How to encrypt ssl keystore password in config.xml

[Da...@ubs.com]

Hi, Guys, 

Is there a way to encrypt keystore password in ssl configuration in
config.xml? 

David

David Hu
UBS, Group Technology Platform Service
1-201-318-7435
ChatID: huda

RE: How to encrypt ssl keystore password in config.xml

[Da...@ubs.com]

Hi, Guys, 
 
Any idea? 
 
I am referring to xxxx in the following configuration - 
 
    <connector>
        <ssl>
            <enabled>true</enabled>
            <sslOnly>false</sslOnly>
            <keystorePath>keystore.jks</keystorePath>
            <keystorePassword>xxxx</keystorePassword>
        </ssl>

Thank you
David

________________________________

From: Hu, David 
Sent: Friday, December 07, 2012 7:21 PM
To: users@qpid.apache.org
Subject: How to encrypt ssl keystore password in config.xml



Hi, Guys, 

Is there a way to encrypt keystore password in ssl configuration in
config.xml? 

David 

David Hu 
UBS, Group Technology Platform Service 
1-201-318-7435 
ChatID: huda 

Re: How to encrypt ssl keystore password in config.xml

[Robbie Gemmell <ro...@gmail.com>]

The javax.net.ssl.keyStore and javax.net.ssl.keyStorePassword properties
will influence the JMX port if SSL is enabled in the <management> element,
but so will the configuration in the management section.

The <connection>.<ssl> is indeed how to configure the messaging port, and
as explained in other mails the connection url of the client has no
influence over what is in config.xml.

Robbie

On 11 December 2012 18:09, <Da...@ubs.com> wrote:

> Hi, Robbie,
>
> JMX is not our concern yet. I will keep this on file for reference in
> the future.
>
> About "javax.net.ssl properties will only influence the SSL behaviour of
> the JMX interface", so the messaging port, we should use configuration
> in connection URL or in config.xml section <connection>.<ssl>, with
> configuration in URL preceding that in config.xml?
>
> Thanks,
> David
>
> -----Original Message-----
> From: Robbie Gemmell [mailto:robbie.gemmell@gmail.com]
> Sent: Tuesday, December 11, 2012 7:04 AM
> To: users@qpid.apache.org
> Subject: Re: How to encrypt ssl keystore password in config.xml
>
> Hi David,
>
> Just to add to add to Phils email..
>
> The javax.net.ssl properties will only influence the SSL behaviour of
> the JMX interface, and not the messaging ports. For the latter you have
> to specify them in the file one way or another.
>
> The 'VM Summary' tab in JConsole has displayed the values of the
> arguments used to set the SSL system properties on the JVM on every JDK
> I have tried it on (though I admit to not having tried on > 1.6.0_31).
> This applied both using the JMXConnectorServer started by the broker, or
> to the platform JMXConnectorServer you can prompt the JVM to start itelf
> by supplying the
> com.sun.management.* system properties.
>
> If you did want to set the password using the system property, you could
> move the brokers MBeans out of the PlatformMBeanServer and into an
> MBeanserver specific to the broker (by adding
> <platform-mbeanserver>false</platform-mbeanserver> within the
> <management>
> element) which would mean that the platform mbeans (used for the
> Threads, Memory, VM Summary etc information) would not be available to
> people connecting to the brokers JMXConnectorServer and they would then
> be unable to view the arguments used to start the JVM. The oppposite is
> also true however, the broekrs MBeans would not be visible to people
> viewing the PlatformMBeanServer contents using e.g. a JConsole local
> 'attach'
> connection to start the management agent in the process, or a remote
> connection to a JMXConnectorServer started via the com.sun.management.*
> properties).
>
> A completely different suggestion might be to investigate encryption at
> the file/filesystem level, although this is essentially just moving the
> problem to being how to securely provide the password needed to decrypt
> that.
>
> Robbie
>
>
> On 11 December 2012 07:00, Phil Harvey <ph...@philharveyonline.com>
> wrote:
>
> > Hi David,
> >
> > You can't exactly encrypt it, but you can avoid hard coding it. You
> > can refer to system properties in config.xml using the form
> ${mypassword}.
> >
> > Expose system properties to the broker before starting it like so:
> >
> > export QPID_OPTS='-Dmypassword=password1'
> >
> > I think the broker automatically picks up the value of system property
>
> > javax.net.ssl.keyStorePassword but iirc this depends on the broker
> > version and whether you're setting it for messaging connections or for
> management.
> > I will check. By the way what is your brother version?
> >
> > A word of warning: anyone who can connect JConsole to the broker can
> > inspect system properties (possibly excluding
> > javax.net.ssl.keyStorePassword, but I'm not sure), so you should
> > consider ways of controlling access. The online broker documentation
> > describes how to apply authentication and authorisation to JMX access.
> >
> > Hope that helps,
> > Phil
> > On Dec 8, 2012 12:21 AM, <Da...@ubs.com> wrote:
> >
> > > **
> > >
> > > Hi, Guys,
> > >
> > > Is there a way to encrypt keystore password in ssl configuration in
> > > config.xml?
> > >
> > > David
> > >
> > > *David Hu*
> > > UBS, Group Technology Platform Service
> > > 1-201-318-7435
> > > ChatID: huda
> > >
> > >
> > > Visit our website at http://www.ubs.com
> > >
> > > This message contains confidential information and is intended only
> > > for the individual named.  If you are not the named addressee you
> > > should not disseminate, distribute or copy this e-mail.  Please
> > > notify the sender immediately by e-mail if you have received this
> > > e-mail by mistake and delete this e-mail from your system.
> > >
> > > E-mails are not encrypted and cannot be guaranteed to be secure or
> > > error-free as information could be intercepted, corrupted, lost,
> > > destroyed, arrive late or incomplete, or contain viruses.  The
> > > sender therefore does not accept liability for any errors or
> > > omissions in the contents of this message which arise as a result of
> e-mail transmission.
> > > If verification is required please request a hard-copy version.
> > > This message is provided for informational purposes and should not
> > > be construed as a solicitation or offer to buy or sell any
> > > securities or related financial instruments.
> > >
> > >
> > > UBS reserves the right to retain all messages. Messages are
> > > protected and accessed only in legally justified cases.
> > >
> > >
> > > --------------------------------------------------------------------
> > > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> > > additional commands, e-mail: users-help@qpid.apache.org
> > >
> >
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only
> for the individual named.  If you are not the named addressee you
> should not disseminate, distribute or copy this e-mail.  Please
> notify the sender immediately by e-mail if you have received this
> e-mail by mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or
> error-free as information could be intercepted, corrupted, lost,
> destroyed, arrive late or incomplete, or contain viruses.  The sender
> therefore does not accept liability for any errors or omissions in the
> contents of this message which arise as a result of e-mail transmission.
> If verification is required please request a hard-copy version.  This
> message is provided for informational purposes and should not be
> construed as a solicitation or offer to buy or sell any securities
> or related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected
> and accessed only in legally justified cases.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>
>

RE: How to encrypt ssl keystore password in config.xml

[Da...@ubs.com]

Hi, Robbie, 

JMX is not our concern yet. I will keep this on file for reference in
the future. 

About "javax.net.ssl properties will only influence the SSL behaviour of
the JMX interface", so the messaging port, we should use configuration
in connection URL or in config.xml section <connection>.<ssl>, with
configuration in URL preceding that in config.xml? 

Thanks, 
David

-----Original Message-----
From: Robbie Gemmell [mailto:robbie.gemmell@gmail.com] 
Sent: Tuesday, December 11, 2012 7:04 AM
To: users@qpid.apache.org
Subject: Re: How to encrypt ssl keystore password in config.xml

Hi David,

Just to add to add to Phils email..

The javax.net.ssl properties will only influence the SSL behaviour of
the JMX interface, and not the messaging ports. For the latter you have
to specify them in the file one way or another.

The 'VM Summary' tab in JConsole has displayed the values of the
arguments used to set the SSL system properties on the JVM on every JDK
I have tried it on (though I admit to not having tried on > 1.6.0_31).
This applied both using the JMXConnectorServer started by the broker, or
to the platform JMXConnectorServer you can prompt the JVM to start itelf
by supplying the
com.sun.management.* system properties.

If you did want to set the password using the system property, you could
move the brokers MBeans out of the PlatformMBeanServer and into an
MBeanserver specific to the broker (by adding
<platform-mbeanserver>false</platform-mbeanserver> within the
<management>
element) which would mean that the platform mbeans (used for the
Threads, Memory, VM Summary etc information) would not be available to
people connecting to the brokers JMXConnectorServer and they would then
be unable to view the arguments used to start the JVM. The oppposite is
also true however, the broekrs MBeans would not be visible to people
viewing the PlatformMBeanServer contents using e.g. a JConsole local
'attach'
connection to start the management agent in the process, or a remote
connection to a JMXConnectorServer started via the com.sun.management.*
properties).

A completely different suggestion might be to investigate encryption at
the file/filesystem level, although this is essentially just moving the
problem to being how to securely provide the password needed to decrypt
that.

Robbie


On 11 December 2012 07:00, Phil Harvey <ph...@philharveyonline.com>
wrote:

> Hi David,
>
> You can't exactly encrypt it, but you can avoid hard coding it. You 
> can refer to system properties in config.xml using the form
${mypassword}.
>
> Expose system properties to the broker before starting it like so:
>
> export QPID_OPTS='-Dmypassword=password1'
>
> I think the broker automatically picks up the value of system property

> javax.net.ssl.keyStorePassword but iirc this depends on the broker 
> version and whether you're setting it for messaging connections or for
management.
> I will check. By the way what is your brother version?
>
> A word of warning: anyone who can connect JConsole to the broker can 
> inspect system properties (possibly excluding 
> javax.net.ssl.keyStorePassword, but I'm not sure), so you should 
> consider ways of controlling access. The online broker documentation 
> describes how to apply authentication and authorisation to JMX access.
>
> Hope that helps,
> Phil
> On Dec 8, 2012 12:21 AM, <Da...@ubs.com> wrote:
>
> > **
> >
> > Hi, Guys,
> >
> > Is there a way to encrypt keystore password in ssl configuration in 
> > config.xml?
> >
> > David
> >
> > *David Hu*
> > UBS, Group Technology Platform Service
> > 1-201-318-7435
> > ChatID: huda
> >
> >
> > Visit our website at http://www.ubs.com
> >
> > This message contains confidential information and is intended only 
> > for the individual named.  If you are not the named addressee you 
> > should not disseminate, distribute or copy this e-mail.  Please 
> > notify the sender immediately by e-mail if you have received this 
> > e-mail by mistake and delete this e-mail from your system.
> >
> > E-mails are not encrypted and cannot be guaranteed to be secure or 
> > error-free as information could be intercepted, corrupted, lost, 
> > destroyed, arrive late or incomplete, or contain viruses.  The 
> > sender therefore does not accept liability for any errors or 
> > omissions in the contents of this message which arise as a result of
e-mail transmission.
> > If verification is required please request a hard-copy version.  
> > This message is provided for informational purposes and should not 
> > be construed as a solicitation or offer to buy or sell any 
> > securities or related financial instruments.
> >
> >
> > UBS reserves the right to retain all messages. Messages are 
> > protected and accessed only in legally justified cases.
> >
> >
> > --------------------------------------------------------------------
> > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> > additional commands, e-mail: users-help@qpid.apache.org
> >
>
Visit our website at http://www.ubs.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.
	
E-mails are not encrypted and cannot be guaranteed to be secure or 
error-free as information could be intercepted, corrupted, lost, 
destroyed, arrive late or incomplete, or contain viruses.  The sender 
therefore does not accept liability for any errors or omissions in the 
contents of this message which arise as a result of e-mail transmission.  
If verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities 
or related financial instruments.

 
UBS reserves the right to retain all messages. Messages are protected
and accessed only in legally justified cases.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org

Re: How to encrypt ssl keystore password in config.xml

[Robbie Gemmell <ro...@gmail.com>]

Hi David,

Just to add to add to Phils email..

The javax.net.ssl properties will only influence the SSL behaviour of the
JMX interface, and not the messaging ports. For the latter you have to
specify them in the file one way or another.

The 'VM Summary' tab in JConsole has displayed the values of the arguments
used to set the SSL system properties on the JVM on every JDK I have tried
it on (though I admit to not having tried on > 1.6.0_31). This applied both
using the JMXConnectorServer started by the broker, or to the platform
JMXConnectorServer you can prompt the JVM to start itelf by supplying the
com.sun.management.* system properties.

If you did want to set the password using the system property, you could
move the brokers MBeans out of the PlatformMBeanServer and into an
MBeanserver specific to the broker (by adding
<platform-mbeanserver>false</platform-mbeanserver> within the <management>
element) which would mean that the platform mbeans (used for the Threads,
Memory, VM Summary etc information) would not be available to people
connecting to the brokers JMXConnectorServer and they would then be unable
to view the arguments used to start the JVM. The oppposite is also true
however, the broekrs MBeans would not be visible to people viewing the
PlatformMBeanServer contents using e.g. a JConsole local 'attach'
connection to start the management agent in the process, or a remote
connection to a JMXConnectorServer started via the com.sun.management.*
properties).

A completely different suggestion might be to investigate encryption at the
file/filesystem level, although this is essentially just moving the problem
to being how to securely provide the password needed to decrypt that.

Robbie


On 11 December 2012 07:00, Phil Harvey <ph...@philharveyonline.com> wrote:

> Hi David,
>
> You can't exactly encrypt it, but you can avoid hard coding it. You can
> refer to system properties in config.xml using the form ${mypassword}.
>
> Expose system properties to the broker before starting it like so:
>
> export QPID_OPTS='-Dmypassword=password1'
>
> I think the broker automatically picks up the value of system property
> javax.net.ssl.keyStorePassword but iirc this depends on the broker version
> and whether you're setting it for messaging connections or for management.
> I will check. By the way what is your brother version?
>
> A word of warning: anyone who can connect JConsole to the broker can
> inspect system properties (possibly excluding
> javax.net.ssl.keyStorePassword, but I'm not sure), so you should consider
> ways of controlling access. The online broker documentation describes how
> to apply authentication and authorisation to JMX access.
>
> Hope that helps,
> Phil
> On Dec 8, 2012 12:21 AM, <Da...@ubs.com> wrote:
>
> > **
> >
> > Hi, Guys,
> >
> > Is there a way to encrypt keystore password in ssl configuration in
> > config.xml?
> >
> > David
> >
> > *David Hu*
> > UBS, Group Technology Platform Service
> > 1-201-318-7435
> > ChatID: huda
> >
> >
> > Visit our website at http://www.ubs.com
> >
> > This message contains confidential information and is intended only
> > for the individual named.  If you are not the named addressee you
> > should not disseminate, distribute or copy this e-mail.  Please
> > notify the sender immediately by e-mail if you have received this
> > e-mail by mistake and delete this e-mail from your system.
> >
> > E-mails are not encrypted and cannot be guaranteed to be secure or
> > error-free as information could be intercepted, corrupted, lost,
> > destroyed, arrive late or incomplete, or contain viruses.  The sender
> > therefore does not accept liability for any errors or omissions in the
> > contents of this message which arise as a result of e-mail transmission.
> > If verification is required please request a hard-copy version.  This
> > message is provided for informational purposes and should not be
> > construed as a solicitation or offer to buy or sell any securities
> > or related financial instruments.
> >
> >
> > UBS reserves the right to retain all messages. Messages are protected
> > and accessed only in legally justified cases.
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> > For additional commands, e-mail: users-help@qpid.apache.org
> >
>

RE: How to encrypt ssl keystore password in config.xml

[Da...@ubs.com]

Thank you, Robbie.  

-----Original Message-----
From: Robbie Gemmell [mailto:robbie.gemmell@gmail.com] 
Sent: Tuesday, December 11, 2012 5:21 PM
To: users@qpid.apache.org
Subject: Re: How to encrypt ssl keystore password in config.xml

Correct.

