Enable CBC Ciphers in B2Bi v5.2.6.4, B2Bi v6.0, SFG v2.2.6.4 and SFG v6.0

Some of the IBM Sterling B2B Integrator(SI) customers wants to avoid SSH handshake using CBC Cipher as it is vulnerable. The link http://www.kb.cert.org/vuls/id/958563 explains that CBC Ciphers are security vulnerable and the solution is to use CTR Cipher instead of CBC Cipher. However, in SI versions 5020602 and 5020603, maverick (the third party api used for SSH/SFTP) version used is 1.4.60 which mandates that CBC Cipher should be present in Client side. Hence, disabling the CBC support using the security property supportCBCCiphers=false will result in SFTP communication failure with key based authentication.

To enforce the use of CTR Cipher in SI, we have introduced two new properties : SSHServerCipherList, SSHClientCipherList

a) security.SSHServerCipherList is the property to restrict the list of server side ciphers. In the SFTP Server adapter, "Preferred Cipher" drop down will pick the values specified in this property list.

b) security.SSHClientCipherList is the property to restrict the list of client side ciphers. In the SSH Remote Profile Configurations, "Preferred Cipher" drop down will pick the values specified in this property list.

The fix also needs the property security.supportCBCCiphers set as true in customer_overrides.properties.

This is how it works :

1. In the server side, SFTP Server Adapter can restrict Cipher as "ctr" by specifying the property value as
   security.SSHServerCipherList=aes128-ctr,aes192-ctr,aes256-ctr

   This will restrict the client to communicate only with "ctr" Ciphers.

2. In the client side, the Business Process should specify Ciphers as "cbr" and "ctr" by specifying the property value as
   security.SSHClientCipherList=aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc

   Also, the PreferredCipher should have the value of "ctr" in BP. This will ensure that the communication happens with "ctr" Cipher.

3. The external client should ensure that it communicates with server adapter with "ctr" Cipher.

In case, if there is a mismatch in client and server side Ciphers, an error message : Failed to negotiate a transport component [aes128-cbc,aes192-cbc,aes256-cbc] [aes256-ctr,aes128-ctr,aes192-ctr] [Unknown cause]:SSH_DISCONNECT_BY_APPLICATION:SFTP session channel closed by server.: should be displayed in SFTP Client Begin Session Service.

NOTE : This fix is available only as a custom ifix for SI versions 5020602 and 5020603. The changes are NOT available in the product.

https://www.ibm.com/developerworks/community/blogs/2f9ef931-1ac3-4d9b-a8ca-6e3f01b13889/entry/IBM_Sterling_B2B_Integrator_Enforce_CTR_Cipher_in_SFTP_Communication?lang=en

Generate Self-Sign Certificate with SHA512

openssl req -newkey rsa:2048 -sha512 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem
openssl x509 -text -noout -in certificate.pem
openssl pkcs12 -inkey key.pem -in certificate.pem -export -out certificate.p12
openssl pkcs12 -in certificate.p12 -noout -info
openssl pkcs12 -inkey key.pem -in certificate.pem -export -out certificate.p12
openssl pkcs12 -in certificate.p12 -noout -info
openssl pkcs12 -in /tmp/certificate.p12 -nokeys -out sirish_test.cer

Sterling Integrator User, Workflow Queries

Active Worksflows in Sterling Integrator

select DISTINCT NAME , WC2.WORKFLOW_ID, sysdate - START_T AS TIMEDIFF
From WORKFLOW_CONTEXT WC,
(
SELECT MAX(STEP_ID) STEP_ID , MIN(START_TIME) START_T, WORKFLOW_ID
FROM WORKFLOW_CONTEXT
GROUP BY WORKFLOW_ID
) WC2,
WFD
WHERE WC.WORKFLOW_ID = WC2.WORKFLOW_ID
AND WC.STEP_ID = WC2.STEP_ID
AND WC.NEXT_AI_ID != -1
AND WC.WFD_ID = WFD.WFD_ID
AND WC.WFD_VERSION = WFD.WFD_VERSION
AND BASIC_STATUS = 0

Sterling Integrator User & User Associated Groups List 

select YFS_USER.LOGINID, YFS_USER_GROUP.USERGROUP_NAME from YFS_USER, YFS_USER_GROUP, YFS_USER_GROUP_LIST
where YFS_USER.USER_KEY=YFS_USER_GROUP_LIST.USER_KEY
and YFS_USER_GROUP.USERGROUP_KEY=YFS_USER_GROUP_LIST.USERGROUP_KEY