My name is Elizabeth Frazier and as the official photographer here at Arlington National Cemetery I'm going to take you through one of our newest exhibits in the ANC Welcome Center inside these hollowed grounds. This interpretive photographic exhibit, located along the inner walls of the Welcome Center, showcases a behind-the-scenes view of the multifaceted work required to fulfill ANC's sacred mission. Arlington National Cemetery represents the American people from past, present and future generations by laying to rest those few who have served our nation with dignity and honor while immersing guests in the cemetery's living history. Through collaboration with the ANC Public Affairs and History Offices, we were able to bring you a candid look at what it's like to work at Arlington National Cemetery. All imagery in this exhibit was taken in real time while our great workforce of government civilians, soldiers and contractors worked diligently, every day, under every kind of weather condition to support our mission with the utmost respect. The idea for inside these hollowed grounds began simply. While conducting normal duties of photographing funerals, events or ceremonies, I would often turn my camera to my fellow employees and capture a moment of them working to support our mission. Sometimes it was a small moment, like measuring and earn as part of our funeral standards. Other times it was more elaborate work, like restoration of our monuments or intricate engineering repairs. And still others were just happenstance, solemn moments of work conducted every day across the cemetery. Through discussions with subject matter experts and department directors and with direct leadership input, we took this large collection of photography and curated a selection we felt best showcased our workforce and mission. To facilitate this mission we created interpretive panels to go with each image, providing a description of what is happening in each photo and information on the duties being carried out. The final selection resulted in the 36 photographs you see here today arranged around Arlington National Cemetery's core themes, honor, remember, explore. The exhibit starts with honor, which revolves around laying to rest our nation's service members and veterans, along with their eligible dependents. Here you will see cemetery representatives meeting with family members. From their arrival to ANSI to after military funeral honors, cemetery representatives provide individual care for each family that is laying a loved one to rest. You'll see our chaplains who preside over services and offer comfort to families in their time of need. And finally, you'll see our internment operations team who work diligently every day to open and close graves no matter what the weather condition. Next, we move on to remember, which showcases our perpetual care for those laid to rest at ANC, as well as how we keep their memories alive every day of the year. Quality assurance conducts inspections of every headstone and niche cover upon arrival to ANC. Facility maintenance prepares the cemetery every Memorial Day and Veterans Day by hanging flags in the Memorial Amphitheater. And internment operations members realign headstones even during the COVID-19 pandemic. On the back wall, we see many of the behind-the-scenes duties our workforce accomplishes to keep Arlington National Cemetery in pristine condition. With precise attention to detail, we preserve historic structures like the Tomb of the Unknown Soldier, dry off chairs before some 5,000 people arrive for the National Memorial Day observance, and enact repairs to our infrastructure like the roof of this very welcome center. Though rarely seen by the public, these duties are essential to the overall effectiveness of our mission. Then, we explore, which consists of visitor experience, public outreach, and operational support. Arlington National Cemetery is a level three accredited arboretum cared for meticulously by our horticulture staff. During normal operations, we offer tours of our Memorial Arboretum, which includes stake champion trees, rain gardens, and expertly managed turf at every gravesite. We also offer history tours, educational materials, and exhibits, which are curated by our history office to educate visitors of all ages and backgrounds on the cemetery's rich and diverse history. In addition, we conduct public outreach through our Public Affairs Office, escorting media and various stakeholders to events and funerals to share our story with the American people and abroad. Finally, we see some of the internal work we do to keep A&C running. Whether it's resource management working to maintain our annual budget, groups of employees coming together to work through challenges such as weather emergencies, or our expert security force working every day to keep A&C safe, we maintain the Army's priority of people first. Many of our team members work behind the scenes to ensure that employees have the proper resources, skills, and training to care for veterans, families, and visitors. A&C's work is precise, from budgets to gravesites, and we ensure that all of our people are trained to achieve that precision. We are a humble workforce. We accomplish our mission with no fanfare under any and all conditions with dignity and honor. It has been a privilege to have captured these moments of our fellow employees and to be able to bring them to you today. We hope that you enjoy honoring, remembering, and exploring with us. If you are interested in learning more about this exhibit and what it takes to accomplish our mission, please visit our website at www.arlingtoncementary.mil.


Meredith Morrocovitz alongside Jack Curry. Jack, no huge news today when it comes to Luis Severino, but we did find out he's gonna go see another doctor. Right, Chris Amad, the Yankees physician, examined him today and Aaron Boone later revealed that on Monday Severino will go to New York. He will spend three days there undergoing a battery of tests. Severino later spoke about that and said, Dr. Amad didn't tell him anything new. He's just going to go see these specialists. He's going to get these tests and the Yankees is going to try and figure out why he's having that discomfort in his forearm. Yankees really are hoping they get some answers there. Luis Severino, while frustrated, does not seem completely concerned because it doesn't hurt him all the time. It's only when he throws that change up and it kind of comes and goes. It's not every time he throws the change up. Sometimes he doesn't feel any pain. They hope it's something that they could figure out, A, what it is, and B, take care of quickly. Right, and Aaron Boone was asked, does this delay in his spring training put opening day in jeopardy? And Boone said, let's let the Yankees get their hands wrapped around this, get some new information, find out exactly what is going on before he would even venture a guess as to whether or not Severino's beginning of the 2020 season might be delayed. Fingers are crossed. No doubt about it that he is going to be back in uniform soon.