On 11 December 2012 22:02, <Da...@ubs.com> wrote:

> Ok, Robbie,
>
> Got it. Back to encrypt keystore password in <connection><ssl> section

> in config.xml, I guess it is not supported?
>
> David
>
> -----Original Message-----
> From: Robbie Gemmell [mailto:robbie.gemmell@gmail.com]
> Sent: Tuesday, December 11, 2012 4:59 PM
> To: users@qpid.apache.org
> Subject: Re: How to encrypt ssl keystore password in config.xml
>
> The variable value can be passed in using -D system properties, but 
> not as an environment variable (Phils example set the -D system 
> property configuration by supplying it to the startup script via an 
> environment variable the startup script uses to enable such
configuration).
>
> Robbie
>
> On 11 December 2012 21:47, <Da...@ubs.com> wrote:
>
> > Hi, Robbie,
> >
> > Make sense.
> >
> > The ssl keystore/truststore/passwords in connection url is for 
> > client side only.
> >
> > But for broker, the configuration should go in config.xml where the 
> > variable can be used as per Phil and the value of the variables can 
> > be
>
> > passed in using -D or via environment variable.
> >
> > Again, I will leave JMX out of the scope at this point.
> >
> > Thanks,
> > David
> >
> > -----Original Message-----
> > From: Robbie Gemmell [mailto:robbie.gemmell@gmail.com]
> > Sent: Tuesday, December 11, 2012 4:43 PM
> > To: users@qpid.apache.org
> > Subject: Re: How to encrypt ssl keystore password in config.xml
> >
> > Hi David,
> >
> > There seems to be a bit of confusion here.
> >
> > The brokers SSL configuration in relation to the messaging ports can

> > only be controlled using the <connector><ssl> elements in
config.xml.
> > Phil was suggesting that you could use system properties (which will

> > be resolved at broker startup) in the config file rather than 
> > placing the actual values in the config file. These system property 
> > could be the standard SSL system properties, or any other name of 
> > your own
> choosing.
> > In this case anyone able to connect via JMX and view the contents of

> > the JVMs 'Platform'
> > MBeanServer (which is what gets used by default by the broker for 
> > its MBeans and by the JVM itself for all its standard MBeans, and 
> > then gets exposed via JMX either by the brokers JMXConnectorServer 
> > or the JVMs own if is enabled at startup or activated by 'locally' 
> > attaching JConsole etc as the user who started the process) would be

> > able to view the arguments used to start the JVM since one of the 
> > standard MBeans exposes these (as used to populate the VM Summary 
> > tab in JConsole), and those would include the system properties. 
> > There is one
>
> > way around that, as mentioned in my earlier email and further
> explained below [*].
> >
> > The ability to specify SSL options in the clients connection url (as

> > opposed to via the client JVMs SSL system properties) only 
> > influences the clients SSL configuration, not the brokers. The 
> > keystore and truststore configuration for the server and client side

> > are entirely independent. When the broker has an SSL certificate it 
> > needs a keystore, and the client needs a truststore containing trust

> > information for that certificate (assuming it is not trusted at the
> JVM installation level).
> > When the broker additionionally requires client certificates be 
> > presented then the client will also need a keystore to contain its 
> > certificate, and the broker will then need a truststore containing 
> > trust information relating to the client certificates (again 
> > assuming they are not already trusted at the JVM installation
level).
> >
> > Robbie
> >
> > [*] You could move the brokers MBeans out of the Platform 
> > MBeanServer using the configuration I mentioned previously, which 
> > would prevent people from being able to see the argument information

> > (along with all
>
> > the Thread, Memory etc information) when connecting to the 
> > JMXConnectorServer started by the broker. People connecting to the 
> > JVMs own Platform JMXConnectorServer (which gets used when you have 
> > started in the JVM using the com.sun.management.* options and then 
> > do
> a 'remote'
> > JConsole etc connection to the JMXConnectorServer, on that port, or 
> > perform a 'local'
> > connection to a JVM with JConsole etc whereby a management agent is 
> > injected in the running JVM using the Attach API) would still be 
> > viewing the contents of the Platform MBeanServer and thus be able to

> > view that argument information, but would not be able to view the 
> > brokers MBeans since they would now be in a separate MBeanServer.
> > Unless you start the JVM the com.sun.management.* options to enable 
> > its platform JMXConnectorServer, the ability to access the Platform 
> > JMXConnectorServer would only apply to the user who started the 
> > broker, such that they can do a 'local' JMX connection with JConsole

> > etc, and they obviously already had acess to the argument 
> > information anyway when starting the broker.
> >
> > On 11 December 2012 17:04, <Da...@ubs.com> wrote:
> >
> > > Hi, Phil,
> > >
> > > With another of the response, you seem have recommended two 
> > > approaches
> >
> > > on doing this -
> > >
> > > 1. use system variable
> > >     (1) use java option -D to pass the value in
> > >     (2) export variable to pass in the value
> > >
> > > 2. Pass the keystore and password via connection URL (like your 
> > > test
>
> > > case). It means that that the one passed in via connection URL 
> > > overrides the one defined in config.xml, correct?
> > >
> > > For 1(1), the password will be exposed in Jconsole. For 1(2), the 
> > > password will be in starting script.
> > >
> > > The better approach is 2 where we can programatically construct 
> > > the
> > URL.
> > > The password can be passed-in in encrypted format and can be 
> > > decrypted
> >
> > > when constructing URL.
> > >
> > > Still it seems there is no out-of-box solution, we need to write 
> > > our
>
> > > own client (in the context of Synapse, we need to write our own
> > JMSListener.
> > > It goes back to my understanding before.
> > >
> > > Thanks for all the help.
> > >
> > > David
> > >
> > > -----Original Message-----
> > > From: philharveyonline@googlemail.com 
> > > [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> > > Sent: Tuesday, December 11, 2012 2:00 AM
> > > To: users@qpid.apache.org
> > > Subject: Re: How to encrypt ssl keystore password in config.xml
> > >
> > > Hi David,
> > >
> > > You can't exactly encrypt it, but you can avoid hard coding it. 
> > > You can refer to system properties in config.xml using the form
> > ${mypassword}.
> > >
> > > Expose system properties to the broker before starting it like so:
> > >
> > > export QPID_OPTS='-Dmypassword=password1'
> > >
> > > I think the broker automatically picks up the value of system 
> > > property
> >
> > > javax.net.ssl.keyStorePassword but iirc this depends on the broker

> > > version and whether you're setting it for messaging connections or

> > > for
> >
> > > management.
> > > I will check. By the way what is your brother version?
> > >
> > > A word of warning: anyone who can connect JConsole to the broker 
> > > can
>
> > > inspect system properties (possibly excluding 
> > > javax.net.ssl.keyStorePassword, but I'm not sure), so you should 
> > > consider ways of controlling access. The online broker 
> > > documentation
>
> > > describes how to apply authentication and authorisation to JMX
> access.
> > >
> > > Hope that helps,
> > > Phil
> > > On Dec 8, 2012 12:21 AM, <Da...@ubs.com> wrote:
> > >
> > > > **
> > > >
> > > > Hi, Guys,
> > > >
> > > > Is there a way to encrypt keystore password in ssl configuration

> > > > in config.xml?
> > > >
> > > > David
> > > >
> > > > *David Hu*
> > > > UBS, Group Technology Platform Service
> > > > 1-201-318-7435
> > > > ChatID: huda
> > > >
> > > >
> > > > Visit our website at http://www.ubs.com
> > > >
> > > > This message contains confidential information and is intended 
> > > > only for the individual named.  If you are not the named 
> > > > addressee
>
> > > > you should not disseminate, distribute or copy this e-mail.
> > > > Please notify
> > >
> > > > the sender immediately by e-mail if you have received this 
> > > > e-mail by
> >
> > > > mistake and delete this e-mail from your system.
> > > >
> > > > E-mails are not encrypted and cannot be guaranteed to be secure 
> > > > or
>
> > > > error-free as information could be intercepted, corrupted, lost,

> > > > destroyed, arrive late or incomplete, or contain viruses.  The 
> > > > sender therefore does not accept liability for any errors or 
> > > > omissions in the
> > >
> > > > contents of this message which arise as a result of e-mail
> > > transmission.
> > > > If verification is required please request a hard-copy version.
> > > > This message is provided for informational purposes and should 
> > > > not
>
> > > > be construed as a solicitation or offer to buy or sell any 
> > > > securities or related financial instruments.
> > > >
> > > >
> > > > UBS reserves the right to retain all messages. Messages are 
> > > > protected and accessed only in legally justified cases.
> > > >
> > > >
> > > > ----------------------------------------------------------------
> > > > --
> > > > --
> > > > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> > > > additional commands, e-mail: users-help@qpid.apache.org
> > > >
> > > Visit our website at http://www.ubs.com
> > >
> > > This message contains confidential information and is intended 
> > > only for the individual named.  If you are not the named addressee

> > > you should not disseminate, distribute or copy this e-mail.  
> > > Please notify
> >
> > > the sender immediately by e-mail if you have received this e-mail 
> > > by
>
> > > mistake and delete this e-mail from your system.
> > >
> > > E-mails are not encrypted and cannot be guaranteed to be secure or

> > > error-free as information could be intercepted, corrupted, lost, 
> > > destroyed, arrive late or incomplete, or contain viruses.  The 
> > > sender therefore does not accept liability for any errors or 
> > > omissions in the
> >
> > > contents of this message which arise as a result of e-mail
> > transmission.
> > > If verification is required please request a hard-copy version.
> > > This message is provided for informational purposes and should not

> > > be construed as a solicitation or offer to buy or sell any 
> > > securities or related financial instruments.
> > >
> > >
> > > UBS reserves the right to retain all messages. Messages are 
> > > protected and accessed only in legally justified cases.
> > >
> > > ------------------------------------------------------------------
> > > --
> > > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> > > additional commands, e-mail: users-help@qpid.apache.org
> > >
> > >
> > Visit our website at http://www.ubs.com
> >
> > This message contains confidential information and is intended only 
> > for the individual named.  If you are not the named addressee you 
> > should not disseminate, distribute or copy this e-mail.  Please 
> > notify
>
> > the sender immediately by e-mail if you have received this e-mail by

> > mistake and delete this e-mail from your system.
> >
> > E-mails are not encrypted and cannot be guaranteed to be secure or 
> > error-free as information could be intercepted, corrupted, lost, 
> > destroyed, arrive late or incomplete, or contain viruses.  The 
> > sender therefore does not accept liability for any errors or 
> > omissions in the
>
> > contents of this message which arise as a result of e-mail
> transmission.
> > If verification is required please request a hard-copy version.  
> > This message is provided for informational purposes and should not 
> > be construed as a solicitation or offer to buy or sell any 
> > securities or related financial instruments.
> >
> >
> > UBS reserves the right to retain all messages. Messages are 
> > protected and accessed only in legally justified cases.
> >
> > --------------------------------------------------------------------
> > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> > additional commands, e-mail: users-help@qpid.apache.org
> >
> >
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only 
> for the individual named.  If you are not the named addressee you 
> should not disseminate, distribute or copy this e-mail.  Please notify

> the sender immediately by e-mail if you have received this e-mail by 
> mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or 
> error-free as information could be intercepted, corrupted, lost, 
> destroyed, arrive late or incomplete, or contain viruses.  The sender 
> therefore does not accept liability for any errors or omissions in the

> contents of this message which arise as a result of e-mail
transmission.
> If verification is required please request a hard-copy version.  This 
> message is provided for informational purposes and should not be 
> construed as a solicitation or offer to buy or sell any securities or 
> related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected 
> and accessed only in legally justified cases.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> additional commands, e-mail: users-help@qpid.apache.org
>
>
Visit our website at http://www.ubs.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.
	
E-mails are not encrypted and cannot be guaranteed to be secure or 
error-free as information could be intercepted, corrupted, lost, 
destroyed, arrive late or incomplete, or contain viruses.  The sender 
therefore does not accept liability for any errors or omissions in the 
contents of this message which arise as a result of e-mail transmission.  
If verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities 
or related financial instruments.

 
UBS reserves the right to retain all messages. Messages are protected
and accessed only in legally justified cases.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org

Re: How to encrypt ssl keystore password in config.xml

[Robbie Gemmell <ro...@gmail.com>]

Correct.

On 11 December 2012 22:02, <Da...@ubs.com> wrote:

> Ok, Robbie,
>
> Got it. Back to encrypt keystore password in <connection><ssl> section
> in config.xml, I guess it is not supported?
>
> David
>
> -----Original Message-----
> From: Robbie Gemmell [mailto:robbie.gemmell@gmail.com]
> Sent: Tuesday, December 11, 2012 4:59 PM
> To: users@qpid.apache.org
> Subject: Re: How to encrypt ssl keystore password in config.xml
>
> The variable value can be passed in using -D system properties, but not
> as an environment variable (Phils example set the -D system property
> configuration by supplying it to the startup script via an environment
> variable the startup script uses to enable such configuration).
>
> Robbie
>
> On 11 December 2012 21:47, <Da...@ubs.com> wrote:
>
> > Hi, Robbie,
> >
> > Make sense.
> >
> > The ssl keystore/truststore/passwords in connection url is for client
> > side only.
> >
> > But for broker, the configuration should go in config.xml where the
> > variable can be used as per Phil and the value of the variables can be
>
> > passed in using -D or via environment variable.
> >
> > Again, I will leave JMX out of the scope at this point.
> >
> > Thanks,
> > David
> >
> > -----Original Message-----
> > From: Robbie Gemmell [mailto:robbie.gemmell@gmail.com]
> > Sent: Tuesday, December 11, 2012 4:43 PM
> > To: users@qpid.apache.org
> > Subject: Re: How to encrypt ssl keystore password in config.xml
> >
> > Hi David,
> >
> > There seems to be a bit of confusion here.
> >
> > The brokers SSL configuration in relation to the messaging ports can
> > only be controlled using the <connector><ssl> elements in config.xml.
> > Phil was suggesting that you could use system properties (which will
> > be resolved at broker startup) in the config file rather than placing
> > the actual values in the config file. These system property could be
> > the standard SSL system properties, or any other name of your own
> choosing.
> > In this case anyone able to connect via JMX and view the contents of
> > the JVMs 'Platform'
> > MBeanServer (which is what gets used by default by the broker for its
> > MBeans and by the JVM itself for all its standard MBeans, and then
> > gets exposed via JMX either by the brokers JMXConnectorServer or the
> > JVMs own if is enabled at startup or activated by 'locally' attaching
> > JConsole etc as the user who started the process) would be able to
> > view the arguments used to start the JVM since one of the standard
> > MBeans exposes these (as used to populate the VM Summary tab in
> > JConsole), and those would include the system properties. There is one
>
> > way around that, as mentioned in my earlier email and further
> explained below [*].
> >
> > The ability to specify SSL options in the clients connection url (as
> > opposed to via the client JVMs SSL system properties) only influences
> > the clients SSL configuration, not the brokers. The keystore and
> > truststore configuration for the server and client side are entirely
> > independent. When the broker has an SSL certificate it needs a
> > keystore, and the client needs a truststore containing trust
> > information for that certificate (assuming it is not trusted at the
> JVM installation level).
> > When the broker additionionally requires client certificates be
> > presented then the client will also need a keystore to contain its
> > certificate, and the broker will then need a truststore containing
> > trust information relating to the client certificates (again assuming
> > they are not already trusted at the JVM installation level).
> >
> > Robbie
> >
> > [*] You could move the brokers MBeans out of the Platform MBeanServer
> > using the configuration I mentioned previously, which would prevent
> > people from being able to see the argument information (along with all
>
> > the Thread, Memory etc information) when connecting to the
> > JMXConnectorServer started by the broker. People connecting to the
> > JVMs own Platform JMXConnectorServer (which gets used when you have
> > started in the JVM using the com.sun.management.* options and then do
> a 'remote'
> > JConsole etc connection to the JMXConnectorServer, on that port, or
> > perform a 'local'
> > connection to a JVM with JConsole etc whereby a management agent is
> > injected in the running JVM using the Attach API) would still be
> > viewing the contents of the Platform MBeanServer and thus be able to
> > view that argument information, but would not be able to view the
> > brokers MBeans since they would now be in a separate MBeanServer.
> > Unless you start the JVM the com.sun.management.* options to enable
> > its platform JMXConnectorServer, the ability to access the Platform
> > JMXConnectorServer would only apply to the user who started the
> > broker, such that they can do a 'local' JMX connection with JConsole
> > etc, and they obviously already had acess to the argument information
> > anyway when starting the broker.
> >
> > On 11 December 2012 17:04, <Da...@ubs.com> wrote:
> >
> > > Hi, Phil,
> > >
> > > With another of the response, you seem have recommended two
> > > approaches
> >
> > > on doing this -
> > >
> > > 1. use system variable
> > >     (1) use java option -D to pass the value in
> > >     (2) export variable to pass in the value
> > >
> > > 2. Pass the keystore and password via connection URL (like your test
>
> > > case). It means that that the one passed in via connection URL
> > > overrides the one defined in config.xml, correct?
> > >
> > > For 1(1), the password will be exposed in Jconsole. For 1(2), the
> > > password will be in starting script.
> > >
> > > The better approach is 2 where we can programatically construct the
> > URL.
> > > The password can be passed-in in encrypted format and can be
> > > decrypted
> >
> > > when constructing URL.
> > >
> > > Still it seems there is no out-of-box solution, we need to write our
>
> > > own client (in the context of Synapse, we need to write our own
> > JMSListener.
> > > It goes back to my understanding before.
> > >
> > > Thanks for all the help.
> > >
> > > David
> > >
> > > -----Original Message-----
> > > From: philharveyonline@googlemail.com
> > > [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> > > Sent: Tuesday, December 11, 2012 2:00 AM
> > > To: users@qpid.apache.org
> > > Subject: Re: How to encrypt ssl keystore password in config.xml
> > >
> > > Hi David,
> > >
> > > You can't exactly encrypt it, but you can avoid hard coding it. You
> > > can refer to system properties in config.xml using the form
> > ${mypassword}.
> > >
> > > Expose system properties to the broker before starting it like so:
> > >
> > > export QPID_OPTS='-Dmypassword=password1'
> > >
> > > I think the broker automatically picks up the value of system
> > > property
> >
> > > javax.net.ssl.keyStorePassword but iirc this depends on the broker
> > > version and whether you're setting it for messaging connections or
> > > for
> >
> > > management.
> > > I will check. By the way what is your brother version?
> > >
> > > A word of warning: anyone who can connect JConsole to the broker can
>
> > > inspect system properties (possibly excluding
> > > javax.net.ssl.keyStorePassword, but I'm not sure), so you should
> > > consider ways of controlling access. The online broker documentation
>
> > > describes how to apply authentication and authorisation to JMX
> access.
> > >
> > > Hope that helps,
> > > Phil
> > > On Dec 8, 2012 12:21 AM, <Da...@ubs.com> wrote:
> > >
> > > > **
> > > >
> > > > Hi, Guys,
> > > >
> > > > Is there a way to encrypt keystore password in ssl configuration
> > > > in config.xml?
> > > >
> > > > David
> > > >
> > > > *David Hu*
> > > > UBS, Group Technology Platform Service
> > > > 1-201-318-7435
> > > > ChatID: huda
> > > >
> > > >
> > > > Visit our website at http://www.ubs.com
> > > >
> > > > This message contains confidential information and is intended
> > > > only for the individual named.  If you are not the named addressee
>
> > > > you should not disseminate, distribute or copy this e-mail.
> > > > Please notify
> > >
> > > > the sender immediately by e-mail if you have received this e-mail
> > > > by
> >
> > > > mistake and delete this e-mail from your system.
> > > >
> > > > E-mails are not encrypted and cannot be guaranteed to be secure or
>
> > > > error-free as information could be intercepted, corrupted, lost,
> > > > destroyed, arrive late or incomplete, or contain viruses.  The
> > > > sender therefore does not accept liability for any errors or
> > > > omissions in the
> > >
> > > > contents of this message which arise as a result of e-mail
> > > transmission.
> > > > If verification is required please request a hard-copy version.
> > > > This message is provided for informational purposes and should not
>
> > > > be construed as a solicitation or offer to buy or sell any
> > > > securities or related financial instruments.
> > > >
> > > >
> > > > UBS reserves the right to retain all messages. Messages are
> > > > protected and accessed only in legally justified cases.
> > > >
> > > >
> > > > ------------------------------------------------------------------
> > > > --
> > > > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> > > > additional commands, e-mail: users-help@qpid.apache.org
> > > >
> > > Visit our website at http://www.ubs.com
> > >
> > > This message contains confidential information and is intended only
> > > for the individual named.  If you are not the named addressee you
> > > should not disseminate, distribute or copy this e-mail.  Please
> > > notify
> >
> > > the sender immediately by e-mail if you have received this e-mail by
>
> > > mistake and delete this e-mail from your system.
> > >
> > > E-mails are not encrypted and cannot be guaranteed to be secure or
> > > error-free as information could be intercepted, corrupted, lost,
> > > destroyed, arrive late or incomplete, or contain viruses.  The
> > > sender therefore does not accept liability for any errors or
> > > omissions in the
> >
> > > contents of this message which arise as a result of e-mail
> > transmission.
> > > If verification is required please request a hard-copy version.
> > > This message is provided for informational purposes and should not
> > > be construed as a solicitation or offer to buy or sell any
> > > securities or related financial instruments.
> > >
> > >
> > > UBS reserves the right to retain all messages. Messages are
> > > protected and accessed only in legally justified cases.
> > >
> > > --------------------------------------------------------------------
> > > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> > > additional commands, e-mail: users-help@qpid.apache.org
> > >
> > >
> > Visit our website at http://www.ubs.com
> >
> > This message contains confidential information and is intended only
> > for the individual named.  If you are not the named addressee you
> > should not disseminate, distribute or copy this e-mail.  Please notify
>
> > the sender immediately by e-mail if you have received this e-mail by
> > mistake and delete this e-mail from your system.
> >
> > E-mails are not encrypted and cannot be guaranteed to be secure or
> > error-free as information could be intercepted, corrupted, lost,
> > destroyed, arrive late or incomplete, or contain viruses.  The sender
> > therefore does not accept liability for any errors or omissions in the
>
> > contents of this message which arise as a result of e-mail
> transmission.
> > If verification is required please request a hard-copy version.  This
> > message is provided for informational purposes and should not be
> > construed as a solicitation or offer to buy or sell any securities or
> > related financial instruments.
> >
> >
> > UBS reserves the right to retain all messages. Messages are protected
> > and accessed only in legally justified cases.
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> > additional commands, e-mail: users-help@qpid.apache.org
> >
> >
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only
> for the individual named.  If you are not the named addressee you
> should not disseminate, distribute or copy this e-mail.  Please
> notify the sender immediately by e-mail if you have received this
> e-mail by mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or
> error-free as information could be intercepted, corrupted, lost,
> destroyed, arrive late or incomplete, or contain viruses.  The sender
> therefore does not accept liability for any errors or omissions in the
> contents of this message which arise as a result of e-mail transmission.
> If verification is required please request a hard-copy version.  This
> message is provided for informational purposes and should not be
> construed as a solicitation or offer to buy or sell any securities
> or related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected
> and accessed only in legally justified cases.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>
>

RE: How to encrypt ssl keystore password in config.xml

[Da...@ubs.com]

Ok, Robbie, 

Got it. Back to encrypt keystore password in <connection><ssl> section
in config.xml, I guess it is not supported? 

David 

-----Original Message-----
From: Robbie Gemmell [mailto:robbie.gemmell@gmail.com] 
Sent: Tuesday, December 11, 2012 4:59 PM
To: users@qpid.apache.org
Subject: Re: How to encrypt ssl keystore password in config.xml

The variable value can be passed in using -D system properties, but not
as an environment variable (Phils example set the -D system property
configuration by supplying it to the startup script via an environment
variable the startup script uses to enable such configuration).

Robbie

On 11 December 2012 21:47, <Da...@ubs.com> wrote:

> Hi, Robbie,
>
> Make sense.
>
> The ssl keystore/truststore/passwords in connection url is for client 
> side only.
>
> But for broker, the configuration should go in config.xml where the 
> variable can be used as per Phil and the value of the variables can be

> passed in using -D or via environment variable.
>
> Again, I will leave JMX out of the scope at this point.
>
> Thanks,
> David
>
> -----Original Message-----
> From: Robbie Gemmell [mailto:robbie.gemmell@gmail.com]
> Sent: Tuesday, December 11, 2012 4:43 PM
> To: users@qpid.apache.org
> Subject: Re: How to encrypt ssl keystore password in config.xml
>
> Hi David,
>
> There seems to be a bit of confusion here.
>
> The brokers SSL configuration in relation to the messaging ports can 
> only be controlled using the <connector><ssl> elements in config.xml.
> Phil was suggesting that you could use system properties (which will 
> be resolved at broker startup) in the config file rather than placing 
> the actual values in the config file. These system property could be 
> the standard SSL system properties, or any other name of your own
choosing.
> In this case anyone able to connect via JMX and view the contents of 
> the JVMs 'Platform'
> MBeanServer (which is what gets used by default by the broker for its 
> MBeans and by the JVM itself for all its standard MBeans, and then 
> gets exposed via JMX either by the brokers JMXConnectorServer or the 
> JVMs own if is enabled at startup or activated by 'locally' attaching 
> JConsole etc as the user who started the process) would be able to 
> view the arguments used to start the JVM since one of the standard 
> MBeans exposes these (as used to populate the VM Summary tab in 
> JConsole), and those would include the system properties. There is one

> way around that, as mentioned in my earlier email and further
explained below [*].
>
> The ability to specify SSL options in the clients connection url (as 
> opposed to via the client JVMs SSL system properties) only influences 
> the clients SSL configuration, not the brokers. The keystore and 
> truststore configuration for the server and client side are entirely 
> independent. When the broker has an SSL certificate it needs a 
> keystore, and the client needs a truststore containing trust 
> information for that certificate (assuming it is not trusted at the
JVM installation level).
> When the broker additionionally requires client certificates be 
> presented then the client will also need a keystore to contain its 
> certificate, and the broker will then need a truststore containing 
> trust information relating to the client certificates (again assuming 
> they are not already trusted at the JVM installation level).
>
> Robbie
>
> [*] You could move the brokers MBeans out of the Platform MBeanServer 
> using the configuration I mentioned previously, which would prevent 
> people from being able to see the argument information (along with all

> the Thread, Memory etc information) when connecting to the 
> JMXConnectorServer started by the broker. People connecting to the 
> JVMs own Platform JMXConnectorServer (which gets used when you have 
> started in the JVM using the com.sun.management.* options and then do
a 'remote'
> JConsole etc connection to the JMXConnectorServer, on that port, or 
> perform a 'local'
> connection to a JVM with JConsole etc whereby a management agent is 
> injected in the running JVM using the Attach API) would still be 
> viewing the contents of the Platform MBeanServer and thus be able to 
> view that argument information, but would not be able to view the 
> brokers MBeans since they would now be in a separate MBeanServer. 
> Unless you start the JVM the com.sun.management.* options to enable 
> its platform JMXConnectorServer, the ability to access the Platform 
> JMXConnectorServer would only apply to the user who started the 
> broker, such that they can do a 'local' JMX connection with JConsole 
> etc, and they obviously already had acess to the argument information 
> anyway when starting the broker.
>
> On 11 December 2012 17:04, <Da...@ubs.com> wrote:
>
> > Hi, Phil,
> >
> > With another of the response, you seem have recommended two 
> > approaches
>
> > on doing this -
> >
> > 1. use system variable
> >     (1) use java option -D to pass the value in
> >     (2) export variable to pass in the value
> >
> > 2. Pass the keystore and password via connection URL (like your test

> > case). It means that that the one passed in via connection URL 
> > overrides the one defined in config.xml, correct?
> >
> > For 1(1), the password will be exposed in Jconsole. For 1(2), the 
> > password will be in starting script.
> >
> > The better approach is 2 where we can programatically construct the
> URL.
> > The password can be passed-in in encrypted format and can be 
> > decrypted
>
> > when constructing URL.
> >
> > Still it seems there is no out-of-box solution, we need to write our

> > own client (in the context of Synapse, we need to write our own
> JMSListener.
> > It goes back to my understanding before.
> >
> > Thanks for all the help.
> >
> > David
> >
> > -----Original Message-----
> > From: philharveyonline@googlemail.com 
> > [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> > Sent: Tuesday, December 11, 2012 2:00 AM
> > To: users@qpid.apache.org
> > Subject: Re: How to encrypt ssl keystore password in config.xml
> >
> > Hi David,
> >
> > You can't exactly encrypt it, but you can avoid hard coding it. You 
> > can refer to system properties in config.xml using the form
> ${mypassword}.
> >
> > Expose system properties to the broker before starting it like so:
> >
> > export QPID_OPTS='-Dmypassword=password1'
> >
> > I think the broker automatically picks up the value of system 
> > property
>
> > javax.net.ssl.keyStorePassword but iirc this depends on the broker 
> > version and whether you're setting it for messaging connections or 
> > for
>
> > management.
> > I will check. By the way what is your brother version?
> >
> > A word of warning: anyone who can connect JConsole to the broker can

> > inspect system properties (possibly excluding 
> > javax.net.ssl.keyStorePassword, but I'm not sure), so you should 
> > consider ways of controlling access. The online broker documentation

> > describes how to apply authentication and authorisation to JMX
access.
> >
> > Hope that helps,
> > Phil
> > On Dec 8, 2012 12:21 AM, <Da...@ubs.com> wrote:
> >
> > > **
> > >
> > > Hi, Guys,
> > >
> > > Is there a way to encrypt keystore password in ssl configuration 
> > > in config.xml?
> > >
> > > David
> > >
> > > *David Hu*
> > > UBS, Group Technology Platform Service
> > > 1-201-318-7435
> > > ChatID: huda
> > >
> > >
> > > Visit our website at http://www.ubs.com
> > >
> > > This message contains confidential information and is intended 
> > > only for the individual named.  If you are not the named addressee

> > > you should not disseminate, distribute or copy this e-mail.  
> > > Please notify
> >
> > > the sender immediately by e-mail if you have received this e-mail 
> > > by
>
> > > mistake and delete this e-mail from your system.
> > >
> > > E-mails are not encrypted and cannot be guaranteed to be secure or

> > > error-free as information could be intercepted, corrupted, lost, 
> > > destroyed, arrive late or incomplete, or contain viruses.  The 
> > > sender therefore does not accept liability for any errors or 
> > > omissions in the
> >
> > > contents of this message which arise as a result of e-mail
> > transmission.
> > > If verification is required please request a hard-copy version.
> > > This message is provided for informational purposes and should not

> > > be construed as a solicitation or offer to buy or sell any 
> > > securities or related financial instruments.
> > >
> > >
> > > UBS reserves the right to retain all messages. Messages are 
> > > protected and accessed only in legally justified cases.
> > >
> > >
> > > ------------------------------------------------------------------
> > > --
> > > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> > > additional commands, e-mail: users-help@qpid.apache.org
> > >
> > Visit our website at http://www.ubs.com
> >
> > This message contains confidential information and is intended only 
> > for the individual named.  If you are not the named addressee you 
> > should not disseminate, distribute or copy this e-mail.  Please 
> > notify
>
> > the sender immediately by e-mail if you have received this e-mail by

> > mistake and delete this e-mail from your system.
> >
> > E-mails are not encrypted and cannot be guaranteed to be secure or 
> > error-free as information could be intercepted, corrupted, lost, 
> > destroyed, arrive late or incomplete, or contain viruses.  The 
> > sender therefore does not accept liability for any errors or 
> > omissions in the
>
> > contents of this message which arise as a result of e-mail
> transmission.
> > If verification is required please request a hard-copy version.  
> > This message is provided for informational purposes and should not 
> > be construed as a solicitation or offer to buy or sell any 
> > securities or related financial instruments.
> >
> >
> > UBS reserves the right to retain all messages. Messages are 
> > protected and accessed only in legally justified cases.
> >
> > --------------------------------------------------------------------
> > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> > additional commands, e-mail: users-help@qpid.apache.org
> >
> >
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only 
> for the individual named.  If you are not the named addressee you 
> should not disseminate, distribute or copy this e-mail.  Please notify

> the sender immediately by e-mail if you have received this e-mail by 
> mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or 
> error-free as information could be intercepted, corrupted, lost, 
> destroyed, arrive late or incomplete, or contain viruses.  The sender 
> therefore does not accept liability for any errors or omissions in the

> contents of this message which arise as a result of e-mail
transmission.
> If verification is required please request a hard-copy version.  This 
> message is provided for informational purposes and should not be 
> construed as a solicitation or offer to buy or sell any securities or 
> related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected 
> and accessed only in legally justified cases.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> additional commands, e-mail: users-help@qpid.apache.org
>
>
Visit our website at http://www.ubs.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.
	
