Application blocked by java security

Application blocked by java security in oracle apps

CAUSE


Java has further enhanced security to make the user system less vulnerable to external exploits. Starting with Java 7 Update 51, Java does not allow users to run applications that are not signed (unsigned), self-signed (not signed by trusted authority) or that are missing permission attributes.

Risks involved in running applications

• Unsigned application
  An application without a certificate (i.e. unsigned apps), or missing application Name and Publisher information are blocked by default. Running this kind of application is potentially unsafe and present higher level of risk.
• Self-signed application (Certificate not from trusted authority)
  An application with self-signed certificate is blocked by default. Applications of this type present the highest level of risk because publisher is not identified and the application may be granted access to personal data on your computer.
• Jar file missing Permission Attribute
  Permissions Attribute verifies that the application requests the permission level that developer specified. If this attribute is not present, it might be possible for an attacker to exploit a user by re-deploying an application that is signed with original certificate and running the application at a different privilege level.

---

SOLUTION

The application that you are running is blocked because the application does not comply with security guidelines implemented in Java 7 Update 51.
Contact the developer or publisher of this application and let them know about the application being blocked. You can refer them to these links that provide information about implementing secure practices in the code for the application.

---

WORKAROUND


It is highly recommended not to run these types of applications. However if you still want to run these apps, run only if you understand the risks and implications.
As a workaround, you can use the Exception Site list feature to run the applications blocked by security settings. Adding the URL of the blocked application to the Exception Site list allows it to run with some warnings.

Steps to Add URLs to the Exception Site list

• Go to the Java Control Panel (On Windows Click Start and then Configure Java)
• Click on the Security tab
• Click on the Edit Site List button
• Click Add in the Exception Site List window
  
  
• Click in the empty field under the Location field to enter the URL
  
  Example: http://www.example.com
  (URL should begin with http:// or https://)
  
  If the URL where the applet is hosted is different from the URL of the web page from which the applet is launched, then you will need to add both the URL for the applet as well as the URL for the web page.
  
  Example with different URLs for the applet and the web page
    you would enter both URLs (The urls listed can be different depending on which host is serving the ERP Apps)
  
  1. http://192.32.33.20:8004
     This is the url for the EBS Apps
  2. http://sujeet.oracle.com:8004
  
  
• Click OK to save the URL that you entered
• Click Continue on the Security Warning dialog

Debug in Oracle appsR12

You can configure whether end users can run the application in debug mode by using the Debugging attribute on the Edit Application Definition page. A developer who is logged into the application's workspace can always run the application in debug mode.

To enable or disable debugging:

1. On the Workspace home page, click the Application Builder icon.
2. Select an application.
3. Click the Edit Application Properties button to the right of the application name.
   The Edit Application page appears.
4. Scroll down to Properties.
5. For Debugging:
   • Yes. Enables the application debug mode using the browser at run time.
   • No. Disables the application debug mode using the browser at run time.
     
     
     
     
     VIEW DEBUG Reports
     
     
   • On the Workspace home page, click the Application Builder icon.
   • Select the desired application.
     You can view debug reports when the application is running or in development mode.
   • To view a debug reports in development mode:
     • Click the Find icon and then the Debug tab. 
     • On the Application home page, click Utilities, and then Debug Messages.
   • To view debug reports when the application is running, click View Debug on the Developer Toolbar.
     A list of Debug reports displays.
   • Click the View Identifier to the left of the session you want to view.
     The following illustration shows debug reports viewed in the Item Finder.
     
     
     
      
   • Description of the illustration debug_report.gif
     
   • To view steps that took the longest, hover over that step on the graph above the report.
     The step details display.
   • To go to that step in the report, click the bar.
     Note:

     Debug sessions listed in the report live for at least 2 weeks and age out along with the activity log. This is usually more than adequate for debugging purposes.

A fatal error related to codelines or codelevels has occurred

AutoPatch error:
--------
This patch is not compatible with your current codelines.

