uncategorized’ Category

Introduction to CloudBees, Developer’s perspective

January 3, 2013 Leave a comment
Thanks to my leftover PTOs (vacation days of my company), I got time to revive my personal projects. So far, my code is on my personal laptop and I have been spending time to research right SVN host, Amazon EC2 instances. And CI tools, Maven repos were kind of out of scope for now. Then I decided to try CloudBees tools.

So Why CloudBees?

Lets begin with situation of typical solo developer or solo start-up teams. Generally, you start with your favorite IDE and as soon as something is working, you start thinking about managing whole project life cycle.  You wish for these things.

For your day-to-day development

  • At least, you ( or your team) wants to commit changes to external source control. (svn, git etc.)
  • You should be able to preserve and release artifacts. (Our favourite tool is Maven.)
  • It would be nice, as soon as you commit (or regular intervals), some external CI tool, takes update from your SCM repo and do build. (And publish to private maven repository too). 
  • And don’t we feel productive, if we have task management system to align with personal or team goals. (if agile tools available, even better.) 
For your testing and production servers. (application servers)
  • You may want one 24 x 7 running development integration server, who is always running HEAD (aka snapshot) of your code. 
  • Once you are ready to release your application to world, you should be able to deploy your code to load-balanced servers. 
That’s where CloudBees comes into picture. CloudBees is trying these two categories of problems by offering two different suites of tools. 
  1. CloudBees DEV@cloud (or BUILD) provides tools for CI, SCM & Maven Repositories. 
  2. CloudBees RUN@cloud (or RUN) provides pre-installed java application servers, ready to run your JEE compliant code. 
How I use it?
I am sure, first thing you will do, go to cloudbees.com. Don’t get temped with their sophisticated UI landing pages. Looks like lots of work and some complex process. (I wish, I could change their landing pages to be more KISS compliant, anyways). Main thing is, first you open an free account, with their FREE tier. (yes FREE option to try out every tool). As soon as you do that, you will have access to their tools which follows simple URLs. For example, if your account id is johndoe, then typical urls looks like
  • https://forge.cloudbees.com/a/johndoe/  – for SVN repos and Maven repos. You get 2GB free, combined for both. 
  • https://johndoe.ci.cloudbees.com/  – Jenkins landing page. Create jobs, configure it. Very much intuitive.
  • (Hopefully in future) https://johndoe.tasks.cloudbees.com/

For you run time needs

Apart from these in-house tools, CloudBees provide 3rd Party integrations. It’s good to have integrations with other hosted solution providers, who are already market leaders. Here is complete list.

End Note:

We are living in age of cloud computing and there are lots of services are popping up. Also it has become important for us that we realize the real value & utilize cloud-based-services and more focused on actual productivity. In my case, I would have spent weeks in perfecting Jenkins (or Hudson), installing Subversion server, installing Maven repositories on Amazon EC2 infrastructure, but now, I have spent 2 days in navigating CloudBees and now I am thinking more of functional goals, not infrastructure tasks.

I have argued with myself, in self-hosting tools, I get much cheaper & unlimited CPU time. But I will be wasting my 80+ hours on perfecting it. Plus reliability of self-hosting service is definitely questionable.

Links to bookmark

Categories: Uncategorized Tags:

Public Key Cryptography (Yet another guide)

October 1, 2011 Leave a comment
Introduction
Traditional encryption method, where you encrypt using one key and de-crypt using same key. Of course it suffers with basic problem is sharing key. And it is difficult or impossible, when we want to exchange information in public domain. (secure websites extra.). 
Public key encryption is asymmetric, means, you encrypt using one key and other key decrypts it. Starting point of this encryption is to generate two keys using some tool at same time and share one key to other party. Other party can be public to all or internet. The key which gets published to public is called public key and key which you keep to yourself is called private key. Hence this type of cryptography called public key cryptography.

pub-key concept is basis for digital signatures and digital certs.


PGP (Pretty Good Privacy) encryption.
PGP uses both symmeteric and assymetric encryption. PGP uses one time session key for encrypting whole document and uses public-private key method to share that session key.

PGP is a hybrid cryptosystem.