E-mails are not encrypted and cannot be guaranteed to be secure or 
error-free as information could be intercepted, corrupted, lost, 
destroyed, arrive late or incomplete, or contain viruses.  The sender 
therefore does not accept liability for any errors or omissions in the 
contents of this message which arise as a result of e-mail transmission.  
If verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities 
or related financial instruments.

 
UBS reserves the right to retain all messages. Messages are protected
and accessed only in legally justified cases.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org

Re: How to encrypt ssl keystore password in config.xml

[Robbie Gemmell <ro...@gmail.com>]

The variable value can be passed in using -D system properties, but not as
an environment variable (Phils example set the -D system property
configuration by supplying it to the startup script via an environment
variable the startup script uses to enable such configuration).

Robbie

On 11 December 2012 21:47, <Da...@ubs.com> wrote:

> Hi, Robbie,
>
> Make sense.
>
> The ssl keystore/truststore/passwords in connection url is for client
> side only.
>
> But for broker, the configuration should go in config.xml where the
> variable can be used as per Phil and the value of the variables can be
> passed in using -D or via environment variable.
>
> Again, I will leave JMX out of the scope at this point.
>
> Thanks,
> David
>
> -----Original Message-----
> From: Robbie Gemmell [mailto:robbie.gemmell@gmail.com]
> Sent: Tuesday, December 11, 2012 4:43 PM
> To: users@qpid.apache.org
> Subject: Re: How to encrypt ssl keystore password in config.xml
>
> Hi David,
>
> There seems to be a bit of confusion here.
>
> The brokers SSL configuration in relation to the messaging ports can
> only be controlled using the <connector><ssl> elements in config.xml.
> Phil was suggesting that you could use system properties (which will be
> resolved at broker startup) in the config file rather than placing the
> actual values in the config file. These system property could be the
> standard SSL system properties, or any other name of your own choosing.
> In this case anyone able to connect via JMX and view the contents of the
> JVMs 'Platform'
> MBeanServer (which is what gets used by default by the broker for its
> MBeans and by the JVM itself for all its standard MBeans, and then gets
> exposed via JMX either by the brokers JMXConnectorServer or the JVMs own
> if is enabled at startup or activated by 'locally' attaching JConsole
> etc as the user who started the process) would be able to view the
> arguments used to start the JVM since one of the standard MBeans exposes
> these (as used to populate the VM Summary tab in JConsole), and those
> would include the system properties. There is one way around that, as
> mentioned in my earlier email and further explained below [*].
>
> The ability to specify SSL options in the clients connection url (as
> opposed to via the client JVMs SSL system properties) only influences
> the clients SSL configuration, not the brokers. The keystore and
> truststore configuration for the server and client side are entirely
> independent. When the broker has an SSL certificate it needs a keystore,
> and the client needs a truststore containing trust information for that
> certificate (assuming it is not trusted at the JVM installation level).
> When the broker additionionally requires client certificates be
> presented then the client will also need a keystore to contain its
> certificate, and the broker will then need a truststore containing trust
> information relating to the client certificates (again assuming they are
> not already trusted at the JVM installation level).
>
> Robbie
>
> [*] You could move the brokers MBeans out of the Platform MBeanServer
> using the configuration I mentioned previously, which would prevent
> people from being able to see the argument information (along with all
> the Thread, Memory etc information) when connecting to the
> JMXConnectorServer started by the broker. People connecting to the JVMs
> own Platform JMXConnectorServer (which gets used when you have started
> in the JVM using the com.sun.management.* options and then do a 'remote'
> JConsole etc connection to the JMXConnectorServer, on that port, or
> perform a 'local'
> connection to a JVM with JConsole etc whereby a management agent is
> injected in the running JVM using the Attach API) would still be viewing
> the contents of the Platform MBeanServer and thus be able to view that
> argument information, but would not be able to view the brokers MBeans
> since they would now be in a separate MBeanServer. Unless you start the
> JVM the com.sun.management.* options to enable its platform
> JMXConnectorServer, the ability to access the Platform
> JMXConnectorServer would only apply to the user who started the broker,
> such that they can do a 'local' JMX connection with JConsole etc, and
> they obviously already had acess to the argument information anyway when
> starting the broker.
>
> On 11 December 2012 17:04, <Da...@ubs.com> wrote:
>
> > Hi, Phil,
> >
> > With another of the response, you seem have recommended two approaches
>
> > on doing this -
> >
> > 1. use system variable
> >     (1) use java option -D to pass the value in
> >     (2) export variable to pass in the value
> >
> > 2. Pass the keystore and password via connection URL (like your test
> > case). It means that that the one passed in via connection URL
> > overrides the one defined in config.xml, correct?
> >
> > For 1(1), the password will be exposed in Jconsole. For 1(2), the
> > password will be in starting script.
> >
> > The better approach is 2 where we can programatically construct the
> URL.
> > The password can be passed-in in encrypted format and can be decrypted
>
> > when constructing URL.
> >
> > Still it seems there is no out-of-box solution, we need to write our
> > own client (in the context of Synapse, we need to write our own
> JMSListener.
> > It goes back to my understanding before.
> >
> > Thanks for all the help.
> >
> > David
> >
> > -----Original Message-----
> > From: philharveyonline@googlemail.com
> > [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> > Sent: Tuesday, December 11, 2012 2:00 AM
> > To: users@qpid.apache.org
> > Subject: Re: How to encrypt ssl keystore password in config.xml
> >
> > Hi David,
> >
> > You can't exactly encrypt it, but you can avoid hard coding it. You
> > can refer to system properties in config.xml using the form
> ${mypassword}.
> >
> > Expose system properties to the broker before starting it like so:
> >
> > export QPID_OPTS='-Dmypassword=password1'
> >
> > I think the broker automatically picks up the value of system property
>
> > javax.net.ssl.keyStorePassword but iirc this depends on the broker
> > version and whether you're setting it for messaging connections or for
>
> > management.
> > I will check. By the way what is your brother version?
> >
> > A word of warning: anyone who can connect JConsole to the broker can
> > inspect system properties (possibly excluding
> > javax.net.ssl.keyStorePassword, but I'm not sure), so you should
> > consider ways of controlling access. The online broker documentation
> > describes how to apply authentication and authorisation to JMX access.
> >
> > Hope that helps,
> > Phil
> > On Dec 8, 2012 12:21 AM, <Da...@ubs.com> wrote:
> >
> > > **
> > >
> > > Hi, Guys,
> > >
> > > Is there a way to encrypt keystore password in ssl configuration in
> > > config.xml?
> > >
> > > David
> > >
> > > *David Hu*
> > > UBS, Group Technology Platform Service
> > > 1-201-318-7435
> > > ChatID: huda
> > >
> > >
> > > Visit our website at http://www.ubs.com
> > >
> > > This message contains confidential information and is intended only
> > > for the individual named.  If you are not the named addressee you
> > > should not disseminate, distribute or copy this e-mail.  Please
> > > notify
> >
> > > the sender immediately by e-mail if you have received this e-mail by
>
> > > mistake and delete this e-mail from your system.
> > >
> > > E-mails are not encrypted and cannot be guaranteed to be secure or
> > > error-free as information could be intercepted, corrupted, lost,
> > > destroyed, arrive late or incomplete, or contain viruses.  The
> > > sender therefore does not accept liability for any errors or
> > > omissions in the
> >
> > > contents of this message which arise as a result of e-mail
> > transmission.
> > > If verification is required please request a hard-copy version.
> > > This message is provided for informational purposes and should not
> > > be construed as a solicitation or offer to buy or sell any
> > > securities or related financial instruments.
> > >
> > >
> > > UBS reserves the right to retain all messages. Messages are
> > > protected and accessed only in legally justified cases.
> > >
> > >
> > > --------------------------------------------------------------------
> > > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> > > additional commands, e-mail: users-help@qpid.apache.org
> > >
> > Visit our website at http://www.ubs.com
> >
> > This message contains confidential information and is intended only
> > for the individual named.  If you are not the named addressee you
> > should not disseminate, distribute or copy this e-mail.  Please notify
>
> > the sender immediately by e-mail if you have received this e-mail by
> > mistake and delete this e-mail from your system.
> >
> > E-mails are not encrypted and cannot be guaranteed to be secure or
> > error-free as information could be intercepted, corrupted, lost,
> > destroyed, arrive late or incomplete, or contain viruses.  The sender
> > therefore does not accept liability for any errors or omissions in the
>
> > contents of this message which arise as a result of e-mail
> transmission.
> > If verification is required please request a hard-copy version.  This
> > message is provided for informational purposes and should not be
> > construed as a solicitation or offer to buy or sell any securities or
> > related financial instruments.
> >
> >
> > UBS reserves the right to retain all messages. Messages are protected
> > and accessed only in legally justified cases.
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> > additional commands, e-mail: users-help@qpid.apache.org
> >
> >
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only
> for the individual named.  If you are not the named addressee you
> should not disseminate, distribute or copy this e-mail.  Please
> notify the sender immediately by e-mail if you have received this
> e-mail by mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or
> error-free as information could be intercepted, corrupted, lost,
> destroyed, arrive late or incomplete, or contain viruses.  The sender
> therefore does not accept liability for any errors or omissions in the
> contents of this message which arise as a result of e-mail transmission.
> If verification is required please request a hard-copy version.  This
> message is provided for informational purposes and should not be
> construed as a solicitation or offer to buy or sell any securities
> or related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected
> and accessed only in legally justified cases.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>
>

RE: How to encrypt ssl keystore password in config.xml

[Da...@ubs.com]

Hi, Robbie, 

Make sense. 

The ssl keystore/truststore/passwords in connection url is for client
side only. 

But for broker, the configuration should go in config.xml where the
variable can be used as per Phil and the value of the variables can be
passed in using -D or via environment variable. 

Again, I will leave JMX out of the scope at this point. 

Thanks, 
David 

-----Original Message-----
From: Robbie Gemmell [mailto:robbie.gemmell@gmail.com] 
Sent: Tuesday, December 11, 2012 4:43 PM
To: users@qpid.apache.org
Subject: Re: How to encrypt ssl keystore password in config.xml

Hi David,

There seems to be a bit of confusion here.

The brokers SSL configuration in relation to the messaging ports can
only be controlled using the <connector><ssl> elements in config.xml.
Phil was suggesting that you could use system properties (which will be
resolved at broker startup) in the config file rather than placing the
actual values in the config file. These system property could be the
standard SSL system properties, or any other name of your own choosing.
In this case anyone able to connect via JMX and view the contents of the
JVMs 'Platform'
MBeanServer (which is what gets used by default by the broker for its
MBeans and by the JVM itself for all its standard MBeans, and then gets
exposed via JMX either by the brokers JMXConnectorServer or the JVMs own
if is enabled at startup or activated by 'locally' attaching JConsole
etc as the user who started the process) would be able to view the
arguments used to start the JVM since one of the standard MBeans exposes
these (as used to populate the VM Summary tab in JConsole), and those
would include the system properties. There is one way around that, as
mentioned in my earlier email and further explained below [*].

The ability to specify SSL options in the clients connection url (as
opposed to via the client JVMs SSL system properties) only influences
the clients SSL configuration, not the brokers. The keystore and
truststore configuration for the server and client side are entirely
independent. When the broker has an SSL certificate it needs a keystore,
and the client needs a truststore containing trust information for that
certificate (assuming it is not trusted at the JVM installation level).
When the broker additionionally requires client certificates be
presented then the client will also need a keystore to contain its
certificate, and the broker will then need a truststore containing trust
information relating to the client certificates (again assuming they are
not already trusted at the JVM installation level).

Robbie

[*] You could move the brokers MBeans out of the Platform MBeanServer
using the configuration I mentioned previously, which would prevent
people from being able to see the argument information (along with all
the Thread, Memory etc information) when connecting to the
JMXConnectorServer started by the broker. People connecting to the JVMs
own Platform JMXConnectorServer (which gets used when you have started
in the JVM using the com.sun.management.* options and then do a 'remote'
JConsole etc connection to the JMXConnectorServer, on that port, or
perform a 'local'
connection to a JVM with JConsole etc whereby a management agent is
injected in the running JVM using the Attach API) would still be viewing
the contents of the Platform MBeanServer and thus be able to view that
argument information, but would not be able to view the brokers MBeans
since they would now be in a separate MBeanServer. Unless you start the
JVM the com.sun.management.* options to enable its platform
JMXConnectorServer, the ability to access the Platform
JMXConnectorServer would only apply to the user who started the broker,
such that they can do a 'local' JMX connection with JConsole etc, and
they obviously already had acess to the argument information anyway when
starting the broker.