This patch is compatible with: entity 'pjt' - codeline 'R12.PJT.A'.
Your current on-site codeline for the entity 'pjt' is: 'R12.PJT.B'.

You should not apply this patch.
Apply an equivalent patch that is compatible with your
current codelines instead.
--------
AutoPatch error:
--------
A fatal error related to codelines or codelevels has occurred.

Solution:-

SQL script to check product patchlevel or codelevel

SELECT app_short_name, MAX(patch_level)
FROM apps.ad_patch_driver_minipks
GROUP BY app_short_name ;

APP_SHORT_NAME
--------------------------------------------------
MAX(PATCH_LEVEL)
------------------------------
PSP
R12.PSP.B.3

AS
R12.AS.B.3

FTE
R12.FTE.B


APP_SHORT_NAME
--------------------------------------------------
MAX(PATCH_LEVEL)
------------------------------
AK
R12.AK.B.3

CHV
R12.CHV.B.3

IEC
R12.IEC.B.3

how to find applied patches in r12

There are some tables in oracle apps (AD tables especially) involved when applying patches.
Some of them are very useful when we need specific information about patch already applied.
 

Adpatch Base Table:-

AD_APPLIED_PATCHES – The main table when we are talking about patches that applied in Oracle Apps.
This table holds information about the "distinct" Oracle Applications patches that have been applied.
If 2 patches happen to have the same name but are different in content (e.g. "merged" patches), then they are considered distinct and this table will therefore hold 2 records (eTRM).
I also found that if the applications tier node is separate from the concurrent manager node, and the patch applied on both nodes, this table will hold 2 records, one for each node.

AD_PATCH_DRIVERS – This table holds information about all patch drivers included in specific patch.
For example if patch contain only one unified driver like u[patch_name].drv then ad_patch_drivers will hold 1 record.
On the other hand, if patch contain more than 1 driver, for example d[patch_name].drv and c[patch_name].drv, this table will hold 2 records.

AD_PATCH_RUNS – holds information about each execution of adpatch for a specific patch driver.
In case a patch contains more than one driver, this table will hold a record for each driver.
This table also holds one record for each node the patch driver has been applied on (column APPL_TOP_ID).

AD_PATCH_RUN_BUGS – holds information about all the bugs fixed as a part of specific run of adpatch.

AD_BUGS – this table holds information about all bug fixes that have been applied.

 Two Way to view applied patch information in Oracle EBS R12:-

1) OAM – Oracle Applications Manager
2) SQL queries


With OAM it’s easy and very intuitive, from OAM site map -> “Maintenance” tab -> “Applied Patches” under Patching and Utilities.

Search by Patch ID will get all information about this patch; In addition, drill down by clicking on details will show the driver details.


For each driver we can use the buttons (Timing Details, Files Copied, etc.) to get more detailed information.

With SQL we can retrieve all the above information, sometimes more easily.

For example: How to know which modules affected by specific patch?

With OAM:
1) search patch by Patch ID
2) click on Details
3) For each driver click on “Bug Fixes” and look on product column.

With SQL:
Run the following query, it will show you all modules affected by specific patch in one click…

select distinct aprb.application_short_name as "Affected Modules"
from ad_applied_patches aap,
ad_patch_drivers apd,
ad_patch_runs apr,
ad_patch_run_bugs aprb
where aap.applied_patch_id = apd.applied_patch_id
and apd.patch_driver_id = apr.patch_driver_id
and apr.patch_run_id = aprb.patch_run_id
and aprb.applied_flag = 'Y'
and aap.patch_name = '&PatchName';
Another SQL will retrieve basic information regarding patch applied, useful when you need to know when and where (node) you applied specific patch:

select aap.patch_name, aat.name, apr.end_date
from ad_applied_patches aap,
ad_patch_drivers apd,
ad_patch_runs apr,
ad_appl_tops aat
where aap.applied_patch_id = apd.applied_patch_id
and apd.patch_driver_id = apr.patch_driver_id
and aat.appl_top_id = apr.appl_top_id
and aap.patch_name = '&PatchName';
To check if specific bug fix is applied, you need to query the AD_BUGS table only.
This table contains all patches and all superseded patches ever applied:

select ab.bug_number, ab.creation_date
from ad_bugs ab
where ab.bug_number = '&BugNumber';

How to disable your browser's popup blockers

The following includes steps for disabling pop-up window blockers.

