Re: SecurityManager

Thanks Greg. Security is quite critical and thus we went the SSL and
Certs route.=20

For now, I do have a SecurityManager(SM) in place with a policyfile that
sets the flag to 'AllPermissions'. That seems equally bad and mucking
with it seems to create more problems. My team tried a few controlled
edits of the policyfile to provide disk r/w/ex access but clients do not
seem to make a successful connection to the server when we restrict
certain IP and port access.

I understand that a SecurityManager is needed when you build a generic
service. SM checks and provides the stubs to the clients at run-time.
But, if you do distribute the stubs as compiled classes, and if the only
way a client can connect to the server is via SSL, then I fail to see
the advantage SM brings into the picture.

I would rather not provide one at all than having a policyfile that
allows 'allpermissions'.


-----Original Message-----
From: Gregg Wonderly [mailto:[email protected]]=20
Sent: Thursday, December 18, 2008 3:37 PM
To: Surendra Lingareddy
Cc: [email protected]
Subject: Re: SecurityManager

Surendra Lingareddy wrote:
> We have a controlled environment where the server and clients most
> likely will be in the same network. Our packaging is done where the
stub
> files are provided to the client so that no one the downloading
business
> needs to happen. In this case, is a SecurityManager necessary at all?
> Also, to provide security, we are use SSL factories to make the
> connection between a client and a server.=20

The SecurityManager has to be set due to explicit checks in RMI.  You
ask if it=20
is necessary.  In your case, it probably isn't doing anything to enhance
normal=20
activities.  But, you should always keep security in mind and try and
protect=20
your environment from things that you haven't anticipated.

The current state of the world regarding viruses is predominately
related to=20
Microsoft not addressing security as a primary thing from the start.
Later,=20
they became more interested in it, or so it seems.  But if you watch the
CERT=20
advisories, MS is still the predominate source of issues.  Thus, there
are still=20
things happening that they didn't anticipate which are creating
problems.

It is much easier to have a policy file with no controls, and to make
everything=20
just work without any real security.  But, in the end, that's what makes

everything that you don't want to happen, happen...

Gregg Wonderly

CONFIDENTIAL: This email, including its contents and attachments, if =
any, are confidential. If the reader of this e-mail is not an intended =
recipient, you have received this e-mail in error and any review, =
dissemination, distribution or copying is strictly prohibited. If you =
have received this e-mail in error, please notify the sender immediately =
by return e-mail at [[email protected]] and permanently delete =
the copy you received. Copyright and other intellectual property rights =
in its contents are the sole property of Crossroads Systems, Inc. Email =
transmission cannot be guaranteed to be secure or error-free. The sender =
therefore does not accept liability for any errors or omissions in the =
contents of the message which arise as a result of email  transmission.  =
Although we routinely screen for viruses, addressees should check this =
email and any attachments for viruses. We make no representation or =
warranty as to the absence of viruses in this email or any attachments.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff RMI-USERS".  For general help, send email to
[email protected] and include in the body of the message "help".

For a list of frequently asked RMI questions please refer to:
http://java.sun.com/j2se/1.3/docs/guide/rmi/faq.html

To view past RMI-USERS postings, please see:
http://archives.java.sun.com/archives/rmi-users.html