On 11 December 2012 17:04, <Da...@ubs.com> wrote:

> Hi, Phil,
>
> With another of the response, you seem have recommended two approaches

> on doing this -
>
> 1. use system variable
>     (1) use java option -D to pass the value in
>     (2) export variable to pass in the value
>
> 2. Pass the keystore and password via connection URL (like your test 
> case). It means that that the one passed in via connection URL 
> overrides the one defined in config.xml, correct?
>
> For 1(1), the password will be exposed in Jconsole. For 1(2), the 
> password will be in starting script.
>
> The better approach is 2 where we can programatically construct the
URL.
> The password can be passed-in in encrypted format and can be decrypted

> when constructing URL.
>
> Still it seems there is no out-of-box solution, we need to write our 
> own client (in the context of Synapse, we need to write our own
JMSListener.
> It goes back to my understanding before.
>
> Thanks for all the help.
>
> David
>
> -----Original Message-----
> From: philharveyonline@googlemail.com
> [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> Sent: Tuesday, December 11, 2012 2:00 AM
> To: users@qpid.apache.org
> Subject: Re: How to encrypt ssl keystore password in config.xml
>
> Hi David,
>
> You can't exactly encrypt it, but you can avoid hard coding it. You 
> can refer to system properties in config.xml using the form
${mypassword}.
>
> Expose system properties to the broker before starting it like so:
>
> export QPID_OPTS='-Dmypassword=password1'
>
> I think the broker automatically picks up the value of system property

> javax.net.ssl.keyStorePassword but iirc this depends on the broker 
> version and whether you're setting it for messaging connections or for

> management.
> I will check. By the way what is your brother version?
>
> A word of warning: anyone who can connect JConsole to the broker can 
> inspect system properties (possibly excluding 
> javax.net.ssl.keyStorePassword, but I'm not sure), so you should 
> consider ways of controlling access. The online broker documentation 
> describes how to apply authentication and authorisation to JMX access.
>
> Hope that helps,
> Phil
> On Dec 8, 2012 12:21 AM, <Da...@ubs.com> wrote:
>
> > **
> >
> > Hi, Guys,
> >
> > Is there a way to encrypt keystore password in ssl configuration in 
> > config.xml?
> >
> > David
> >
> > *David Hu*
> > UBS, Group Technology Platform Service
> > 1-201-318-7435
> > ChatID: huda
> >
> >
> > Visit our website at http://www.ubs.com
> >
> > This message contains confidential information and is intended only 
> > for the individual named.  If you are not the named addressee you 
> > should not disseminate, distribute or copy this e-mail.  Please 
> > notify
>
> > the sender immediately by e-mail if you have received this e-mail by

> > mistake and delete this e-mail from your system.
> >
> > E-mails are not encrypted and cannot be guaranteed to be secure or 
> > error-free as information could be intercepted, corrupted, lost, 
> > destroyed, arrive late or incomplete, or contain viruses.  The 
> > sender therefore does not accept liability for any errors or 
> > omissions in the
>
> > contents of this message which arise as a result of e-mail
> transmission.
> > If verification is required please request a hard-copy version.  
> > This message is provided for informational purposes and should not 
> > be construed as a solicitation or offer to buy or sell any 
> > securities or related financial instruments.
> >
> >
> > UBS reserves the right to retain all messages. Messages are 
> > protected and accessed only in legally justified cases.
> >
> >
> > --------------------------------------------------------------------
> > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> > additional commands, e-mail: users-help@qpid.apache.org
> >
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only 
> for the individual named.  If you are not the named addressee you 
> should not disseminate, distribute or copy this e-mail.  Please notify

> the sender immediately by e-mail if you have received this e-mail by 
> mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or 
> error-free as information could be intercepted, corrupted, lost, 
> destroyed, arrive late or incomplete, or contain viruses.  The sender 
> therefore does not accept liability for any errors or omissions in the

> contents of this message which arise as a result of e-mail
transmission.
> If verification is required please request a hard-copy version.  This 
> message is provided for informational purposes and should not be 
> construed as a solicitation or offer to buy or sell any securities or 
> related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected 
> and accessed only in legally justified cases.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> additional commands, e-mail: users-help@qpid.apache.org
>
>
Visit our website at http://www.ubs.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.
	
E-mails are not encrypted and cannot be guaranteed to be secure or 
error-free as information could be intercepted, corrupted, lost, 
destroyed, arrive late or incomplete, or contain viruses.  The sender 
therefore does not accept liability for any errors or omissions in the 
contents of this message which arise as a result of e-mail transmission.  
If verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities 
or related financial instruments.

 
UBS reserves the right to retain all messages. Messages are protected
and accessed only in legally justified cases.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org

Re: How to encrypt ssl keystore password in config.xml

[Robbie Gemmell <ro...@gmail.com>]

Also meant to add, when Phil pointed you at SSLTest he really meant you to
look at configuration of the clients for SSL via the standard SSL system
properties (as used in testCreateSSLConnectionUsingSystemProperties for
example), and not the ability to configure the clients SSL configuration
using the connection URL. Those properties being:

javax.net.ssl.keyStore
javax.net.ssl.keyStorePassword
javax.net.ssl.trustStore
javax.net.ssl.trustStorePassword

Robbie


On 11 December 2012 21:42, Robbie Gemmell <ro...@gmail.com> wrote:

> Hi David,
>
> There seems to be a bit of confusion here.
>
> The brokers SSL configuration in relation to the messaging ports can only
> be controlled using the <connector><ssl> elements in config.xml. Phil was
> suggesting that you could use system properties (which will be resolved at
> broker startup) in the config file rather than placing the actual values in
> the config file. These system property could be the standard SSL system
> properties, or any other name of your own choosing. In this case anyone
> able to connect via JMX and view the contents of the JVMs 'Platform'
> MBeanServer (which is what gets used by default by the broker for its
> MBeans and by the JVM itself for all its standard MBeans, and then gets
> exposed via JMX either by the brokers JMXConnectorServer or the JVMs own if
> is enabled at startup or activated by 'locally' attaching JConsole etc as
> the user who started the process) would be able to view the arguments used
> to start the JVM since one of the standard MBeans exposes these (as used to
> populate the VM Summary tab in JConsole), and those would include the
> system properties. There is one way around that, as mentioned in my earlier
> email and further explained below [*].
>
> The ability to specify SSL options in the clients connection url (as
> opposed to via the client JVMs SSL system properties) only influences the
> clients SSL configuration, not the brokers. The keystore and truststore
> configuration for the server and client side are entirely independent. When
> the broker has an SSL certificate it needs a keystore, and the client needs
> a truststore containing trust information for that certificate (assuming it
> is not trusted at the JVM installation level). When the broker
> additionionally requires client certificates be presented then the client
> will also need a keystore to contain its certificate, and the broker will
> then need a truststore containing trust information relating to the client
> certificates (again assuming they are not already trusted at the JVM
> installation level).
>
> Robbie
>
> [*] You could move the brokers MBeans out of the Platform MBeanServer
> using the configuration I mentioned previously, which would prevent people
> from being able to see the argument information (along with all the Thread,
> Memory etc information) when connecting to the JMXConnectorServer started
> by the broker. People connecting to the JVMs own Platform
> JMXConnectorServer (which gets used when you have started in the JVM using
> the com.sun.management.* options and then do a 'remote' JConsole etc
> connection to the JMXConnectorServer, on that port, or perform a 'local'
> connection to a JVM with JConsole etc whereby a management agent is
> injected in the running JVM using the Attach API) would still be viewing
> the contents of the Platform MBeanServer and thus be able to view that
> argument information, but would not be able to view the brokers MBeans
> since they would now be in a separate MBeanServer. Unless you start the JVM
> the com.sun.management.* options to enable its platform JMXConnectorServer,
> the ability to access the Platform JMXConnectorServer would only apply to
> the user who started the broker, such that they can do a 'local' JMX
> connection with JConsole etc, and they obviously already had acess to the
> argument information anyway when starting the broker.
>
>
> On 11 December 2012 17:04, <Da...@ubs.com> wrote:
>
>> Hi, Phil,
>>
>> With another of the response, you seem have recommended two approaches
>> on doing this -
>>
>> 1. use system variable
>>     (1) use java option -D to pass the value in
>>     (2) export variable to pass in the value
>>
>> 2. Pass the keystore and password via connection URL (like your test
>> case). It means that that the one passed in via connection URL overrides
>> the one defined in config.xml, correct?
>>
>> For 1(1), the password will be exposed in Jconsole. For 1(2), the
>> password will be in starting script.
>>
>> The better approach is 2 where we can programatically construct the URL.
>> The password can be passed-in in encrypted format and can be decrypted
>> when constructing URL.
>>
>> Still it seems there is no out-of-box solution, we need to write our own
>> client (in the context of Synapse, we need to write our own JMSListener.
>> It goes back to my understanding before.
>>
>> Thanks for all the help.
>>
>> David
>>
>> -----Original Message-----
>> From: philharveyonline@googlemail.com
>> [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
>> Sent: Tuesday, December 11, 2012 2:00 AM
>> To: users@qpid.apache.org
>> Subject: Re: How to encrypt ssl keystore password in config.xml
>>
>> Hi David,
>>
>> You can't exactly encrypt it, but you can avoid hard coding it. You can
>> refer to system properties in config.xml using the form ${mypassword}.
>>
>> Expose system properties to the broker before starting it like so:
>>
>> export QPID_OPTS='-Dmypassword=password1'
>>
>> I think the broker automatically picks up the value of system property
>> javax.net.ssl.keyStorePassword but iirc this depends on the broker
>> version and whether you're setting it for messaging connections or for
>> management.
>> I will check. By the way what is your brother version?
>>
>> A word of warning: anyone who can connect JConsole to the broker can
>> inspect system properties (possibly excluding
>> javax.net.ssl.keyStorePassword, but I'm not sure), so you should
>> consider ways of controlling access. The online broker documentation
>> describes how to apply authentication and authorisation to JMX access.
>>
>> Hope that helps,
>> Phil
>> On Dec 8, 2012 12:21 AM, <Da...@ubs.com> wrote:
>>
>> > **
>> >
>> > Hi, Guys,
>> >
>> > Is there a way to encrypt keystore password in ssl configuration in
>> > config.xml?
>> >
>> > David
>> >
>> > *David Hu*
>> > UBS, Group Technology Platform Service
>> > 1-201-318-7435
>> > ChatID: huda
>> >
>> >
>> > Visit our website at http://www.ubs.com
>> >
>> > This message contains confidential information and is intended only
>> > for the individual named.  If you are not the named addressee you
>> > should not disseminate, distribute or copy this e-mail.  Please notify
>>
>> > the sender immediately by e-mail if you have received this e-mail by
>> > mistake and delete this e-mail from your system.
>> >
>> > E-mails are not encrypted and cannot be guaranteed to be secure or
>> > error-free as information could be intercepted, corrupted, lost,
>> > destroyed, arrive late or incomplete, or contain viruses.  The sender
>> > therefore does not accept liability for any errors or omissions in the
>>
>> > contents of this message which arise as a result of e-mail
>> transmission.
>> > If verification is required please request a hard-copy version.  This
>> > message is provided for informational purposes and should not be
>> > construed as a solicitation or offer to buy or sell any securities or
>> > related financial instruments.
>> >
>> >
>> > UBS reserves the right to retain all messages. Messages are protected
>> > and accessed only in legally justified cases.
>> >
>> >
>> > ---------------------------------------------------------------------
>> > To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
>> > additional commands, e-mail: users-help@qpid.apache.org
>> >
>> Visit our website at http://www.ubs.com
>>
>> This message contains confidential information and is intended only
>> for the individual named.  If you are not the named addressee you
>> should not disseminate, distribute or copy this e-mail.  Please
>> notify the sender immediately by e-mail if you have received this
>> e-mail by mistake and delete this e-mail from your system.
>>
>> E-mails are not encrypted and cannot be guaranteed to be secure or
>> error-free as information could be intercepted, corrupted, lost,
>> destroyed, arrive late or incomplete, or contain viruses.  The sender
>> therefore does not accept liability for any errors or omissions in the
>> contents of this message which arise as a result of e-mail transmission.
>> If verification is required please request a hard-copy version.  This
>> message is provided for informational purposes and should not be
>> construed as a solicitation or offer to buy or sell any securities
>> or related financial instruments.
>>
>>
>> UBS reserves the right to retain all messages. Messages are protected
>> and accessed only in legally justified cases.
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
>> For additional commands, e-mail: users-help@qpid.apache.org
>>
>>
>

Re: How to encrypt ssl keystore password in config.xml

[Robbie Gemmell <ro...@gmail.com>]

Hi David,

There seems to be a bit of confusion here.

The brokers SSL configuration in relation to the messaging ports can only
be controlled using the <connector><ssl> elements in config.xml. Phil was
suggesting that you could use system properties (which will be resolved at
broker startup) in the config file rather than placing the actual values in
the config file. These system property could be the standard SSL system
properties, or any other name of your own choosing. In this case anyone
able to connect via JMX and view the contents of the JVMs 'Platform'
MBeanServer (which is what gets used by default by the broker for its
MBeans and by the JVM itself for all its standard MBeans, and then gets
exposed via JMX either by the brokers JMXConnectorServer or the JVMs own if
is enabled at startup or activated by 'locally' attaching JConsole etc as
the user who started the process) would be able to view the arguments used
to start the JVM since one of the standard MBeans exposes these (as used to
populate the VM Summary tab in JConsole), and those would include the
system properties. There is one way around that, as mentioned in my earlier
email and further explained below [*].

The ability to specify SSL options in the clients connection url (as
opposed to via the client JVMs SSL system properties) only influences the
clients SSL configuration, not the brokers. The keystore and truststore
configuration for the server and client side are entirely independent. When
the broker has an SSL certificate it needs a keystore, and the client needs
a truststore containing trust information for that certificate (assuming it
is not trusted at the JVM installation level). When the broker
additionionally requires client certificates be presented then the client
will also need a keystore to contain its certificate, and the broker will
then need a truststore containing trust information relating to the client
certificates (again assuming they are not already trusted at the JVM
installation level).

Robbie

[*] You could move the brokers MBeans out of the Platform MBeanServer using
the configuration I mentioned previously, which would prevent people from
being able to see the argument information (along with all the Thread,
Memory etc information) when connecting to the JMXConnectorServer started
by the broker. People connecting to the JVMs own Platform
JMXConnectorServer (which gets used when you have started in the JVM using
the com.sun.management.* options and then do a 'remote' JConsole etc
connection to the JMXConnectorServer, on that port, or perform a 'local'
connection to a JVM with JConsole etc whereby a management agent is
injected in the running JVM using the Attach API) would still be viewing
the contents of the Platform MBeanServer and thus be able to view that
argument information, but would not be able to view the brokers MBeans
since they would now be in a separate MBeanServer. Unless you start the JVM
the com.sun.management.* options to enable its platform JMXConnectorServer,
the ability to access the Platform JMXConnectorServer would only apply to
the user who started the broker, such that they can do a 'local' JMX
connection with JConsole etc, and they obviously already had acess to the
argument information anyway when starting the broker.

On 11 December 2012 17:04, <Da...@ubs.com> wrote:

> Hi, Phil,
>
> With another of the response, you seem have recommended two approaches
> on doing this -
>
> 1. use system variable
>     (1) use java option -D to pass the value in
>     (2) export variable to pass in the value
>
> 2. Pass the keystore and password via connection URL (like your test
> case). It means that that the one passed in via connection URL overrides
> the one defined in config.xml, correct?
>
> For 1(1), the password will be exposed in Jconsole. For 1(2), the
> password will be in starting script.
>
> The better approach is 2 where we can programatically construct the URL.
> The password can be passed-in in encrypted format and can be decrypted
> when constructing URL.
>
> Still it seems there is no out-of-box solution, we need to write our own
> client (in the context of Synapse, we need to write our own JMSListener.
> It goes back to my understanding before.
>
> Thanks for all the help.
>
> David
>
> -----Original Message-----
> From: philharveyonline@googlemail.com
> [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> Sent: Tuesday, December 11, 2012 2:00 AM
> To: users@qpid.apache.org
> Subject: Re: How to encrypt ssl keystore password in config.xml
>
> Hi David,
>
> You can't exactly encrypt it, but you can avoid hard coding it. You can
> refer to system properties in config.xml using the form ${mypassword}.
>
> Expose system properties to the broker before starting it like so:
>
> export QPID_OPTS='-Dmypassword=password1'
>
> I think the broker automatically picks up the value of system property
> javax.net.ssl.keyStorePassword but iirc this depends on the broker
> version and whether you're setting it for messaging connections or for
> management.
> I will check. By the way what is your brother version?
>
> A word of warning: anyone who can connect JConsole to the broker can
> inspect system properties (possibly excluding
> javax.net.ssl.keyStorePassword, but I'm not sure), so you should
> consider ways of controlling access. The online broker documentation
> describes how to apply authentication and authorisation to JMX access.
>
> Hope that helps,
> Phil
> On Dec 8, 2012 12:21 AM, <Da...@ubs.com> wrote:
>
> > **
> >
> > Hi, Guys,
> >
> > Is there a way to encrypt keystore password in ssl configuration in
> > config.xml?
> >
> > David
> >
> > *David Hu*
> > UBS, Group Technology Platform Service
> > 1-201-318-7435
> > ChatID: huda
> >
> >
> > Visit our website at http://www.ubs.com
> >
> > This message contains confidential information and is intended only
> > for the individual named.  If you are not the named addressee you
> > should not disseminate, distribute or copy this e-mail.  Please notify
>
> > the sender immediately by e-mail if you have received this e-mail by
> > mistake and delete this e-mail from your system.
> >
> > E-mails are not encrypted and cannot be guaranteed to be secure or
> > error-free as information could be intercepted, corrupted, lost,
> > destroyed, arrive late or incomplete, or contain viruses.  The sender
> > therefore does not accept liability for any errors or omissions in the
>
> > contents of this message which arise as a result of e-mail
> transmission.
> > If verification is required please request a hard-copy version.  This
> > message is provided for informational purposes and should not be
> > construed as a solicitation or offer to buy or sell any securities or
> > related financial instruments.
> >
> >
> > UBS reserves the right to retain all messages. Messages are protected
> > and accessed only in legally justified cases.
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> > additional commands, e-mail: users-help@qpid.apache.org
> >
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only
> for the individual named.  If you are not the named addressee you
> should not disseminate, distribute or copy this e-mail.  Please
> notify the sender immediately by e-mail if you have received this
> e-mail by mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or
> error-free as information could be intercepted, corrupted, lost,
> destroyed, arrive late or incomplete, or contain viruses.  The sender
> therefore does not accept liability for any errors or omissions in the
> contents of this message which arise as a result of e-mail transmission.
> If verification is required please request a hard-copy version.  This
> message is provided for informational purposes and should not be
> construed as a solicitation or offer to buy or sell any securities
> or related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected
> and accessed only in legally justified cases.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>
>

RE: How to encrypt ssl keystore password in config.xml

[Da...@ubs.com]

Hi, Phil, 

With another of the response, you seem have recommended two approaches
on doing this - 

1. use system variable 
    (1) use java option -D to pass the value in 
    (2) export variable to pass in the value 

2. Pass the keystore and password via connection URL (like your test
case). It means that that the one passed in via connection URL overrides
the one defined in config.xml, correct? 

