Re: [jetty-user] Encrypted passwords in .xml files
Greg Wilkins <[email protected]> Thu, 26 Sep 2013 12:30:49 +1000
| Newsgroups | gmane.comp.java.jetty.support |
|---|---|
| Message-ID | <CAH_y2NF+PLL_OZz-41VNtFeCpROQrhi_0bjrYU3k6qKRrJRk+A@mail.gmail.com> |
--e89a8f23558171e41e04e74028e7 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Walter, the CRYPT password decoration is a one way encryption, so Jetty is unable to recover the password to pass to the DB2 datasource. Crypt is really only of use if you are given a password (eg from a client) that you Crypt and then compare to the crypted version stored locally. You can use OBF:, but that is not strong protection. It only protects from a casual look over the shoulder and anybody with the OBJ string can decode it. To really crypt passwords, you need support from the datasources. On 26 October 2010 17:43, <[email protected]> wrote: > > Peter, > > This looks fine, but I like to use this for datasource > > ex. > > <New id=3DDB" class=3D"org.mortbay.jetty.plus.naming.Resource"> > <Arg>jdbc/DB</Arg> > <Arg> > <New class=3D"com.ibm.db2.jcc.DB2SimpleDataSource"> > <Set name=3D"DatabaseName">database/Set> > <Set name=3D"User">user</Set> > <Set name=3D"Password">password</Set> > <Set name=3D"ServerName">server</Set> > <Set name=3D"PortNumber">nnn</Set> > </New> > </Arg> > </New> > > java -cp lib/jetty-6.1.24.jar:lib/jetty-util-6.1.24.jar > org.mortbay.jetty.security.Password user password > password > OBF:1v2j1uum1xtv1zej1zer1xtn1uvk1v1v > MD5:5f4dcc3b5aa765d61d8327deb882cf99 > CRYPT:usjRS48E8ZADM > > I adapt to : > > <New id=3DDB" class=3D"org.mortbay.jetty.plus.naming.Resource"> > <Arg>jdbc/DB</Arg> > <Arg> > <New class=3D"com.ibm.db2.jcc.DB2SimpleDataSource"> > <Set name=3D"DatabaseName">database/Set> > <Set name=3D"User">user</Set> > <Set name=3D"Password">CRYPT:usjRS48E8ZADM</Set> > <Set name=3D"ServerName">server</Set> > <Set name=3D"PortNumber">nnn</Set> > </New> > </Arg> > </New> > > But when starting the server, exception on invalid password. > > Walter > > > > > > > > > *Peter Ondru=C5=A1ka <[email protected]>* > 25/10/2010 20:23 > Please respond to > [email protected] > To > [email protected] > cc > Subject > Re: [jetty-user] Encrypted passwords in .xml files > > > > > http://docs.codehaus.org/display/JETTY/Securing+Passwords > > On Mon, Oct 25, 2010 at 4:00 PM, <[email protected]> > wrote: > > > > Hi, > > > > We are using the jetty.xml file for our application and inside this fil= e > we > > declare some datasources. One of the properties of this configurarion i= s > a > > password to be used for the database connection, which is readable insi= de > > the jetty.xml file. Are there some ways to have these kind of properti= es > > encrypted? > > > > Walter > > > > > > -- > Peter > > --------------------------------------------------------------------- > To unsubscribe from this list, please visit: > > http://xircles.codehaus.org/manage_email > > > > --e89a8f23558171e41e04e74028e7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div><div><div><br></div>Walter,<br><br>the CRYPT password= decoration is a one way encryption, so Jetty is unable to recover the pass= word to pass to the DB2 datasource.=C2=A0 Crypt is really only of use if yo= u are given a password (eg from a client) that you Crypt and then compare t= o the crypted version stored locally.<br> <br>You can use OBF:, =C2=A0but that is not strong protection. =C2=A0It onl= y protects from a casual look over the shoulder and anybody with the OBJ st= ring can decode it.<br></div><font><font face=3D"Courier"><br></font></font= ></div>To really crypt passwords, you need support from the datasources.<fo= nt><font face=3D"Courier"><br> <br></font></font><div><font face=3D"Courier"></font></div></div><div class= =3D"gmail_extra"><br><br><div class=3D"gmail_quote">On 26 October 2010 17:4= 3, <span dir=3D"ltr"><<a href=3D"mailto:Walter.Heestermans@toyota-europ= e.com" target=3D"_blank">[email protected]</a>></span= > wrote:<br> <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex"> <br><font face=3D"sans-serif">Peter,</font> <br> <br><font face=3D"sans-serif">This looks fine, but I like to use this for datasource </font> <br> <br><font face=3D"sans-serif">ex.