• Internet Explorer 7 (WindowsXP)
• Internet Explorer6 (Windows XP)
• Firefox (Windows PC)
• Firefox (Mac OSX)
• Mozilla (Mac OSX)
• Safari (MacOSX)

The following includes steps for disabling Brower toolbars.

• Yahoo toolbar popup blocker
• Google toolbar popup blocker
• AOL toolbar popup blocker
• MSN toolbar popup blocker
• Norton Internet Security/Personal Firewall popup blocker

How to disable Internet Explorer 7 popup blocker (Windows XP)

1. From the Tools menu, select Internet Options.
2. 
   
    
3. From the Privacy tab, uncheck Turn on Pop-up Blocker and click "OK".
5. 
   
   

How to disable Internet Explorer 6 popup blocker (Windows XP)

1. From the Tools menu, select Internet Options.

  

 From the Privacy tab, uncheck Block pop-ups
.

How to disable the Firefox popup blocker (Windows PC)

1. From the Tools menu, select Options.
   
    
2. From the Content tab, uncheck Block Popup Windows and click "OK".
   
   
    

How to disable the Firefox popup blocker (Mac OSX)

1. From the Firefox menu, select Preferences.
   
    
2. From the Preferences window, choose the Content button and then uncheck Block Pop-up Windows.
3. 
   
    

How to disable the Mozilla popup blocker (Mac OSX)

1. From the Mozilla menu, select Preferences.
   
2. From the Privacy & Security tab, choose Popup Windows. Un-check Block unrequested popup windows, and click "OK"
3. 

How to disable the Safari popup blocker

1. From the Safari menu, make sure Block Pop-Up Windows is unchecked.
2. Choose Safari > Preferences, and then click Security.
3. Turn on “Block pop-up windows.”
   
   
    

How to disable the Yahoo toolbar popup blocker

1. Locate the Popup blocker icon and click the down arrow.
   
    
2. Uncheck Enable Pop-Up Blocker.
   
    

How to disable the Google toolbar popup blocker?

1. Click on the Google logo on the Google toolbar and select Options.
   
    
2. Uncheck Popup Blocker, and then click OK.
   
    

How to disable AOL toolbar popup blocker?

1. Locate the Popup blocker icon.
   
    
2. Click on it until it says Allowed.
   
    

How to disable the MSN toolbar popup blocker?

1. Locate the Popup blocker icon and click the down arrow.
   
    
2. Check Allow Pop-ups.
   
    

How do I disable my Norton Internet Security/Personal Firewall popup blocker?

1. Open Norton Internet Security's/Firewall�s main window (you may click the firewall icon on the system tray or use Start->Programs->Norton Firewall)
2. Click the Ad Blocking line.
3. Click the Turn Off button.
   
    

Give FTP User access to specific directory in Linux

To create FTP user through SSH you would need to follow below mentioned steps:

1. Login as root through SSH.

2. Next add the user account you want using the 'useradd' command

useradd <username>

3. Now create a special group for that user.

groupadd <groupname>

4. Now to add the user to the group

gpasswd -a <username> <groupname>

These commands are non-standard but available on most popular distributions. If not, then you can
try editing /etc/group using your favorite text editor.

5. Change the group ownership of the special directory to that group.

chgrp -Ra groupname
/path/to/your/web/directory

6. Enable write permissions

chmod -R g+rw

/path/to/your/web/directory

How to give ftp users access to directories outside their home folder in Linux

Say you have 2 users, with 2 different websites:
User sonu:

• Home folder:  /home/sonu
• Document root, virtual-host: /var/www/sonu.com

User sujeet:

• Home folder: /home/sujeet
• Document root, virtualhost: /var/www/sujeet.com

And you are using vsftpd, with the setting chroot_local_user=YES so that users are limited to their own home folder.