special holiday greetings to one and all. It is this time of year when we pause to reflect upon the accomplishments of 2017 and to look forward to the new challenges of 2018. As I reflect upon the past year, I can see that there are many things to be thankful for though we've had many challenges. The holiday season gives us the opportunity to reflect on how we have lived during the past year and to also make new resolutions for the new year. As I recall, all of the events of 2017, we are much stronger nation today than when we started in 2017. And if we continue to work together to build St. Lucia, we would have a much better country in 2018. I want to take this opportunity to thank especially the members and staff of the Ministry of Economic Development, Housing, Urban Renewal, Transport and Civil Aviation for the level of support I have received and the commitment of those who have worked hard to be able to accomplish the task that we set out for ourselves. We do have a challenge in year ahead of us. Apart from the members of staff, I want to also compliment my colleagues and to wish them all the best for the holiday season. My cabinet colleagues and also my colleague parliamentarians on both sides of the political divide. It is this time of year when we set everything aside and we reflect and we decide on how we are going to do things better in the coming year. I want to wish all my colleague parliamentarians all the best for the holiday season in 2018. I want to take this opportunity to thank everyone and I want to give a good compliment to the holiday season and to everyone who has worked hard to be able to accomplish the task that we set out for ourselves. I also want to thank everyone who has worked hard to be able to accomplish the task that we set out for ourselves. I also want to thank everyone who has worked hard to be able to accomplish the task that we set out for ourselves. I also want to take this opportunity especially to thank my constituents of Castries Southeast. It is with your help that I have been able to represent you in the manner that I have been able to. As I reflect upon the level of support that I receive from the constituents, especially those who pray for me on a daily basis, those who meet me and encourage me to continue the work that I am doing, I am very thankful and I want to take this opportunity to wish everyone in Castries Southeast all of the best for the Christmas season and a bright and prosperous 2018. I also want to take this opportunity to thank everyone at Castries Southeast who has been able to come to the election for a long time. It is with your help that I have been able to work hard to be able to accomplish the task that we set out for ourselves. For everyone who has supported me, especially those who have helped me and encouraged me to continue to work hard to be able to accomplish the task that I am doing. I am very thankful that everyone has supported me and encouraged me to continue to work hard to be able to do the things that I am doing and to continue to work hard to be able to accomplish the task that I am doing. To the churches especially, I want to take this opportunity to thank all the pastors and leaders of all the churches within my constituency and the membership of the churches because the soul of the nation, the morality of the nation is so dependent upon where our church leaders lead our country. And so the work that you have been doing, I want to encourage you to continue to do it. As we go into this festive season, let us remember why we are celebrating. It is a time for reflection and a time when people should be thankful for the love of God towards us as a people and that Jesus came to be the person to show us how to love. Let us practice the love that he showed us. Also, I want to extend these special greetings to all Saint Lucians, both here and abroad. Wherever people are listening to this message at this point in time, I want to wish you God's richest blessings. I want to wish you all the best for 2018. As we reflect and we see 2017 could have been a better year, but we know that life will always have its challenges. I want to pause also to reflect upon my family, to thank my wife in a very special way for the level of support and encouragement that I receive from her all the time, even when the going is tough and when you've had a challenging day at work that I can go home to a place of peace and rest. I thank her for being who she has been and I want to thank her especially for her prayers and her support to the extended family, all my brothers, sisters, cousins, loved ones and even those who are not immediate family but treat me like family, I want to thank all of you. I would not have been the successful representative that I have been without your support and I continue to encourage you to continue to pray and support me as we go along. To all people all around the world who may have the opportunity to view this broadcast I thank you and I encourage you that we would live at peace as much as it depends upon us. I would not have the opportunity to thank my family in a special way for the level of support and all the support that I receive from her all the time. Without her support I would not have been able to do all that I have done. This is a place that I am very happy and I would like to thank all of you for your support and all the support that I receive from you. As we bring this year to a close, let us remember it is love that makes the world go round. Without love we cannot be the persons we ought to be.  Let us love each other and let a true time of peace reign during this holiday season and for the remainder of our lives. God bless you and happy 2018 to everyone. I thank you.


Dennis Day is brought to you by Colgate Dental Cream and Luster Cream Shampoo. Colgate Dental Cream to clean your breath while you clean your teeth. Luster Cream, the Cream Shampoo for true hair loveliness. The Dennis Day Show with Barbara Eiler, B. Benadera, Dinktrop, Charles Stanton, the orchestra, and yours truly, Vern Smith, is written by Frank Galen and stars our popular young singer in A Day in the Life of Dennis Day. Here's Dennis to sing the title tune from the new Edgar Bergen motion picture, Fun and Fancy Free. Fun and Fancy Free, that's the way that troubles, trouble me. Singing in the song, make you strong. You should take as a teaspoon full of song.  Winning secret of true hair loveliness. Your hair can be your most captivating charm with one touch of magic, Luster Cream Shampoo. Yes, whether your hair is honey blonde or raven black, sunny brown or fiery red, it's your natural hair appeal that men love. And more and more women of all ages are discovering that Luster Cream Shampoo brings out the fullest natural glory of their hair. Not a soap, not a liquid, Luster Cream Shampoo is an amazing new baby cream that whips up luxurious lather like magic in hard or soft water, sweeps dullness away and in its place leaves hair heavenly soft, shining, obedient. Out of her wealth of cosmetic lore, K. Dumont blended lanolin with special secret ingredients to achieve this almost magic new cream that offers your hair a stunning new sheen and finish. Try that economical dollar jar of Luster Cream Shampoo now at all cosmetic counters. Also 30 cent and 55 cent sizes. Thrilled to all those admiring looks coming your way when you begin using Luster Cream, the Cream Shampoo for true hair loveliness. Well, as you know, when our young hero Dennis Day met the girl of his dreams, Mildred Anderson, over a year ago, his immediate problem was to get on the good side of her mother. Unfortunately, he's made very little progress with that problem.  