For 1(1), the password will be exposed in Jconsole. For 1(2), the
password will be in starting script. 

The better approach is 2 where we can programatically construct the URL.
The password can be passed-in in encrypted format and can be decrypted
when constructing URL. 

Still it seems there is no out-of-box solution, we need to write our own
client (in the context of Synapse, we need to write our own JMSListener.
It goes back to my understanding before. 

Thanks for all the help. 

David

-----Original Message-----
From: philharveyonline@googlemail.com
[mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
Sent: Tuesday, December 11, 2012 2:00 AM
To: users@qpid.apache.org
Subject: Re: How to encrypt ssl keystore password in config.xml

Hi David,

You can't exactly encrypt it, but you can avoid hard coding it. You can
refer to system properties in config.xml using the form ${mypassword}.

Expose system properties to the broker before starting it like so:

export QPID_OPTS='-Dmypassword=password1'

I think the broker automatically picks up the value of system property
javax.net.ssl.keyStorePassword but iirc this depends on the broker
version and whether you're setting it for messaging connections or for
management.
I will check. By the way what is your brother version?

A word of warning: anyone who can connect JConsole to the broker can
inspect system properties (possibly excluding
javax.net.ssl.keyStorePassword, but I'm not sure), so you should
consider ways of controlling access. The online broker documentation
describes how to apply authentication and authorisation to JMX access.

Hope that helps,
Phil
On Dec 8, 2012 12:21 AM, <Da...@ubs.com> wrote:

> **
>
> Hi, Guys,
>
> Is there a way to encrypt keystore password in ssl configuration in 
> config.xml?
>
> David
>
> *David Hu*
> UBS, Group Technology Platform Service
> 1-201-318-7435
> ChatID: huda
>
>
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only 
> for the individual named.  If you are not the named addressee you 
> should not disseminate, distribute or copy this e-mail.  Please notify

> the sender immediately by e-mail if you have received this e-mail by 
> mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or 
> error-free as information could be intercepted, corrupted, lost, 
> destroyed, arrive late or incomplete, or contain viruses.  The sender 
> therefore does not accept liability for any errors or omissions in the

> contents of this message which arise as a result of e-mail
transmission.
> If verification is required please request a hard-copy version.  This 
> message is provided for informational purposes and should not be 
> construed as a solicitation or offer to buy or sell any securities or 
> related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected 
> and accessed only in legally justified cases.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> additional commands, e-mail: users-help@qpid.apache.org
>
Visit our website at http://www.ubs.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.
	
E-mails are not encrypted and cannot be guaranteed to be secure or 
error-free as information could be intercepted, corrupted, lost, 
destroyed, arrive late or incomplete, or contain viruses.  The sender 
therefore does not accept liability for any errors or omissions in the 
contents of this message which arise as a result of e-mail transmission.  
If verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities 
or related financial instruments.

 
UBS reserves the right to retain all messages. Messages are protected
and accessed only in legally justified cases.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org

Re: How to encrypt ssl keystore password in config.xml

[Phil Harvey <ph...@philharveyonline.com>]

Hi David,

You can't exactly encrypt it, but you can avoid hard coding it. You can
refer to system properties in config.xml using the form ${mypassword}.

Expose system properties to the broker before starting it like so:

export QPID_OPTS='-Dmypassword=password1'

I think the broker automatically picks up the value of system property
javax.net.ssl.keyStorePassword but iirc this depends on the broker version
and whether you're setting it for messaging connections or for management.
I will check. By the way what is your brother version?

A word of warning: anyone who can connect JConsole to the broker can
inspect system properties (possibly excluding
javax.net.ssl.keyStorePassword, but I'm not sure), so you should consider
ways of controlling access. The online broker documentation describes how
to apply authentication and authorisation to JMX access.

Hope that helps,
Phil
On Dec 8, 2012 12:21 AM, <Da...@ubs.com> wrote:

> **
>
> Hi, Guys,
>
> Is there a way to encrypt keystore password in ssl configuration in
> config.xml?
>
> David
>
> *David Hu*
> UBS, Group Technology Platform Service
> 1-201-318-7435
> ChatID: huda
>
>
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only
> for the individual named.  If you are not the named addressee you
> should not disseminate, distribute or copy this e-mail.  Please
> notify the sender immediately by e-mail if you have received this
> e-mail by mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or
> error-free as information could be intercepted, corrupted, lost,
> destroyed, arrive late or incomplete, or contain viruses.  The sender
> therefore does not accept liability for any errors or omissions in the
> contents of this message which arise as a result of e-mail transmission.
> If verification is required please request a hard-copy version.  This
> message is provided for informational purposes and should not be
> construed as a solicitation or offer to buy or sell any securities
> or related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected
> and accessed only in legally justified cases.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>

RE: How to encrypt user password in connection url

[Da...@ubs.com]

Ok, Robbie.  

-----Original Message-----
From: Robbie Gemmell [mailto:robbie.gemmell@gmail.com] 
Sent: Tuesday, December 11, 2012 5:18 PM
To: users@qpid.apache.org
Subject: Re: How to encrypt user password in connection url

Hi David,

The authentication system is pluggable (in the below case, using the
class element to specify a specific PrincipalDatabase implementation)
and I recall a discussion on here with someone from WSO2 a couple of
years ago about integrating with their existing authentication pieces,
so this would seem to relate to that. You would have to consult them for
any more information.

Its probably worth me mentioning that the configuration below looks to
be like that of a significantly older version of Qpid's Java code base,
which would suggest the broker you are using wont support SSL Client
Certificate Authentication (needs the 0.20 Java broker) and so you can
likely disregard the information mentioned on that topic.

Robbie

On 11 December 2012 18:13, <Da...@ubs.com> wrote:

> Hi, Robbie,
>
> Thanks for the info.
>
> About authenticator, I have noticed that there are the following 
> configurations in our qpid config.xml.
>
>     <security>
>         <principal-databases>
>             <principal-database>
>                 <name>carbon-user-store</name>
>
> <class>org.wso2.carbon.qpid.authentication.qpid.CarbonBasedPrincipalDa
> ta
> base</class>
>             </principal-database>
>         </principal-databases>
>
>         <msg-auth>false</msg-auth>
>
>         <jmx>
>             <access>${conf}/qpid-jmxremote.access</access>
>             <principal-database>carbon-user-store</principal-database>
>         </jmx>
>     </security>
>
> Well, the truth is that we use wso2, which is based on Synapse. Based 
> on the configuration, it seems that the qpid authentication is based 
> on
> wso2 user data base?
>
> Thanks,
> David
>
> -----Original Message-----
> From: Robbie Gemmell [mailto:robbie.gemmell@gmail.com]
> Sent: Tuesday, December 11, 2012 7:07 AM
> To: users@qpid.apache.org
> Subject: Re: How to encrypt user password in connection url
>
> Hi David,
>
> I beleive what Phil and Rajith were commenting on was the use of the 
> SSL certificates as opposed to the password in the connection URL, 
> that is to use Client Certificate Authentication such that the broker 
> only allows the connection if it trusts the clients certificate. This 
> could be instead of any password verification from the client being 
> required, or in addition to it, depending on the particular 
> authentication provider that was configured.
>
> I would note that in order to do that with the Java broker you would 
> need to use the 0.20 release, which is currently at RC2 (available at
> http://people.apache.org/~jross/qpid-0.20-rc2/) and expected to 
> proceed to initial release vote based on RC3 next week.
>
> You can find a pre-release (but not currently expected to change) copy

> of the 0.20 documentation for the Java broker on the subjects of SSL 
> [client auth] and AuthenticationProviders at:
> http://qpid.apache.org/books/0.20/AMQP-Messaging-Broker-Java-Book/html
> /J
> ava-Broker-Security-SSL.html
> http://qpid.apache.org/books/0.20/AMQP-Messaging-Broker-Java-Book/html
> /J ava-Broker-Security-Authentication-Providers.html
>
> I'm not familiar with Synapse so I dont know if this is an option with

> it as it stands, but its worth noting that you dont strictly have to 
> supply usernames and passwords in the actual URL. It is possible to 
> specify credentials at runtime when using a JMS ConnectionFactory (as 
> per 
> http://docs.oracle.com/javaee/6/api/javax/jms/ConnectionFactory.html#c
> re ateConnection(java.lang.String,%20java.lang.String),
> such that those are used instead of any that were/were not specified 
> in the base JNDI config. In that case, the URL you put in the file 
> could just have placholders or empty strings for the user and 
> password, with the real credentials to be supplied at runtime, sourced

> via whatever mechanism you like. Again however, I'm not sure of the 
> options available for specifying the credentials when using Synapse.
>
> As mentioned on the other thread, a completely different suggestion 
> might be to investigate encryption at the file/filesystem level.
>
> Robbie
>
>
> On 10 December 2012 22:09, <Da...@ubs.com> wrote:
>
> > Hi, Rajith,
> >
> > I know qpid supports ssl but in terms of the password in connection 
> > url below, how? This is tied up with Synapse, which read the url, 
> > parse out user name and password and tries to sign up with Synapse 
> > server. Maybe you are talking about checking if Synapse supports SSL

> > authentication & Kerberos?
> >
> > connectionfactory.QueueConnectionFactory = 
> > amqp://user:password@clientID/test?brokerlist=..&ssl="true"&.
> >
> > David
> >
> > -----Original Message-----
> > From: Rajith Attapattu [mailto:rajith77@gmail.com]
> > Sent: Monday, December 10, 2012 4:25 PM
> > To: users@qpid.apache.org
> > Subject: Re: How to encrypt user password in connection url
> >
> > David,
> >
> > If you have security concerns, I think rather than trying to write a

> > custom JMS listener, it would probably be worthwhile looking at 
> > using a more secure mechanism like SSL certificates or Kerberos.
> >
> > Rajith
> >
> > On Mon, Dec 10, 2012 at 3:25 PM,  <Da...@ubs.com> wrote:
> > > Hi, Phil,
> > >
> > > Got it. It seems that we need to write our own JMS listener, 
> > > extending
> >
> > > from the default one, org.apache.axis2.transport.jms.JMSListener .
> > >
> > > Thanks for the help.
> > > David
> > >
> > > -----Original Message-----
> > > From: philharveyonline@googlemail.com 
> > > [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> > > Sent: Sunday, December 09, 2012 12:57 AM
> > > To: users@qpid.apache.org
> > > Subject: RE: How to encrypt user password in connection url
> > >
> > > Hi David,
> > >
> > > I was actually thinking containers such as WebSphere which allow 
> > > JNDI objects to be securely stored by an administrator. Sounds 
> > > like that might not be useful in your case though.
> > >
> > > I don't know the best way of securely storing the connection URL 
> > > in Synapse. Writing a custom JMSListener may be an option. You 
> > > could try asking for advice on the Synapse mailing list.
> > >
> > > Finally, note that Qpid does support client SSL authentication. 
> > > This
>
> > > may provide the level of security that you need. If you think this

> > > might be useful we can help you set it up.
> > >
> > > Incidentally, which version of the Qpid client and broker are you
> > using?
> > >
> > > Phil
> > > On Dec 8, 2012 4:47 PM, <Da...@ubs.com> wrote:
> > >
> > >> Hi, Phil,
> > >>
> > >> Thanks for the info.
> > >>
> > >> We are trying to embed qpid in Synapse where qpid connection 
> > >> information is stored in a property file in the format like -
> > >>
> > >> connectionfactory.QueueConnectionFactory = 
> > >> amqp://user:password@clientID/test?brokerlist=...
> > >>
> > >> So what you mean is that we need to create customized listener to

> > >> read
> > >
> > >> the property file and decrypt the password where the password can

> > >> be encrypted?
> > >>
> > >> It seems out of the box in Synapse, it uses 
> > >> org.apache.axis2.transport.jms.JMSListener and there is no such 
> > >> an option.
> > >>
> > >> Thanks,
> > >> David
> > >>
> > >>
> > >>
> > >> -----Original Message-----
> > >> From: philharveyonline@googlemail.com 
> > >> [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> > >> Sent: Saturday, December 08, 2012 2:11 AM
> > >> To: users@qpid.apache.org
> > >> Subject: Re: How to encrypt user password in connection url
> > >>
> > >> Hi David,
> > >>
> > >> I assume you're talking about encrypting the stored URL string, 
> > >> and
>
> > >> not about encrypting the details sent over the wire to the
broker.
>
> > >> I
> >
> > >> think the only way to do this is to store it in a secure JNDI 
> > >> context,
> > > e.g.
> > >> one provided by a Java application server.  This is in line with 
> > >> the approach commonly taken for making JDBC connections from JEE
> apps.
> > >>
> > >> Phil
> > >>
> > >>
> > >> On 8 December 2012 00:27, <Da...@ubs.com> wrote:
> > >>
> > >> > **
> > >> > Hi, Guys,
> > >> >
> > >> > Is there a way to encrypt password in the connection URL below?
> > >> >
> > >> > amqp://[<user>:<pass>@][<clientid>]<virtualhost>[..]
> > >> >
> > >> > David
> > >> >
> > >> > Visit our website at http://www.ubs.com
> > >> >
> > >> > This message contains confidential information and is intended 
> > >> > only
> >
> > >> > for the individual named.  If you are not the named addressee 
> > >> > you
>
> > >> > should not disseminate, distribute or copy this e-mail.  Please

> > >> > notify
> > >>
> > >> > the sender immediately by e-mail if you have received this 
> > >> > e-mail
>
> > >> > by
> > >
> > >> > mistake and delete this e-mail from your system.
> > >> >
> > >> > E-mails are not encrypted and cannot be guaranteed to be secure

> > >> > or error-free as information could be intercepted, corrupted, 
> > >> > lost, destroyed, arrive late or incomplete, or contain viruses.
> > >> > The sender therefore does not accept liability for any errors 
> > >> > or omissions in the
> > >>
> > >> > contents of this message which arise as a result of e-mail
> > >> transmission.
> > >> > If verification is required please request a hard-copy version.
> > >> > This message is provided for informational purposes and should 
> > >> > not be construed as a solicitation or offer to buy or sell any 
> > >> > securities or related financial instruments.
> > >> >
> > >> >
> > >> > UBS reserves the right to retain all messages. Messages are 
> > >> > protected and accessed only in legally justified cases.
> > >> >
> > >> >
> > >> > ---------------------------------------------------------------
> > >> > --
> > >> > --
> > >> > -
> > >> > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For