</font> <br> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 <New id=3DDB" class=3D&= quot;org.mortbay.jetty.plus.naming.Resource"></font> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 <Arg>jdbc/D= B</Arg></font> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 <Arg></font= > <br><font face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<New class=3D"com.ibm.db2.jcc.DB2SimpleD= ataSource"></font> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <Set name=3D"Datab= aseName">database/Set></font> <br><font color=3D"blue" face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <Set name=3D"User">user</Set></font> <br><font color=3D"blue" face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <Set name=3D"Password">password</Set></font> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <Set name=3D"Serve= rName">server</Set></font> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <Set name=3D"PortN= umber">nnn</Set></font> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 </New></font> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 </Arg></fon= t> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 </New></font> <br> <br><font face=3D"Courier">java -cp lib/jetty-6.1.24.jar:lib/jetty-util-6.1= .24.jar org.mortbay.jetty.security.Password user password =C2=A0</font> <br><font face=3D"Courier">password</font> <br><font face=3D"Courier">OBF:1v2j1uum1xtv1zej1zer1xtn1uvk1v1v</font> <br><font face=3D"Courier">MD5:5f4dcc3b5aa765d61d8327deb882cf99</font> <br><font face=3D"Courier">CRYPT:usjRS48E8ZADM</font> <br> <br><font face=3D"sans-serif">I adapt to :</font> <br> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 <New id=3DDB" class=3D&= quot;org.mortbay.jetty.plus.naming.Resource"></font> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 <Arg>jdbc/D= B</Arg></font> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 <Arg></font= > <br><font face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<New class=3D"com.ibm.db2.jcc.DB2SimpleD= ataSource"></font> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <Set name=3D"Datab= aseName">database/Set></font> <br><font color=3D"blue" face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <Set name=3D"User">user</Set></font> <br><font color=3D"blue" face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <Set name=3D"Password">CRYPT:usjRS48E8ZADM</Set></font> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <Set name=3D"Serve= rName">server</Set></font> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 <Set name=3D"PortN= umber">nnn</Set></font> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 </New></font> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 =C2=A0 =C2=A0 </Arg></fon= t> <br><font face=3D"sans-serif">=C2=A0 =C2=A0 </New></font> <br> <br><font face=3D"sans-serif">But when starting the server, exception on invalid password. </font> <br> <br><font face=3D"sans-serif">Walter</font> <br> <br> <br> <br> <table width=3D"100%"> <tbody><tr valign=3D"top"> <td width=3D"27%"> <br> <br> <br> <br> <br><font face=3D"sans-serif" size=3D"1"><b>Peter Ondru=C5=A1ka <<a href= =3D"mailto:[email protected]" target=3D"_blank">peter.ondruska@gmail= .com</a>></b> </font> <br><font face=3D"sans-serif" size=3D"1">25/10/2010 20:23</font> <br><font face=3D"sans-serif" size=3D"1">Please respond to<br> <a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]= ehaus.org</a></font> </td><td width=3D"72%"> <table width=3D"100%"> <tbody><tr> <td> <div align=3D"right"><font face=3D"sans-serif" size=3D"1">To</font></div> </td><td bgcolor=3D"white" valign=3D"top"><font face=3D"sans-serif" size=3D= "1"><a href=3D"mailto:[email protected]" target=3D"_blank">user@jetty= .codehaus.org</a></font> </td></tr><tr> <td> <div align=3D"right"><font face=3D"sans-serif" size=3D"1">cc</font></div> </td><td valign=3D"top"> </td></tr><tr> <td> <div align=3D"right"><font face=3D"sans-serif" size=3D"1">Subject</font></d= iv> </td><td bgcolor=3D"white" valign=3D"top"><font face=3D"sans-serif" size=3D= "1">Re: [jetty-user] Encrypted passwords in .xml files</font></td></tr></tbody></table> <br> <table> <tbody><tr valign=3D"top"> <td> </td><td></td></tr></tbody></table> <br></td></tr></tbody></table><div class=3D"HOEnZb"><div class=3D"h5"> <br> <br> <br><tt><font><a href=3D"http://docs.codehaus.org/display/JETTY/Securing+Pa= sswords" target=3D"_blank">http://docs.codehaus.org/display/JETTY/Securing+= Passwords</a><br> <br> On Mon, Oct 25, 2010 at 4:00 PM, =C2=A0<<a href=3D"mailto:Walter.Heester= [email protected]" target=3D"_blank">Walter.Heestermans@toyota-europe.= com</a>> wrote:<br> ><br> > Hi,<br> ><br> > We are using the jetty.xml file for our application and inside this file we<br> > declare some datasources. One of the properties of this configurarion is a<br> > password to be used for the database connection, which is readable inside<br> > the jetty.xml file. =C2=A0Are there some ways to have these kind of properties<br> > encrypted?<br> ><br> > Walter<br> ><br> <br> <br> <br> -- <br> Peter<br> <br> ---------------------------------------------------------------------<br> To unsubscribe from this list, please visit:<br> <br> =C2=A0 =C2=A0<a href=3D"http://xircles.codehaus.org/manage_email" target= =3D"_blank">http://xircles.codehaus.org/manage_email</a><br> <br> <br> </font></tt> <br></div></div></blockquote></div><br></div> --e89a8f23558171e41e04e74028e7--