So this morning, he decided to seek some advice from one who's unquestionably a qualified expert on the matter, the cuter half of the Anderson family. Mr. Anderson. Yes, my son. I've been wanting to have a talk with you for some time, sir. It's about Mrs. Anderson. My little lump of love. Yes, sir, but with me, she isn't that kind of lump at all. In fact, she hates me. Oh, now, Dennis, I'm sure you're mistaken. It's probably just that you do something now and then that annoys her. Yes, sir, I breathe. Well, don't you stop my boy, even for her. But I got to do something, Mr. Anderson. I can't go through life or we're scared to death of her. Well, why should you, my boy? Now, I've known Pupsy for years, and I sure you she wouldn't harm a fly. Maybe not, but boy, the way she treats human beings. Dennis, you mustn't feel that way about my wife. She has a heart exterior, yes, but way down deep inside her is a sweet, kindly, lovely so-called. Mr. Anderson, I have no time for dredging. I need help now. Yes, son, I see your problem. Mrs. Anderson didn't have much respect for me either. Right up to the day that I asked her to come my wife. But then, she looked at me in a different light. Yes, sir, but I don't think a step like that would be practical for me. Well, to tell the truth, I really didn't have it in mind for you. But now, what we need is some little, oh, say, hey, wait a minute, I think I have it. Are you sure I want it? Yes, I think you do. Remember a few weeks back, my wife's club put on a drive to help juvenile delinquency? Yes, sir. Well, they have a new project now. They want the city of Weaverville to build a new jail. Gee, they must have helped juvenile delinquency no end. Well, no, no. As far as I know, the two projects are unrelated, except that because of her work on the other one, they made Mrs. Anderson the chairman of this one. Oh, I see. And you think if I could help her in some way... Exactly. Now, if she can get the city to erect a new jail, despite the objections of the mayor and the chief of police, I have a hunch the club presidency is in her lap. So, you see... Good morning. Oh, good morning, Mrs. Anderson. Good morning, blossom face. Gee, Mrs. Anderson, I just heard all about your problem with the new jail, and you know what? I'm going to help you. Dennis, don't say things like that, even if you're joking. But, Mrs. Anderson, I want to help. Don't you want to hear my ideas? Why should I? I might have a good one. You can't listen to your common sense all the time. Dennis, I'm warning you. Stay out of this. We're taking a public opinion poll on a new jail, and that's all that should be necessary to convince the mayor and the chief of police. But I know the chief of police personally, and I could have a talk with them and present your side of the case. Certainly not. Let's at least keep our old jail. If you get mixed up in this in any way, young man... Good morning, everybody. Oh, good morning, Mildred. Good morning, Mildred. Nailed it. Just remember what I said, Dennis. Come along, Herbert. Get your Hoover. This is your thorough cleaning day. Yes. My goodness, Dennis, what's the matter? Oh, I just hopped off to help your mother with the new jail, and as usual, I made quite a bit of backway. Gee, they really should have a new jail. Prisoners escape from this old rat trap and droves. It'd be wonderful if you could do something to... Say, wait a minute. An idea, huh? Oh, a beauty. Look, I'm the secretary of the committee headed by Mrs. Phillips to take a public opinion poll on the new jail. Yeah. Well, suppose I list houses to call on where we're sure no one's home. This is a beauty? Well, sure. Because there will be someone there. You. Me. Of course. At each place, you open the door just wide enough for Mrs. Phillips to hear you but not see you. Then in a different voice each time, you vote yes on the poll. Wonderful. Wonderful. That's trespassing, illegal entry, housebreaking. Not if we don't get caught. We'll pick places that are unoccupied or up for sale. Come on, let's go. You know what, Mildred? If you pass your ideas around to everyone in town instead of just me, they'd have to build a new jail. This house was open for inspection so we have a perfect right to be here. Gee, never in my wildest dreams did I expect to become all the answers on a public opinion poll. I wish I... Oh my gosh, look, here's Mrs. Phillips coming up the walk. All right, now, don't get excited. Just remember which way to vote and disguise your voice. Be Italian or something. Gee, I don't know much about Italian, but I'll try. Conducting a public opinion poll. That's a fine. I'm a vote to wee-wee. That's a mean mashu. I'm in a favor of the new jail. Who knew that I was going to ask you that? Well, uh, that's the question on everyone's lips, you know? Yes. Well, you happen to pass a vibe just to win a... to mine. Good night, please. Dennis, you've just got to be more careful after this. Yeah. Come on, her next stop is 349 Elm. Okay.  Does the city of Weaverville need a new jail? By sure, ma'am. As the clerk in the girdle department said of the fat lady, there ain't no getting around that. Very much. Oh, much better, Dennis. All right, let's go. Professor Nikolai Rudenski? Uh, da. I'd like to ask you a question, professor. Da? Yes. Will you answer it? Does Weaverville need a new jail? Da. Oh, thank you, sir. Goodbye. Da-da. I see I've got my opinions, but they're no for free. Now, if you'll give me a hipney for my thoughts. Ah, thank you, ma'am. I vote aye. Full dispense and domestic. Will Holder, do you think Weaverville should have a new jail? Oh, yes, sure. You betcha. Oh, sure. Me only say my flavor a new jail for Weaverville. You betcha. Well, thank you very much. May I have your name, please? Ah, me only say I'm hip long on passing dang ding dong bong from Hong Kong. Could you repeat that? Oh, no. Very solid. Just made it first time. So now on the top of the morning to your collie and darling, and what is it I can be after doing for you this fine morning to store a cushion of McCree? That's what your sign says outside the door. Dr. Goldberg. Oh. Tell me, Dr. Goldberg, do you think the city of Weaverville needs a new jail? You're asking me, and I'm telling you. Far down? Far so good, Dennis. And this is the last place. Yeah, but I'm running out of voices. I can't think of anybody else to be. Dennis, just use your imagination. You've got to think of one. Oh, my gosh. Here she comes. I'll run out and try to stall her while you think of something. OK. Yes, I knew you'd be passing by here, so I thought I'd meet you. How's the pole going? Oh, my dear, it's a landslide for us. But you know, the strangest thing, I never see anyone. No, they just open the door and crack and put their foot in it. Oh, really? Yes. And honest of all, they're all wearing the same clothes. Light brown slacks and sneakers. Even hold a Swenson domestic. Oh, well, you don't say. I do believe it's a trend, my dear. I must wire Adrian immediately. Who do I find in this last house? They've all been so unusual today. I beg your pardon, but could you open the door just a bit wider? No, I can't, because I'm only two-and-a-half years older there, too, sir. I've seen the fact that you're wearing light brown slacks and sneakers. Uh, second childhood? So, perhaps I'd better push open the door and find out for myself. No, wait, wait. Denis Day. So, it was you all the time. Well, Mrs. Phillips, I... You've ruined my pole. That's what you've done. My report is worthless. I'll have to tear it up. Well, Mrs. Phillips, I...  