> > >> > additional commands, e-mail: users-help@qpid.apache.org
> > >> >
> > >> Visit our website at http://www.ubs.com
> > >>
> > >> This message contains confidential information and is intended 
> > >> only
>
> > >> for the individual named.  If you are not the named addressee you

> > >> should not disseminate, distribute or copy this e-mail.  Please 
> > >> notify
> > >
> > >> the sender immediately by e-mail if you have received this e-mail

> > >> by mistake and delete this e-mail from your system.
> > >>
> > >> E-mails are not encrypted and cannot be guaranteed to be secure 
> > >> or error-free as information could be intercepted, corrupted, 
> > >> lost, destroyed, arrive late or incomplete, or contain viruses.  
> > >> The sender
> >
> > >> therefore does not accept liability for any errors or omissions 
> > >> in the
> > >
> > >> contents of this message which arise as a result of e-mail
> > > transmission.
> > >> If verification is required please request a hard-copy version.
> > >> This
> >
> > >> message is provided for informational purposes and should not be 
> > >> construed as a solicitation or offer to buy or sell any 
> > >> securities or
> >
> > >> related financial instruments.
> > >>
> > >>
> > >> UBS reserves the right to retain all messages. Messages are 
> > >> protected
> >
> > >> and accessed only in legally justified cases.
> > >>
> > >> -----------------------------------------------------------------
> > >> --
> > >> -- To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> > >> additional commands, e-mail: users-help@qpid.apache.org
> > >>
> > >>
> > > Visit our website at http://www.ubs.com
> > >
> > > This message contains confidential information and is intended 
> > > only for the individual named.  If you are not the named addressee

> > > you should not disseminate, distribute or copy this e-mail.  
> > > Please notify
> >
> > > the sender immediately by e-mail if you have received this e-mail 
> > > by
>
> > > mistake and delete this e-mail from your system.
> > >
> > > E-mails are not encrypted and cannot be guaranteed to be secure or

> > > error-free as information could be intercepted, corrupted, lost, 
> > > destroyed, arrive late or incomplete, or contain viruses.  The 
> > > sender therefore does not accept liability for any errors or 
> > > omissions in the
> >
> > > contents of this message which arise as a result of e-mail
> > transmission.
> > > If verification is required please request a hard-copy version.
> > > This message is provided for informational purposes and should not

> > > be construed as a solicitation or offer to buy or sell any 
> > > securities or related financial instruments.
> > >
> > >
> > > UBS reserves the right to retain all messages. Messages are 
> > > protected and accessed only in legally justified cases.
> > >
> > > ------------------------------------------------------------------
> > > --
> > > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> > > additional commands, e-mail: users-help@qpid.apache.org
> > >
> >
> > --------------------------------------------------------------------
> > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> > additional commands, e-mail: users-help@qpid.apache.org
> >
> > Visit our website at http://www.ubs.com
> >
> > This message contains confidential information and is intended only 
> > for the individual named.  If you are not the named addressee you 
> > should not disseminate, distribute or copy this e-mail.  Please 
> > notify
>
> > the sender immediately by e-mail if you have received this e-mail by

> > mistake and delete this e-mail from your system.
> >
> > E-mails are not encrypted and cannot be guaranteed to be secure or 
> > error-free as information could be intercepted, corrupted, lost, 
> > destroyed, arrive late or incomplete, or contain viruses.  The 
> > sender therefore does not accept liability for any errors or 
> > omissions in the
>
> > contents of this message which arise as a result of e-mail
> transmission.
> > If verification is required please request a hard-copy version.  
> > This message is provided for informational purposes and should not 
> > be construed as a solicitation or offer to buy or sell any 
> > securities or related financial instruments.
> >
> >
> > UBS reserves the right to retain all messages. Messages are 
> > protected and accessed only in legally justified cases.
> >
> > --------------------------------------------------------------------
> > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> > additional commands, e-mail: users-help@qpid.apache.org
> >
> >
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only 
> for the individual named.  If you are not the named addressee you 
> should not disseminate, distribute or copy this e-mail.  Please notify

> the sender immediately by e-mail if you have received this e-mail by 
> mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or 
> error-free as information could be intercepted, corrupted, lost, 
> destroyed, arrive late or incomplete, or contain viruses.  The sender 
> therefore does not accept liability for any errors or omissions in the

> contents of this message which arise as a result of e-mail
transmission.
> If verification is required please request a hard-copy version.  This 
> message is provided for informational purposes and should not be 
> construed as a solicitation or offer to buy or sell any securities or 
> related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected 
> and accessed only in legally justified cases.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> additional commands, e-mail: users-help@qpid.apache.org
>
>
Visit our website at http://www.ubs.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.
	
E-mails are not encrypted and cannot be guaranteed to be secure or 
error-free as information could be intercepted, corrupted, lost, 
destroyed, arrive late or incomplete, or contain viruses.  The sender 
therefore does not accept liability for any errors or omissions in the 
contents of this message which arise as a result of e-mail transmission.  
If verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities 
or related financial instruments.

 
UBS reserves the right to retain all messages. Messages are protected
and accessed only in legally justified cases.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org

Re: How to encrypt user password in connection url

[Robbie Gemmell <ro...@gmail.com>]

Hi David,

The authentication system is pluggable (in the below case, using the class
element to specify a specific PrincipalDatabase implementation) and I
recall a discussion on here with someone from WSO2 a couple of years ago
about integrating with their existing authentication pieces, so this would
seem to relate to that. You would have to consult them for any more
information.

Its probably worth me mentioning that the configuration below looks to be
like that of a significantly older version of Qpid's Java code base, which
would suggest the broker you are using wont support SSL Client Certificate
Authentication (needs the 0.20 Java broker) and so you can likely disregard
the information mentioned on that topic.

Robbie

On 11 December 2012 18:13, <Da...@ubs.com> wrote:

> Hi, Robbie,
>
> Thanks for the info.
>
> About authenticator, I have noticed that there are the following
> configurations in our qpid config.xml.
>
>     <security>
>         <principal-databases>
>             <principal-database>
>                 <name>carbon-user-store</name>
>
> <class>org.wso2.carbon.qpid.authentication.qpid.CarbonBasedPrincipalData
> base</class>
>             </principal-database>
>         </principal-databases>
>
>         <msg-auth>false</msg-auth>
>
>         <jmx>
>             <access>${conf}/qpid-jmxremote.access</access>
>             <principal-database>carbon-user-store</principal-database>
>         </jmx>
>     </security>
>
> Well, the truth is that we use wso2, which is based on Synapse. Based on
> the configuration, it seems that the qpid authentication is based on
> wso2 user data base?
>
> Thanks,
> David
>
> -----Original Message-----
> From: Robbie Gemmell [mailto:robbie.gemmell@gmail.com]
> Sent: Tuesday, December 11, 2012 7:07 AM
> To: users@qpid.apache.org
> Subject: Re: How to encrypt user password in connection url
>
> Hi David,
>
> I beleive what Phil and Rajith were commenting on was the use of the SSL
> certificates as opposed to the password in the connection URL, that is
> to use Client Certificate Authentication such that the broker only
> allows the connection if it trusts the clients certificate. This could
> be instead of any password verification from the client being required,
> or in addition to it, depending on the particular authentication
> provider that was configured.
>
> I would note that in order to do that with the Java broker you would
> need to use the 0.20 release, which is currently at RC2 (available at
> http://people.apache.org/~jross/qpid-0.20-rc2/) and expected to proceed
> to initial release vote based on RC3 next week.
>
> You can find a pre-release (but not currently expected to change) copy
> of the 0.20 documentation for the Java broker on the subjects of SSL
> [client auth] and AuthenticationProviders at:
> http://qpid.apache.org/books/0.20/AMQP-Messaging-Broker-Java-Book/html/J
> ava-Broker-Security-SSL.html
> http://qpid.apache.org/books/0.20/AMQP-Messaging-Broker-Java-Book/html/J
> ava-Broker-Security-Authentication-Providers.html
>
> I'm not familiar with Synapse so I dont know if this is an option with
> it as it stands, but its worth noting that you dont strictly have to
> supply usernames and passwords in the actual URL. It is possible to
> specify credentials at runtime when using a JMS ConnectionFactory (as
> per
> http://docs.oracle.com/javaee/6/api/javax/jms/ConnectionFactory.html#cre
> ateConnection(java.lang.String,%20java.lang.String),
> such that those are used instead of any that were/were not specified in
> the base JNDI config. In that case, the URL you put in the file could
> just have placholders or empty strings for the user and password, with
> the real credentials to be supplied at runtime, sourced via whatever
> mechanism you like. Again however, I'm not sure of the options available
> for specifying the credentials when using Synapse.
>
> As mentioned on the other thread, a completely different suggestion
> might be to investigate encryption at the file/filesystem level.
>
> Robbie
>
>
> On 10 December 2012 22:09, <Da...@ubs.com> wrote:
>
> > Hi, Rajith,
> >
> > I know qpid supports ssl but in terms of the password in connection
> > url below, how? This is tied up with Synapse, which read the url,
> > parse out user name and password and tries to sign up with Synapse
> > server. Maybe you are talking about checking if Synapse supports SSL
> > authentication & Kerberos?
> >
> > connectionfactory.QueueConnectionFactory =
> > amqp://user:password@clientID/test?brokerlist=..&ssl="true"&.
> >
> > David
> >
> > -----Original Message-----
> > From: Rajith Attapattu [mailto:rajith77@gmail.com]
> > Sent: Monday, December 10, 2012 4:25 PM
> > To: users@qpid.apache.org
> > Subject: Re: How to encrypt user password in connection url
> >
> > David,
> >
> > If you have security concerns, I think rather than trying to write a
> > custom JMS listener, it would probably be worthwhile looking at using
> > a more secure mechanism like SSL certificates or Kerberos.
> >
> > Rajith
> >
> > On Mon, Dec 10, 2012 at 3:25 PM,  <Da...@ubs.com> wrote:
> > > Hi, Phil,
> > >
> > > Got it. It seems that we need to write our own JMS listener,
> > > extending
> >
> > > from the default one, org.apache.axis2.transport.jms.JMSListener .
> > >
> > > Thanks for the help.
> > > David
> > >
> > > -----Original Message-----
> > > From: philharveyonline@googlemail.com
> > > [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> > > Sent: Sunday, December 09, 2012 12:57 AM
> > > To: users@qpid.apache.org
> > > Subject: RE: How to encrypt user password in connection url
> > >
> > > Hi David,
> > >
> > > I was actually thinking containers such as WebSphere which allow
> > > JNDI objects to be securely stored by an administrator. Sounds like
> > > that might not be useful in your case though.
> > >
> > > I don't know the best way of securely storing the connection URL in
> > > Synapse. Writing a custom JMSListener may be an option. You could
> > > try asking for advice on the Synapse mailing list.
> > >
> > > Finally, note that Qpid does support client SSL authentication. This
>
> > > may provide the level of security that you need. If you think this
> > > might be useful we can help you set it up.
> > >
> > > Incidentally, which version of the Qpid client and broker are you
> > using?
> > >
> > > Phil
> > > On Dec 8, 2012 4:47 PM, <Da...@ubs.com> wrote:
> > >
> > >> Hi, Phil,
> > >>
> > >> Thanks for the info.
> > >>
> > >> We are trying to embed qpid in Synapse where qpid connection
> > >> information is stored in a property file in the format like -
> > >>
> > >> connectionfactory.QueueConnectionFactory =
> > >> amqp://user:password@clientID/test?brokerlist=...
> > >>
> > >> So what you mean is that we need to create customized listener to
> > >> read
> > >
> > >> the property file and decrypt the password where the password can
> > >> be encrypted?
> > >>
> > >> It seems out of the box in Synapse, it uses
> > >> org.apache.axis2.transport.jms.JMSListener and there is no such an
> > >> option.
> > >>
> > >> Thanks,
> > >> David
> > >>
> > >>
> > >>
> > >> -----Original Message-----
> > >> From: philharveyonline@googlemail.com
> > >> [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> > >> Sent: Saturday, December 08, 2012 2:11 AM
> > >> To: users@qpid.apache.org
> > >> Subject: Re: How to encrypt user password in connection url
> > >>
> > >> Hi David,
> > >>
> > >> I assume you're talking about encrypting the stored URL string, and
>
> > >> not about encrypting the details sent over the wire to the broker.
>
> > >> I
> >
> > >> think the only way to do this is to store it in a secure JNDI
> > >> context,
> > > e.g.
> > >> one provided by a Java application server.  This is in line with
> > >> the approach commonly taken for making JDBC connections from JEE
> apps.
> > >>
> > >> Phil
> > >>
> > >>
> > >> On 8 December 2012 00:27, <Da...@ubs.com> wrote:
> > >>
> > >> > **
> > >> > Hi, Guys,
> > >> >
> > >> > Is there a way to encrypt password in the connection URL below?
> > >> >
> > >> > amqp://[<user>:<pass>@][<clientid>]<virtualhost>[..]
> > >> >
> > >> > David
> > >> >
> > >> > Visit our website at http://www.ubs.com
> > >> >
> > >> > This message contains confidential information and is intended
> > >> > only
> >
> > >> > for the individual named.  If you are not the named addressee you
>
> > >> > should not disseminate, distribute or copy this e-mail.  Please
> > >> > notify
> > >>
> > >> > the sender immediately by e-mail if you have received this e-mail
>
> > >> > by
> > >
> > >> > mistake and delete this e-mail from your system.
> > >> >
> > >> > E-mails are not encrypted and cannot be guaranteed to be secure
> > >> > or error-free as information could be intercepted, corrupted,
> > >> > lost, destroyed, arrive late or incomplete, or contain viruses.
> > >> > The sender therefore does not accept liability for any errors or
> > >> > omissions in the
> > >>
> > >> > contents of this message which arise as a result of e-mail
> > >> transmission.
> > >> > If verification is required please request a hard-copy version.
> > >> > This message is provided for informational purposes and should
> > >> > not be construed as a solicitation or offer to buy or sell any
> > >> > securities or related financial instruments.
> > >> >
> > >> >
> > >> > UBS reserves the right to retain all messages. Messages are
> > >> > protected and accessed only in legally justified cases.
> > >> >
> > >> >
> > >> > -----------------------------------------------------------------
> > >> > --
> > >> > -
> > >> > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> > >> > additional commands, e-mail: users-help@qpid.apache.org
> > >> >
> > >> Visit our website at http://www.ubs.com
> > >>
> > >> This message contains confidential information and is intended only
>
> > >> for the individual named.  If you are not the named addressee you
> > >> should not disseminate, distribute or copy this e-mail.  Please
> > >> notify
> > >
> > >> the sender immediately by e-mail if you have received this e-mail
> > >> by mistake and delete this e-mail from your system.
> > >>
> > >> E-mails are not encrypted and cannot be guaranteed to be secure or
> > >> error-free as information could be intercepted, corrupted, lost,
> > >> destroyed, arrive late or incomplete, or contain viruses.  The
> > >> sender
> >
> > >> therefore does not accept liability for any errors or omissions in
> > >> the
> > >
> > >> contents of this message which arise as a result of e-mail
> > > transmission.
> > >> If verification is required please request a hard-copy version.
> > >> This
> >
> > >> message is provided for informational purposes and should not be
> > >> construed as a solicitation or offer to buy or sell any securities
> > >> or
> >
> > >> related financial instruments.
> > >>
> > >>
> > >> UBS reserves the right to retain all messages. Messages are
> > >> protected
> >
> > >> and accessed only in legally justified cases.
> > >>
> > >> -------------------------------------------------------------------
> > >> -- To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> > >> additional commands, e-mail: users-help@qpid.apache.org
> > >>
> > >>
> > > Visit our website at http://www.ubs.com
> > >
> > > This message contains confidential information and is intended only
> > > for the individual named.  If you are not the named addressee you
> > > should not disseminate, distribute or copy this e-mail.  Please
> > > notify
> >
> > > the sender immediately by e-mail if you have received this e-mail by
>
> > > mistake and delete this e-mail from your system.
> > >
> > > E-mails are not encrypted and cannot be guaranteed to be secure or
> > > error-free as information could be intercepted, corrupted, lost,
> > > destroyed, arrive late or incomplete, or contain viruses.  The
> > > sender therefore does not accept liability for any errors or
> > > omissions in the
> >
> > > contents of this message which arise as a result of e-mail
> > transmission.
> > > If verification is required please request a hard-copy version.
> > > This message is provided for informational purposes and should not
> > > be construed as a solicitation or offer to buy or sell any
> > > securities or related financial instruments.
> > >
> > >
> > > UBS reserves the right to retain all messages. Messages are
> > > protected and accessed only in legally justified cases.
> > >
> > > --------------------------------------------------------------------
> > > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> > > additional commands, e-mail: users-help@qpid.apache.org
> > >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> > additional commands, e-mail: users-help@qpid.apache.org
> >
> > Visit our website at http://www.ubs.com
> >
> > This message contains confidential information and is intended only
> > for the individual named.  If you are not the named addressee you
> > should not disseminate, distribute or copy this e-mail.  Please notify
>
> > the sender immediately by e-mail if you have received this e-mail by
> > mistake and delete this e-mail from your system.
> >
> > E-mails are not encrypted and cannot be guaranteed to be secure or
> > error-free as information could be intercepted, corrupted, lost,
> > destroyed, arrive late or incomplete, or contain viruses.  The sender
> > therefore does not accept liability for any errors or omissions in the
>
> > contents of this message which arise as a result of e-mail
> transmission.
> > If verification is required please request a hard-copy version.  This
> > message is provided for informational purposes and should not be
> > construed as a solicitation or offer to buy or sell any securities or
> > related financial instruments.
> >
> >
> > UBS reserves the right to retain all messages. Messages are protected
> > and accessed only in legally justified cases.
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> > additional commands, e-mail: users-help@qpid.apache.org
> >
> >
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only
> for the individual named.  If you are not the named addressee you
> should not disseminate, distribute or copy this e-mail.  Please
> notify the sender immediately by e-mail if you have received this
> e-mail by mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or
> error-free as information could be intercepted, corrupted, lost,
> destroyed, arrive late or incomplete, or contain viruses.  The sender
> therefore does not accept liability for any errors or omissions in the
> contents of this message which arise as a result of e-mail transmission.
> If verification is required please request a hard-copy version.  This
> message is provided for informational purposes and should not be
> construed as a solicitation or offer to buy or sell any securities
> or related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected
> and accessed only in legally justified cases.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>
>