You could create a link ( ln -s ) between /home/sujeet/sujeet.com and /var/www/sujeet.com so sujeet could manage his website from his home directory. that would work, but not via ftp, since it does not follow links outside sujeet’s home folder.

Steps:-

Instead of using the traditional link, you can in Linux mount two folders like this:
Make sure the directories /home/sujeet/sujeet.com and /var/www/sujeet.com exists (create them with mkdir)
Then mount the two folders with mount –bind  /home/sujeet/sujeet.com /var/www/sujeet.com
Now Alex should be able to update his website files in his home folder, via ftp, and at the same time, Apache can serve his website from the default /var/www directory (ubuntu default).

Note:-

This is a simpler workaround, a solution, but not to the specific problem of giving ftp users access.
Instead of linking or mounting directories between Apaches www folder and users home folder, you could just point the document root of the Apache virtual-hosts to /home/sujeet/sujeet.com or /home/sonu/sonu.com instead.

 

 

ORA-01555 snapshot too old

What is "snapshot too old" error and how to avoid it?
ORA-01555: snapshot too old: rollback segment number with name "" too small.

First thing to be understood here is how rollback segments work. These work in a circular fashion by looping around to reuse the extents which have been released by committed transactions. Thus in case of long running queries if data is changed while the query is running, rollback segments created for that change are needed to make a read consistent image for the lon running query. When these extents are reused while these were still need by the query, this error occurs, because oracle can no longer provide a read consistent image of the data.
To avoid this error you need to postpone the reuse of extents. Thus increasing the size of rollback segments and the value of OPTIMAL parameter should do the trick. Committing less often would be other solution. As until transaction is c omitted rollback segment can not be reused thus reducing the chances of a snapshot too old error.

Solution:- 

You'll probably need to dive into Oracle DB administration if you want to solve it via increasing the UNDO log. Basically you do (as SYSDBA):

SQL> show parameter undo

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
undo_management                      string      AUTO
undo_retention                       integer     900
undo_tablespace                      string      APPS_UNDOTS1
 

SQL> ALTER SYSTEM SET UNDO_RETENTION = 21600;

21600 is 6 hours in seconds.
However, Oracle will only keep 6 hours of old data if the UNDO log files are big enough, which depends on the size of the rollback segments and the amount of updates executed on the database.
So in addition to changing the undo retention time, you should also make sure that few concurrent updates are executed while your job is running. In particular, updates of the data your job is reading should be minimized.
If everything fails, increase the UNDO logs.



The ORA-01555 snapshot too old error can be addressed by several remedies:-

Re-schedule long-running queries when the system has less DML load.

Increasing the size of your rollback segments(undo)size. The ORA-01555 snapshot too old also relates to your setting for automatically undo retention.

Don’t fetch between commits.


Ways to avoiding the ORA-01555 error are mention below:

Do not run discrete transactions while sensitive queries or transactions are running, unless you are confident that the data sets required are mutually exclusive.

Schedule long running queries and transactions out of hours, so that the consistent gets will not to rollback changes made since the snapshot SCN. This also reduces the work done by the server, and thus improves performance.

Code long–running processes as a series of restart–able steps.

Shrink all rollback segments back to their optimal size manually before running a sensitive query or transaction to reduce the risk of consistent get rollback failure due to extent reallocation.

Use a large optimal value on all rollback segments, to delay extent reuse.

Don’t fetch across commits,  that is, don’t fetch on a cursor that was opened prior to the last commit, particularly if the data queried by the cursor is being changed in the current session.

Use a large database block size to maximize the number of slots in the rollback segment transaction tables, and thus delay slot reuse.

Commit less often in tasks that will run at the same time as the sensitive query, particularly in PL/SQL procedures, to reduce transaction slot reuse.

If necessary, add extra rollback segments (undo logs) to make more transaction slots available.