How could you do a thing like that? We use Mr. Anderson's car. The idea did blow up in our faces. You're not going to quit, are you? Yep. Denis Day, are you the kind of a man who takes a beating lying down? Nope. I get up and run. Well, you're not giving up. I have another idea. Oh, no, Mildred. Yes. This Mayor Brown who's fighting the new jail is a very impressionable man. Now, if an important senator from Washington in a big hat and a handlebar moustache told the mayor we needed a new jail, he... Mildred, no, not a senator. I won't do it. I won't. Denis? No, this I positively and definitely will not do, and that's final. Denis Day? Very well, pupsie. I'm a big senator from Washington. DC, that is. Senator, why this is a pleasure. Sit down, sir. Thank you, old master. We hear reports in Washington that you'd make a mighty good congressman. A congressman? Oh, senator, not really. Yep. Now, how do you stand on price control, Mayor? Labor, foreign relations, housing, the tariff? Well, gosh, I don't believe I ever gave any of them a thought. By George, you might even make the Senate. Gosh, senator. Honest? You bet, son. Only there's something standing in the way of your career. We hear... I say we hear you got a bad jail on this side. A bad jail? Mighty bad, son. We hear it so bad that you've got to lock people in it. But they're prisoners, senator. They vote, don't they? Well, yes. I love every one of them. But what can I do, senator? Building new jail, son, and fast. I've got big plans for you, but you've got to cooperate. Now, the first thing that we do... Oh, here's our chief of police. Chief, I want you to meet someone. Oh, hello, Denis. Hello, chief. Hello, as I was saying... Look at all this man, chief, and he's not a senator. A senator? Denis Day? That kills me. I don't think it's going to do me much good, either. I'm impersonating a senator, eh? Dave, do you know I could have you jailed for this? But I did it for a good cause, Your Honor. That jail you've got is an old rat trap. Why, anybody could break out of it. Anybody, huh? Why, sure they... Chief, why are you looking at me like that? You said anybody could get out, didn't you? Are you... are you... Is somebody going to get a chance? We're going to hold you on a technical charge. You've been impersonating a senator-wise guy. And if you can get out of our jail, we'll agree to build a new one. Me? You're going to put me in jail? Why, you'll be out in an hour.  Yeah, but suppose I was wrong. You'd leave a boy of my type in jail with those hardened criminals? That's their tough luck. They should have thought of that before they committed their crime. How are you coming with that hole? Okay. I ought to hit daylight any minute now. Not a boy. Keep digging. We got to get out of this... Wait a minute. Huh? Quick. Cover up the hole. Here comes the chief of the guy. Okay. Okay, kid. Right in here with these two boys. Well... I'll see you, chum. Hello, bunkies. What's the moniker, kid? The what? The name. I'm Harry the hook. Yeah, I'm Frankie the fake. Oh. I'm Dennis the day. What kind of a name is that? What kind of a name is that for a crook? Well, you see, I'm not really a full-fledged criminal. I'm just sort of an elderly juvenile delinquent. Oh, yeah? Yeah. They just put me in here to see if I could find a way to get out. Say, you boys don't happen to know anyway, do you? Oh, so that's it.  Huh? All right. Talk, kid. How much do you know? Big pardon? Oh, don't give me that. Spill it. How much do you know? Well, I went through junior high. That's not what I mean. Do you see this fist, buddy? Yes, sir. It's very nicely formed. How'd you like it in your face? I... I wouldn't. Then talk. Go on. Say something. Yes, sir. Under the spreading chestnut tree...  Yes, sir. Let me out, I'm Frankie. There's nothing I like better than taking care of a stooly. Lay off, Harry. The guy's no stooly. I'm Tully ears. Let me out, I'm... You're crazy, Harry.  Oh, yeah? Listen to your friend, Harry. A wise guy, huh? I'll show you how we handle stooly's around here. Harry, watch it! You push it right into the... Hey! Look, a big hole in the floor. Imagine that. Yeah, imagine. Say, we better tell the chief, huh? A proller could sneak in here that way. Did you hear that, Frankie? He wants to tell the chief.  Yeah, well, who pushed him into the hole in the first place, you lunkhead? Who are you calling a lunkhead? Who are you calling a dumb-ox? You. Oh, yeah? So you want a plane, huh? Yeah. Gentlemen. Fellas. Monkeys. Please. Hey, you'll have to hurt someone or you'll not be yourself. Harry, wait a minute! Oh, is that one? Frankie, don't hit him with that phone! I guess I just bring out the beast and people. Hey, what's going on here? Holy smoke. Frankie and the hook, both out cold. It's my fault, chief. You see, I am. Your fault?  Huh? Who are you? What's this? A hole in the floor. Yes, sir. That's what started it, you see. Oh, yes. Are you all right? Mildred and Mrs. Anderson, what are you doing here? The marathonist. We came down to get you all. What is this? What's going on here? This kid just cooled off both these thugs. What? Dennis? How did it happen? Well, the way I figured it, the kid dug that tunnel to make the break, he said he was going to make.  They got tough about it, so day here, well, let's have the rest of it from you, day. Oh, no, go right ahead. You're doing fine. Good heavens, look at the size of the hole he dug. And in less than five minutes. How did you do it, day, with no cool tools of any kind? Oh, it wasn't very hard rock, I just used my teeth. Good gosh. Well, this boy has taught me a lesson. The town does need a new jail and I'm going to see that it gets one. Dennis, sugar baby, you doll you. Me, I lead the most unpredictable life.  