Viber on Fedora 30 Says No Connection even When Connected to the Internet

TL;DR: link openssl library to viber/lib ('sudo ln -s /usr/lib64/libssl.so.10 /opt/viber/lib/libssl.so')

Because Internet messaging on mobile is more efficient than SMS, and I'm almost always on my keyboard, I had to install my mobile messaging app, Viber, on my newly set-up PC running Fedora 30.

After downloading, installing and running the app, I got a 'No Connection' when I try to register, even when connected to the Internet.

Running the executable on the terminal doesn't give any useful message.

Someone at bytefreaks.net (https://bytefreaks.net/applications/viber-desktop-on-fedora-27-64bit-viber-cannot-connect-to-the-internet-openssl-error) had a solution for an explicit SSL error message. I checked if the SSL library they needed existed in my Viber installation. It doesn't. So, I took it as a hint on the possible problem and tried their solution, which is to link the SSL library to Viber's lib folder.

# sudo ln -s /usr/lib64/libssl.so.10 /opt/viber/lib/libssl.so

It worked!

Ubuntu 16 : Certificate Verify Failed

An application, hosted on an Ubuntu 16 box, calling a URL returned "certificate verify failed".

Checking if the URL is accessible, tested calling it via wget. Got "Unable to locally verify the issuer's authority."

To test URL access and response, use openssl...

# openssl s_client -showcerts -connect <host>:<port>






To install the needed certificate...

# cd /usr/local/share/ca-certificates/


# sudo mkdir <source name>
# sudo chmod 755 <source name>


# cp .crt .


# sudo chmod 644 .crt

# sudo dpkg-reconfigure ca-certificates

select new certificate to allow, then click ok

# sudo update-ca-certificates


Retest URL access and response...

OK.

google chrome - ssl certificate - NET::ERR_CERT_AUTHORITY_INVALID

you get this when browsing a site with a self-signed certificate or a certificate created by an unauthorized ssl provider...

but what if you truly trust this site and don't want to keep on telling chrome to proceed to site everytime you try to access? obviously, you add the ssl certificate to your list of trusted sites. in chrome, you have to manually export and import the certificate to do this.

first, export the certificate by:

 1. clicking the padlock icon with red x mark in the address bar

 2. click connection > certificate information

 3. click details > export > save (take note of where you save it and what filename)
* save your certificate with .crt extension name

second, import the certificate by:

 1. clicking chrome menu at the top right of the browser, after the address bar

 2. click settings > show advanced settings...

 3. under https/ssl, click manage certificates...

 4. click authorities > import...

 5. select the certificate you exported in the first step, then open

 6. click 'trust this certificate for identifying websites' > ok

that's it. chrome will automatically proceed next time you go to this site.

web server: a few notes on security hardening

server access hardening

1. dont allow root in sshd, set protocol and max tries
 in /etc/ssh/sshd_config, set
  Protocol 2
  PermitRootLogin no
  MaxAuthTries 3

2. remove remote root login
 in /etc/securetty, remove all entries except for "console"

3. set idle timeout
 in /etc/profile, add
  TMOUT=7200

4. set password policy
 in /etc/login.defs, set
  PASS_MAX_DAYS 30
  PASS_MIN_LEN 8

web access hardening

1. remove http mod_rewrite (to disable http trace/track method)
 in /usr/local/apache2/conf/httpd.conf, set
  RewriteEngine Off

2. display http 413 error message (for web server cross-site scripting vulnerability due to 413 error message)
 in /usr/local/apache2/conf/httpd.conf, uncomment
  ErrorDocument 413 /error/HTTP_REQUEST_ENTITY_TOO_LARGE.html.var

3. apply SSL to portion of website that uses logon credentials or entire website (for credentials with encryption)

4. implement input validation (for more web server cross-site scripting vulnerability) see owasp.org for details

5. ignore session id provided by user. generate your own session id after authentication. (for session fixation vulnerability) see owasp.org for details

apache: ssl setup

1. configure your apache with ssl
    # ./configure --prefix=/usr/local/apache2 --enable-rewrite --enable-ssl --with-ssl=/usr/include/openssl

2. create a sign key without pass phrase *
    # openssl genrsa -out server.key 1024
    or if with pass phrase
    # openssl genrsa -des3 -out server.key 1024

3. create a certificate request. use this when you purchase your certificate. (or do no. 4 for self signed certificate)
    # openssl req -new -key server.key -out server.csr
    (leave the challenge password blank)

4. create a self signed certificate
    # openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

5. modify your httpd.conf file to add ssl key and cetrificate
    <VirtualHost 127.0.0.1:443>
        SSLEngine on
        SSLCertificateFile /usr/local/apache2/conf/server.crt
        SSLCertificateKeyFile /usr/local/apache2/conf/server.key
    </VirtualHost>

6. place your ssl key and certificate files into the directory paths you supplied in your httpd.conf (above)

7. start apache with ssl
    # /etc/init.d/httpd startssl

* you should NOT generate the RSA private key with a pass phrase if you have scripts that restart apache with ssl automatically, else, it will require you to enter the pass phrase before it starts apache with ssl

8. edit apache startup script to launch with ssl
    include DSSL in start start script /etc/init.d/httpd
    $HTTPD -k $ARGV -DSSL

9. allow ssl port through your firewall. if you're using iptables, add this
    -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT

to verify the contents of the certificate request, use the this comand:
# openssl req -noout -text -in server.csr

to view the contents of the private key, use the command below:
# openssl rsa -noout -text -in server.key

to use SSLv3 instead of TLSv3, add this in ssl.conf:
SSSLProtocol -all +SSLv3 +TLSv1
SSLCipherSuite SSLv3:+HIGH:+MEDIUM

to test ssl connection
# openssl s_client -connect localhost:443