Hence it’s faster to encrypt and decrypt compare to just using pub key to encrypt whole document. Conventional encryption is about 1,000 times faster than public key encryption. Public key encryption in turn provides a solution to key distribution and data transmission issues.
These days, PGP method is being used most widely.
Digital Signatures
One of important use of public key cryptography is, authentication of sender. Hence this type of cryptography is perfect for digitally signing documents (or emails). This even more secure than signing by hand (nobody can forge it) (Imagine, digital signing report cards of kids, they are out of luck 🙂 ).
Instead of encrypting information using someone else’s public key, you encrypt it with your private key. If the information can be decrypted with your public key, then it must have originated with you.
General rule of using PGP (or public key ) cryptography
If you want to exchange information, where origin from you has to be verified then you use your private key to encrypt. Example: Digital signatures in email.
If you want to authenticate origin of document, then you use that origin’s public key to decrypt. Example secure website of banks.
Hash Functions (Message Digest or MD5)
PGP tool can take any file and generate fixed length hash value of that file. Fixed length is generally couple of bytes to 10-20 bytes. (Lets say 160 bits). Now if recipient gets that file or downloads (or using torrents), then he can generate same hash code for received file. If that hash code matches from hash code published (on website), it means he has right file with no modifications. This concept is generally used if users are getting software archives from different sources (or server mirrors) and users want to make sure, they got original file.
Even a single bit changed in file, will cause different hash code. The generated hash code is called message digest or MD5.
To make cryptography even more fasted using PGP, instead of encrypting whole document with session key, PGP generates message digest and digitally sign it using private key. (Basically encrypted message digest). Recipient then uses public key to decrypt MD and generate new one from received file. If both matches, then voila.
Digital Certificates
Now with all above encryption methods, one thing is that, public key has to published and we need to make sure that public key originated from right party. To solve problem authentication of public key, digital certificates comes into picture.
A digital certificate consists of three things:
  1. A public key of entity, whole this certificate belongs to.
  2. Certificate information. (“Identity” information about the user, such as name, user ID, and so on.)
  3. One or more digital signatures of third party companies vouching for authenticity of public key. Digital signature is for public key of entity in question, signed by ‘trusted’ 3rd party. Example verisign, geotrust etc.

One way for a recipient to check whether a certificate is valid is by verifying its digital signature, using its issuer’s (signer’s) public key. That key can itself be stored within another certificate whose signature can also be verified by using the public key of that next certificate’s issuer, and that key may also be stored in yet another certificate, and so on. You can stop checking when you reach a public key that you already trust and use it to verify the signature on the corresponding certificate.
Hence there is hierarchy of CAs (Certificate Authority). Top most level CA is called root CA.
A CA creates certificates and digitally signs them using the CA’s private key.
Public Key Infrastructures (PKI)
A PKI contains the certificate storage facilities of a certificate server, but also provides certificate management facilities
Our browsers come equipped with some top level certificate issuing authority public keys.
Digital Certificates are of two types
  • PGP Certs (lesser used)

No 3rd Party digital signature
Self signed digital signature
Multiple people can sign it.

  • X.509 Certificates (most commonly used) (web browsers).

Apart from above three labels, it has DN (distinguished name)
Example: CN=Bob Allen, OU=Total Network Security Division, O=Network Associates, Inc., C=US
How to get X.509 Certificates?
To obtain an X.509 certificate, you must ask a CA to issue you a certificate. You provide your public key, proof that you possess the corresponding private key, and some specific information about yourself. You then digitally sign the information and send the whole package — the certificate request — to the CA. The CA then performs some due diligence in verifying that the information you provided is correct, and if so, generates the certificate and returns it
In other words, you send a self-signed certificate signing request (CSR) to the CA. The CA verifies the signature on the CSR and your identity, perhaps by checking your driver’s license or other information. The CA then vouches for your being the owner of the public key by issuing a certificate and signing it with its own (the CA’s) private key. Anybody who trusts the issuing CA’s public key can now verify the signature on the certificate. In many cases the issuing CA itself may have a certificate from a CA higher up in the CA hierarchy, leading to certificate chains.
Other Misc Topics

Passphrase
Further private key can be stored encrypted by using some password. Generally it is phrase, hence it’s called passphrase. Think of situation, if someone has access to your m/c and steal your private keys. Unless, they decrypt private key using same passphrase, they can’t use that key to encrypt any document

Strength of encryption.
Keys (private & public) are measured in bits. Generally it ranges from 64 bit to 1024 bit. Larger is key, more powerful encryption but bad performing. Hence while choosing key strength, it has to be right balance between strength and performance. Generally 128bit to 256 bit keys are enough for day to day operations like secure website etc. Unless it is military secret. 1024 bit keys are overkill.

References:
Categories: Uncategorized