I'm going to kiss him. I think he's just the most lo- Dennis Day, come up out of that hole. Yes, ma'am. Dennis Day will be back in just a moment with the song. But first, here's a fact worth knowing. Colgate dental cream cleans your breath while it cleans your teeth. And just how important that is, our Colgate players are going to demonstrate. Let's look in on a young couple with a love seat but no love. Listen. Gosh, Judy, you sure are scrappy lately. I've been spending more time in the doghouse than Fido. Jim, I don't like these cat and dog fights any better than you do. Well, then tell me what the trouble is, Judy. Jim, your Dennis can handle that subject better than I can. So ask him, won't you? And here's what Jim found out. Scientific tests prove that in seven out of ten cases, Colgate dental cream instantly stops unpleasing breath that originates in the mouth and Colgate's safe polishing agent brings out the natural sparkle of your teeth, cleans them thoroughly and safely. Yes, Colgate dental cream cleans your breath while it cleans your teeth. And Colgate dental cream is famous for its wonderful wake-up flavor, too. Nationwide tests of leading toothpaste prove that Colgate's is preferred for flavor over other brands tested. So to clean your teeth thoroughly and safely, for a wake-up flavor everyone enjoys, use Colgate dental cream. Remember, Colgate dental cream cleans your breath while it cleans your teeth. With Charles Dand in the orchestra, here's Dennis to sing the beautiful old favorite, the Whiffin' Groove song. And the magic of theirs, that's the magic of their singing. Remember, doctors prove the palm olive plant brings two out of three women lovelier complexions in 14 days. And this beauty plant with palm olive soap was tested on women with all types of skin. Dry, oily, even skin that was not clear. Yes, 36 doctors prove the 14-day palm olive plant improves all types of skin. Brings fresher, brighter, younger-looking complexions. So get palm olive soap and start your 14-day palm olive plant now. This is NBC, the national broadcasting company.


Hi, welcome to the Key Factor DevOps Workshop. Today we're going to cover securing your containers using EJBCA. My name is Eric Meisel, I'm the Field CTO here at Key Factor and my good colleague Sven. Hello, Sven Reiler, the International PKM and of Mystery. I love that title by the way, right? Sven is an awesome PKI guy. So if you ever need help with PKI, this is your guy. So for today, we're going to cover a few things. We're going to talk about how to deploy EJBCA in a container. We're going to talk about how to issue certificates to an Istio service mesh using the CSR API. We're going to show you how to use a Vault plugin so that you don't have to change code and you can actually get certificates from EJBCA through existing mechanisms where you get searched from Vault today. And then we're going to finally finish up using CERT Manager with this new external issuer that we built with EJBCA. So that's our agenda. So kicking it off, the first workshop, we're going to talk about how to deploy EJBCA in a container. And I'm going to hand it over to my good friend Sven to walk us through it. All right, thank you. So we will first go into the image here that we've got and we've got our Jupyter Notebook open. And what we've got in the first section here is deploying EJBCA using Helm. So Anton, one of our professional service engineer put together a Helm chart for us. And what we have are the different sections that really are kind of important to this, the first one being the environment and variables that we deploy EJBCA with. We've got the JDBC URL and the password set to connect to it. We're going to set audit log to true. So that means our audit logs will actually be stored in the database. And then we're also going to do the TLS setup enabled equal simple, which means for this tutorial, we can just log into EJBCA without having an MTLS CERT at the time. And then we can lock that down later. The next section we have is the image area, where we're going to be pulling the container from Docker Hub. And you'll see that new tag of the 8.1.0 beta. I got us a special community release with the new APIs to use for this tutorial. And then the next section is how do we access EJBCA? So with that, we'll be using the proxy AJP along with an ingress. And what that will give us is the ability to access inside the cluster for containers running in there, as well as us accessing outside of the cluster. That way you can run EJBCA in the Kubernetes cluster and have both the external and internal access, all from the same instance of EJBCA. And lastly, we've got the resources section, which specifies how much CPU and memory we'll be allocating to our container. So you can tweak this around to your own settings in your environment. All right, so with that, we'll run our command to deploy with the Helm chart using the values YAML that we just went over. So we'll click the Play button, and that deploys. All right, the next step is where we're going to deploy a patchy HTTBD, which we're using as a reverse proxy inside of our Kubernetes cluster. And this is serving a couple purposes. Number one, it's how any container running internal will go to access EJBCA through it, as well as pulling any revocations, such as CRL or OCSP, or if you wanted to download the CA certificate inside the Kubernetes cluster. And then the ingress that we added through the Helm will also go in through the reverse proxy as well. So in the configuration, we have another ingress that we actually added outside of the Helm to route the OCSP, CRLs, and the AIA access into this Apache proxy, too. So it's kind of multifaceted with what we're doing. And you can take a look at the YAML file in there, too, if you want to see all of the magic of what I created. So with that, let's go and run that guy. So we will click the Play button on step two, and it launches. And then we can give that a few seconds like this. Because the next command we're going to run will actually go and check the logs of the EJBCA container. And we're looking for a string that says the health check now reports the application status at EJBCA public web health check, EJBCA health is up. And when we see that message in the logs, that's telling us that EJBCA is ready to use now and the container is up and running. So let's go ahead and give this a try and see what we get back. All right, so it did come back with a new health stamp. So at this point, we are ready to begin using EJBCA, Eric. Dude, that took forever. I'm sorry. I'm sorry. I don't know if you guys are about you guys, but taking that long to deploy a CA, that's crazy. So we've got EJBCA up. Now we're ready to go, right? So magic happened, downloaded some bits, got it on the box. So now what we're going to do is we're going to start to look at how we can use EJBCA to serve a bunch of DevOps use cases, right? So whether I want to get searched into Istio service mesh or through a vault or through another way, we're going to talk about those. So first use case up is using the Kubernetes CSR API. Now what's interesting about this is this API has been around, seems like for a while, but it's been experimental for ever. Yeah, and so I don't know. It doesn't feel like it's ever going to launch, but yet I think people are using it. We have customers using it. So the nice part about it is what happens is that when you plug this in, it's going to redirect to call EJBCA. So part of this workshop is to show you guys how to do these different things using EJBCA, where others might be using an inbuilt CA like Citadel or Hashicorp or some others. Or even the built-in Kubernetes CA in the cluster. Exactly. And they're finding that that's breaking policy at their org. And they're like, hey, we need to go to something that's standard, that is compliant. Exactly. So this allows you to deploy without changing code. So we're going to be able to use this plug-in to redirect to call EJBCA. So without further ado, we'll turn it over to Sven and he's going to show you how to enable this CSR API and to go get search from EJBCA, that one we just built. All right, let's go over and check that out. So now we're in the section of Issue Certificates to Service Mesh. So we're using the EJBCA CSR signer integration, which is in our GitHub. And you can see how it's a blue text, so it's a link. So you click on that and it'll take you over to the GitHub repo so you can see the code. We've deployed this with the Helm chart that's in there. And the thing to point out with this is in the EJBCA settings here in that little YAML text snippet we've got, a one-day ephemeral search. So what that's telling us is that with the ephemeral search we've configured, we're not going to be keeping those search in the EJBCA database because they're one day. And with that lifetime like that, that just obviously fill up too much and we don't really need that. This is more think session based at that point because with service meshes things are coming and going up and down. We're always issuing you certificates so we don't need a long lifetime on those. And we've got the values YAML on the OS here in the path and check that out. So now we're in the section of issue certificates to service mesh. So we're using the EJBCA CSR signer integration which is in our GitHub. And you can see the little how it's a blue text so it's a link so you click on that and it'll take you over to the GitHub repo so you can see the code. We've deployed this with the Helm chart that's in there, namespace. So our namespace is where we're going to organize everything like logically. It's kind of like you can think of like an Azure tenant I guess if you're in the cloud world or if you're already familiar with namespaces and Kubernetes, you get it. All right, so then we'll go down and create, we'll deploy the book info app from Istio. And it's using an app that's already there, yeah? Yep, we're using it there. So when we deploy that, that instantly kicks off the certificate issue and so all the containers spinning up in the mesh will be generating CSRs and the CSR API will send that over to EJBCA to give us a certificate. And so as that kicks off, we'll add a gateway in. So we'll click the little play button again. And now we're going to go and tail the logs with the container. So we'll click the play on that one. There we go. So it loads and we'll scroll through the text. So we want to look in here for this begin certificate request, that's good. What is that begin certificate request? That means we're generating certificate requests from the containers booting up and those will be sent over to EJBCA to get signed. So the next thing we want to look at is a begin certificate that we actually got a cert back and that'll be a bigger blob with the cert contents. So it comes through and ooh, there we go. We got some certificates too. So I mean, it's that easy to get certificates with CSR API and a service mesh like that. So you didn't have to change any code, right? No, we didn't have to do anything. Just enable the plugin. Yep. And remember, the policy is driven from the EJBCA side because that's where our cert profile and identity profile are configured with this integration. I think that's the important thing to touch on. So depending on the audience who's watching, developers, I'm a dev by heart, security is not my thing. It was not my thing. It is now, right? But the thing is, with a lot of these tools that we use, Kubernetes, Vault, any of these tools, you can request a cert of any longevity you want, any key length you want, you can do whatever you want and that's breaking policy. And so what we're offering here with EJBCA is policies enforced by the CA. The PKI where it should be. Exactly, exactly. Perfect. All right. Next up. Next up. So a lot of people use hashi. Nothing wrong with hashi, right? Great tool for secrets. Great tool. It actually has an inbuilt CA. Part of the problems there with the hashi is there's lack of missed two requirements. A lot of the InfoSec teams struggle with it because, again, going back to what we talked about, policy enforcement, getting any kind of cert you want, the keys aren't in an HSM. There's different things there that are break InfoSec policy rules. So we built a plug-in that allows us to redirect the calls to EJBCA. So much like you just saw with the CSR API, where it redirects to EJBCA, same thing here. So if you're using an application or your service mesh or your Kubernetes cluster is calling into hashi to get a cert, they'll actually redirect it to EJBCA, where we work the magic. So again, handing it back over to my good buddies fan. Let's go through that. Let's go take a peek-a-boo. So what we have here, we scroll down to the issue certificates through the hash corp vault with EJBCA. So thing to note is, I think like two or three years ago, we released a vault plug-in. And this is the new vault plug-in that we did. As you may or may not know from using the old vault plug-in, it only worked with a single instance of vault. You couldn't do it or could not use it with Vault HA. And with this one in the tutorial I did, I really wanted to take advantage to show now that HA works. So what we did is we did a three-node Vault HA cluster with containers deploying with the Vault Helm chart. We also used the init container in the Vault Helm chart to download and compile the EJBCA vault plug-in, which then puts it just in a volume out within each of the three vault instances. And then we configured that to issue a certificate type of a five-day, I believe. Yes, client-off-cert and a role for that. The big one with this is you can issue multiple certificate profiles and entity profile types with this plug-in, too, by just creating different roles. So it's quite scalable at that point. And from what I understand, too, you can even assert different CAs in this as well. And it's very robust compared to what we had before. It's something that I've been wanting for. And I finally got a dev to help me out with that. And now it's there for us to use. And as well, the link for that repo is the blue text in here. So you can link over to that to be able to go and check that out. So with that, the first thing we need to do is unlock Vault because the VM just came up. Vault is locked. So we'll have to go through all three instances to unlock those. So let's do that real quick by clicking the little Play button to unlock the first instance. And we can see how it goes from true, true to false sealed. So now this one's unlocked. And then we'll do our second instance. And that's true, true. And then the last one should be false. And then we'll do the last instance. All right, so we've got Vault unlocked. So with Vault unlocked, the next thing we need to do is to log into Vault. So we'll get a token to be able to log in. And that will actually let us be into issuing certs. So we'll go ahead and click the Play button to do a log in here. All right, we've got a token back to log in. And we've got a little note in there. If you actually want to see the docs for all the settings of a role, you can run the command just above step five there to check that out. So one of the things, too, as we talked about is, in this instance, for the lab, we're logging straight into Vault and running commands. Whereas you guys would be running, your application would be calling into Vault. Or whatever's calling into Vault, we don't have an app tied into it. So we're just running command. Exactly, yeah. The idea was really, I wanted to package this up so we could focus as much on just issuing certs to this so you guys can go and play with it on your own after this. I guess we should give a little more context. So we have an OVA here that you guys will make available that you can run either in VMware or in VirtualBox that you can go through all the stuff. See the setup, see the configuration, run it, test it, try it, and then you can be able to port it over to your world very easily. Exactly, all right. So we'll click the play button to do our first cert. And there we go, we got a cert back. You can see all the payload of it. And this one was with the PEM bundle, so it's a big blob. So the next format we'll try is just a PEM. So we can click the play button here. And we get another cert there with the CA chain in it, and the issuing CA. And then lastly, we'll go through and do one without the root chain included in that bundle that it's returning. So we'll click the play button for that.  So really, really straightforward to just be able to get certs right through the vault. And so since we did these and these ones were not ephemeral, let's go take a look in RAweb. So we'll pop up in a new tab here and click on the RAweb link and accept a little cert coming in. Clearly, this is a lab. Yeah, right. And then we'll go to certificates and we can go look at those. So we can see here that we'll go by our cert type to have a little more fun with that. So we want the five-day these guys right here. And we can see the ones we just issued through Vault right here. And view those and take a look at how they came out. Yeah. So that easy to issue certs with Vault and need to be CA now. That's awesome. So the nice part, as you mentioned it earlier, is that you can change. You can have multiple different kinds of certs, serving different use cases by role. But again, no code changes. There's configuration, quick deploy. You don't have to change anything and now your devs can still get their certs. But they come from EJBCA. And what's even cooler in my world is that it was all in containers too. Yeah, we weren't even using VMs. Yeah. Let's say soon next level. Love it, love it. All right, on to the last one, last and final. So cert manager is evolving, right? I think it's becoming sort of the defecto. Exactly, yeah. I mean, we're seeing it with all our customer engagements where we're going and talking to them. And they're like, hey, we're really interested in deploying EJBCA in a container. And my first question is, do you cert manager? Yes. And then I'm writing Eric, hey, Eric, I really need some dev time to get that cert manager integration done. What's nice about cert manager is it used to be just ingress egress with Acme. But now it serves MTLS into the cluster, which is phenomenal. And the ingress egress in Nomura Acme, which is magic for I think anyone. I think the Acme stuff is what people are a little bit tired of. So now we have a provider service that Sven's going to walk us through that, again, another plug-in sits next to cert manager as an issuer service and allows us to get certs from EJBCA. So let's take a look. All right, let's go. So now we're in the issue certificates through cert manager with EJBCA section. So with this, cert manager added the ability to add an external issuer for integrations to come in quicker. So we're actively working to get a pull request and GitHub to get EJBCA added as an external issuer. And on the VM here, we do have the container that was built for this and the source code of the CRDs that are added for this to make this all work. And in the YAML blob here, we see an issuer. So with this plug-in and integration, you can use an issuer or a cluster issuer. Both of them are supported with this. So just like any other cert manager integration we're the same way. You can have issuers for different CAs. And again, the whole a la carte of creating issuers for your different cert profiles, identity profiles for your certificate needs. And the best part is, again, all of the cert policies driven on EJBCA. No configuration for policy stuff on the Kubernetes side with the integration here. I think for all you devs out there that are butting heads with your implicit team, this solves a lot of problems. Exactly. And just makes it so easy because you've already got cert manager in place. So all you're doing is adding another issuer into the Kubernetes cluster to be able to take advantage of. Dare I say a better issuer? Maybe. One ring. That's right. All right. So the first thing we're going to do is just manually deploy a YAML file to issue a test TLS cert. So if you were actually deploying an application and setting that up to get the TLS cert, you could handle that automatically. But we're just really keeping the simple to get the most out of just how easy it is to just issue certs like this. So we'll click Play here to load that. And so that creates our object. Then the next thing we want to go do is we want to go describe that object so we can see that it was created. So here we've got it described. And we can see that it was done and is added like that to issue the certificate. So then we'll go grab the secret names. OK. So we've got our secret here. And it's the secret MTLS test 01. And then lastly, let's go actually look at that secret to see that it's populated. And now we can see that it is populated. And we've actually got data in there for the TLS cert and the key. And yes, it's small. But that's because we're using elliptic keys. So they're going to be nice and small cert sizes. And since that did issue a five-day cert, we can also go back over to our other tab here and check that out in the RE web and just go back to Overview. So the nice things about EGBCA is we can set up certs to be ephemeral. And we can set them up to not be. And so you get a lot of flexibility. So based off your use case, so if it was ingress egress, those wouldn't be ephemeral. But typically within the cluster MTLS would be. So you get both kinds. And there we go. Perfect. Awesome. All right. So what did we learn? How easy was it to play EGBCA in a container? Exactly. That was crazy easy. I can't believe how quickly that came up. And then we talked a lot about getting certs into Kubernetes using CSR API, using cert manager. Looked at how you can put in the HashiCorp vault eGBCA plugin to make it easy for you to take what you were doing and redirect eGBCA. And so for more information, here's some QR codes that you can get information on where all this magic is, right? So that's all out there for you guys. Hope this was useful. It was a great being here, Sven. Rockstar, this is an amazing OVA. We'll make all the stuff available for you guys to grab from a GitHub that will be part of the package that gets delivered when this goes live. Thanks for joining. Yep, thanks, guys.


Civilians must stay inside. Civilians must wear protection. Civilians must obey the authorities. A dangerous infection named SCP-610 is in your area and you must immediately follow safety instructions to stay safe. This guidance requires that you stay inside, wear some form of protective clothing, and obey the authorities. Suitable authorities include your national government, as well as the international security groups, the SCP Foundation, and the Global Occult Coalition. Treatments for SCP-610 are being developed by these organizations and will be made available when possible. While these treatments are developed, follow safety guidance and immediately contact the authorities if someone you know displays symptoms. Symptoms include a rash, physical mutations, heightened aggression. Thank you for your cooperation. Stay safe, secure, contain, protect.


Hey, what's going on guys? Root of the Null here coming back at you with another Python tutorial. Let's fire up idle and let's get to programming I'm gonna create a new script here save this as a file.python USR bin environment Python we get our shebang line started create a new class Define a constructor Initialize this with the self keyword passing as a parameter as always Let's go test if this is the current script if name is equal to main And now we can create a new object and We can start programming. All right. I'm going to create a string variable I'm going to call the self dot string and then set its value to a this string Has random Cases There you go All right now the function that I want to show you guys today is Evidently called swap case and what this will do is it will swap every lower case letter that you see in your string for an Upper case letter and every upper case letter you see in your string into a lower case letter So if we print out our original string first of all print out self dot string Let's concatenate on some new line characters here. So our code is a little bit free and Now we can print out the The function self dot string it's always going to be your strings name as a variable You can use your dot selector and then run swap case Now luckily swap case does not take any parameters. It just gets the job done So now that H has been turned to a capital H the the I is in the S's have been turned into lower case and Then everything everything in the string has been changed from a capital at least lower case and eat the capital Nd and that sort of thing you can see there's an evident difference here But it doesn't touch any of our spaces or our exclamation points or anything that isn't a letter So we better be able to make up for that and outside of our own function and let's go ahead and start writing our own Let's Define it's with our DEF keyword. I'm gonna call mine swap case I'm passing the cell variable as always and the string to swap All right, let's get our code block started and now we're gonna use a new string This is gonna be a blank string for now But this is what we're gonna return because we can't modify the string that we've been passed to it So we have to create a new one and let's get the length of the alphabet because we're gonna have to loop through something So alphabet length equals the length of the le and function of string And then you can pass in either ASCII uppercase or ASCII lowercase I'm gonna pass in lowercase and now remember we're using this string module here So we have to go up go up to the top of our script and type in import string So we can have access to everything that's inside that module now We can begin to loop through all through all the things inside of our string. So for character in string to swap We can sort of create code block here and then we can test if the character is In string dots ASCII lowercase. So if it's a lowercase Letter what we're gonna do is we're gonna begin to loop through all of those things that are inside the lowercase So we can do for I in range And we'll pass in the length of the alphabet so we can start counting and we can index with I Whatever letter we need so now we can test once more if string Let's see dot ASCII lowercase Since that's the one we're testing for this time I is equal to the current character that we're looking at Character what we can do is We can add from new string We can append on their string dot ASCII uppercase so we can switch The the case of the letter and we're gonna pass in that I variable as an index here So that way we get the current character just the uppercase form of it And then we can break out of the for loop that we're going in right now And now we're gonna want to create this as a new case So if you can we can test else at the uppermost if statement that we have here if the character is an ASCII lowercase We're gonna want to test if the character is a is inside the string dot ASCII uppercase So we're just gonna do the same thing here, but reverse So now we can do a for loop for I in range alphabet length Get a new code block Test if the String dot ASCII uppercase The current I variable is equal to the character that we're looking at if it is we can add on New string plus equals string dot ASCII Lowercase and Then pass an I Now it can break out of our current for loop and we should be done here But now once we have this elf statement We've tested for things that are lowercase and then for cut for uppercase So now we should do is test for it's not if it's an uppercase or lowercase So if it's a if it's a space or that exclamation park that we had so we're going to do is have the if that's inside This L statement will add an L statement on to there So if it's neither lowercase or uppercase if it's not a letter Then what we're gonna have to do is new string and then add the current character And now we're done looping So when we break out of this topmost loop here what we can do is we can return The new string that we've created So if we go up here, and we we go back into our constructor when we run this Self dot swap case remember we name that function and now we can pass in self dot string So we can run this and we have the exact same output as the swap case that we ran beforehand So now we can change some of the cases in here this string has random cases And that sort of thing it'll still change it the way appropriate to change it the way it should So look what we've done. This is created a interesting function here It solves the same thing that the original swap case function would do but we've taken a look at it and see how it works on the back end and We're using the string module to be able to test for uppercase and lowercase letters and that sort of thing So thank you guys for watching. I hope you enjoyed this. I know this one is a little bit simple The more easy the better. Thank you guys for watching again, and I will see you in the next tutorial. Bye