RE: How to encrypt user password in connection url

[Da...@ubs.com]

Hi, Robbie, 

Thanks for the info. 

About authenticator, I have noticed that there are the following
configurations in our qpid config.xml. 

    <security>
        <principal-databases>
            <principal-database>
                <name>carbon-user-store</name>
 
<class>org.wso2.carbon.qpid.authentication.qpid.CarbonBasedPrincipalData
base</class>
            </principal-database>
        </principal-databases>

        <msg-auth>false</msg-auth>

        <jmx>
            <access>${conf}/qpid-jmxremote.access</access>
            <principal-database>carbon-user-store</principal-database>
        </jmx>
    </security>

Well, the truth is that we use wso2, which is based on Synapse. Based on
the configuration, it seems that the qpid authentication is based on
wso2 user data base? 

Thanks, 
David 

-----Original Message-----
From: Robbie Gemmell [mailto:robbie.gemmell@gmail.com] 
Sent: Tuesday, December 11, 2012 7:07 AM
To: users@qpid.apache.org
Subject: Re: How to encrypt user password in connection url

Hi David,

I beleive what Phil and Rajith were commenting on was the use of the SSL
certificates as opposed to the password in the connection URL, that is
to use Client Certificate Authentication such that the broker only
allows the connection if it trusts the clients certificate. This could
be instead of any password verification from the client being required,
or in addition to it, depending on the particular authentication
provider that was configured.

I would note that in order to do that with the Java broker you would
need to use the 0.20 release, which is currently at RC2 (available at
http://people.apache.org/~jross/qpid-0.20-rc2/) and expected to proceed
to initial release vote based on RC3 next week.

You can find a pre-release (but not currently expected to change) copy
of the 0.20 documentation for the Java broker on the subjects of SSL
[client auth] and AuthenticationProviders at:
http://qpid.apache.org/books/0.20/AMQP-Messaging-Broker-Java-Book/html/J
ava-Broker-Security-SSL.html
http://qpid.apache.org/books/0.20/AMQP-Messaging-Broker-Java-Book/html/J
ava-Broker-Security-Authentication-Providers.html

I'm not familiar with Synapse so I dont know if this is an option with
it as it stands, but its worth noting that you dont strictly have to
supply usernames and passwords in the actual URL. It is possible to
specify credentials at runtime when using a JMS ConnectionFactory (as
per
http://docs.oracle.com/javaee/6/api/javax/jms/ConnectionFactory.html#cre
ateConnection(java.lang.String,%20java.lang.String),
such that those are used instead of any that were/were not specified in
the base JNDI config. In that case, the URL you put in the file could
just have placholders or empty strings for the user and password, with
the real credentials to be supplied at runtime, sourced via whatever
mechanism you like. Again however, I'm not sure of the options available
for specifying the credentials when using Synapse.

As mentioned on the other thread, a completely different suggestion
might be to investigate encryption at the file/filesystem level.

Robbie


On 10 December 2012 22:09, <Da...@ubs.com> wrote:

> Hi, Rajith,
>
> I know qpid supports ssl but in terms of the password in connection 
> url below, how? This is tied up with Synapse, which read the url, 
> parse out user name and password and tries to sign up with Synapse 
> server. Maybe you are talking about checking if Synapse supports SSL 
> authentication & Kerberos?
>
> connectionfactory.QueueConnectionFactory = 
> amqp://user:password@clientID/test?brokerlist=..&ssl="true"&.
>
> David
>
> -----Original Message-----
> From: Rajith Attapattu [mailto:rajith77@gmail.com]
> Sent: Monday, December 10, 2012 4:25 PM
> To: users@qpid.apache.org
> Subject: Re: How to encrypt user password in connection url
>
> David,
>
> If you have security concerns, I think rather than trying to write a 
> custom JMS listener, it would probably be worthwhile looking at using 
> a more secure mechanism like SSL certificates or Kerberos.
>
> Rajith
>
> On Mon, Dec 10, 2012 at 3:25 PM,  <Da...@ubs.com> wrote:
> > Hi, Phil,
> >
> > Got it. It seems that we need to write our own JMS listener, 
> > extending
>
> > from the default one, org.apache.axis2.transport.jms.JMSListener .
> >
> > Thanks for the help.
> > David
> >
> > -----Original Message-----
> > From: philharveyonline@googlemail.com 
> > [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> > Sent: Sunday, December 09, 2012 12:57 AM
> > To: users@qpid.apache.org
> > Subject: RE: How to encrypt user password in connection url
> >
> > Hi David,
> >
> > I was actually thinking containers such as WebSphere which allow 
> > JNDI objects to be securely stored by an administrator. Sounds like 
> > that might not be useful in your case though.
> >
> > I don't know the best way of securely storing the connection URL in 
> > Synapse. Writing a custom JMSListener may be an option. You could 
> > try asking for advice on the Synapse mailing list.
> >
> > Finally, note that Qpid does support client SSL authentication. This

> > may provide the level of security that you need. If you think this 
> > might be useful we can help you set it up.
> >
> > Incidentally, which version of the Qpid client and broker are you
> using?
> >
> > Phil
> > On Dec 8, 2012 4:47 PM, <Da...@ubs.com> wrote:
> >
> >> Hi, Phil,
> >>
> >> Thanks for the info.
> >>
> >> We are trying to embed qpid in Synapse where qpid connection 
> >> information is stored in a property file in the format like -
> >>
> >> connectionfactory.QueueConnectionFactory = 
> >> amqp://user:password@clientID/test?brokerlist=...
> >>
> >> So what you mean is that we need to create customized listener to 
> >> read
> >
> >> the property file and decrypt the password where the password can 
> >> be encrypted?
> >>
> >> It seems out of the box in Synapse, it uses 
> >> org.apache.axis2.transport.jms.JMSListener and there is no such an 
> >> option.
> >>
> >> Thanks,
> >> David
> >>
> >>
> >>
> >> -----Original Message-----
> >> From: philharveyonline@googlemail.com 
> >> [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> >> Sent: Saturday, December 08, 2012 2:11 AM
> >> To: users@qpid.apache.org
> >> Subject: Re: How to encrypt user password in connection url
> >>
> >> Hi David,
> >>
> >> I assume you're talking about encrypting the stored URL string, and

> >> not about encrypting the details sent over the wire to the broker.

> >> I
>
> >> think the only way to do this is to store it in a secure JNDI 
> >> context,
> > e.g.
> >> one provided by a Java application server.  This is in line with 
> >> the approach commonly taken for making JDBC connections from JEE
apps.
> >>
> >> Phil
> >>
> >>
> >> On 8 December 2012 00:27, <Da...@ubs.com> wrote:
> >>
> >> > **
> >> > Hi, Guys,
> >> >
> >> > Is there a way to encrypt password in the connection URL below?
> >> >
> >> > amqp://[<user>:<pass>@][<clientid>]<virtualhost>[..]
> >> >
> >> > David
> >> >
> >> > Visit our website at http://www.ubs.com
> >> >
> >> > This message contains confidential information and is intended 
> >> > only
>
> >> > for the individual named.  If you are not the named addressee you

> >> > should not disseminate, distribute or copy this e-mail.  Please 
> >> > notify
> >>
> >> > the sender immediately by e-mail if you have received this e-mail

> >> > by
> >
> >> > mistake and delete this e-mail from your system.
> >> >
> >> > E-mails are not encrypted and cannot be guaranteed to be secure 
> >> > or error-free as information could be intercepted, corrupted, 
> >> > lost, destroyed, arrive late or incomplete, or contain viruses.  
> >> > The sender therefore does not accept liability for any errors or 
> >> > omissions in the
> >>
> >> > contents of this message which arise as a result of e-mail
> >> transmission.
> >> > If verification is required please request a hard-copy version.
> >> > This message is provided for informational purposes and should 
> >> > not be construed as a solicitation or offer to buy or sell any 
> >> > securities or related financial instruments.
> >> >
> >> >
> >> > UBS reserves the right to retain all messages. Messages are 
> >> > protected and accessed only in legally justified cases.
> >> >
> >> >
> >> > -----------------------------------------------------------------
> >> > --
> >> > -
> >> > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> >> > additional commands, e-mail: users-help@qpid.apache.org
> >> >
> >> Visit our website at http://www.ubs.com
> >>
> >> This message contains confidential information and is intended only

> >> for the individual named.  If you are not the named addressee you 
> >> should not disseminate, distribute or copy this e-mail.  Please 
> >> notify
> >
> >> the sender immediately by e-mail if you have received this e-mail 
> >> by mistake and delete this e-mail from your system.
> >>
> >> E-mails are not encrypted and cannot be guaranteed to be secure or 
> >> error-free as information could be intercepted, corrupted, lost, 
> >> destroyed, arrive late or incomplete, or contain viruses.  The 
> >> sender
>
> >> therefore does not accept liability for any errors or omissions in 
> >> the
> >
> >> contents of this message which arise as a result of e-mail
> > transmission.
> >> If verification is required please request a hard-copy version.  
> >> This
>
> >> message is provided for informational purposes and should not be 
> >> construed as a solicitation or offer to buy or sell any securities 
> >> or
>
> >> related financial instruments.
> >>
> >>
> >> UBS reserves the right to retain all messages. Messages are 
> >> protected
>
> >> and accessed only in legally justified cases.
> >>
> >> -------------------------------------------------------------------
> >> -- To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> >> additional commands, e-mail: users-help@qpid.apache.org
> >>
> >>
> > Visit our website at http://www.ubs.com
> >
> > This message contains confidential information and is intended only 
> > for the individual named.  If you are not the named addressee you 
> > should not disseminate, distribute or copy this e-mail.  Please 
> > notify
>
> > the sender immediately by e-mail if you have received this e-mail by

> > mistake and delete this e-mail from your system.
> >
> > E-mails are not encrypted and cannot be guaranteed to be secure or 
> > error-free as information could be intercepted, corrupted, lost, 
> > destroyed, arrive late or incomplete, or contain viruses.  The 
> > sender therefore does not accept liability for any errors or 
> > omissions in the
>
> > contents of this message which arise as a result of e-mail
> transmission.
> > If verification is required please request a hard-copy version.  
> > This message is provided for informational purposes and should not 
> > be construed as a solicitation or offer to buy or sell any 
> > securities or related financial instruments.
> >
> >
> > UBS reserves the right to retain all messages. Messages are 
> > protected and accessed only in legally justified cases.
> >
> > --------------------------------------------------------------------
> > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> > additional commands, e-mail: users-help@qpid.apache.org
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> additional commands, e-mail: users-help@qpid.apache.org
>
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only 
> for the individual named.  If you are not the named addressee you 
> should not disseminate, distribute or copy this e-mail.  Please notify

> the sender immediately by e-mail if you have received this e-mail by 
> mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or 
> error-free as information could be intercepted, corrupted, lost, 
> destroyed, arrive late or incomplete, or contain viruses.  The sender 
> therefore does not accept liability for any errors or omissions in the

> contents of this message which arise as a result of e-mail
transmission.
> If verification is required please request a hard-copy version.  This 
> message is provided for informational purposes and should not be 
> construed as a solicitation or offer to buy or sell any securities or 
> related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected 
> and accessed only in legally justified cases.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> additional commands, e-mail: users-help@qpid.apache.org
>
>
Visit our website at http://www.ubs.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.
	
E-mails are not encrypted and cannot be guaranteed to be secure or 
error-free as information could be intercepted, corrupted, lost, 
destroyed, arrive late or incomplete, or contain viruses.  The sender 
therefore does not accept liability for any errors or omissions in the 
contents of this message which arise as a result of e-mail transmission.  
If verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities 
or related financial instruments.

 
UBS reserves the right to retain all messages. Messages are protected
and accessed only in legally justified cases.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org

Re: How to encrypt user password in connection url

[Robbie Gemmell <ro...@gmail.com>]

Hi David,

I beleive what Phil and Rajith were commenting on was the use of the SSL
certificates as opposed to the password in the connection URL, that is to
use Client Certificate Authentication such that the broker only allows the
connection if it trusts the clients certificate. This could be instead of
any password verification from the client being required, or in addition to
it, depending on the particular authentication provider that was
configured.

I would note that in order to do that with the Java broker you would need
to use the 0.20 release, which is currently at RC2 (available at
http://people.apache.org/~jross/qpid-0.20-rc2/) and expected to proceed to
initial release vote based on RC3 next week.

You can find a pre-release (but not currently expected to change) copy of
the 0.20 documentation for the Java broker on the subjects of SSL [client
auth] and AuthenticationProviders at:
http://qpid.apache.org/books/0.20/AMQP-Messaging-Broker-Java-Book/html/Java-Broker-Security-SSL.html
http://qpid.apache.org/books/0.20/AMQP-Messaging-Broker-Java-Book/html/Java-Broker-Security-Authentication-Providers.html

I'm not familiar with Synapse so I dont know if this is an option with it
as it stands, but its worth noting that you dont strictly have to supply
usernames and passwords in the actual URL. It is possible to specify
credentials at runtime when using a JMS ConnectionFactory (as per
http://docs.oracle.com/javaee/6/api/javax/jms/ConnectionFactory.html#createConnection(java.lang.String,%20java.lang.String),
such that those are used instead of any that were/were not specified in the
base JNDI config. In that case, the URL you put in the file could just have
placholders or empty strings for the user and password, with the real
credentials to be supplied at runtime, sourced via whatever mechanism you
like. Again however, I'm not sure of the options available for specifying
the credentials when using Synapse.

As mentioned on the other thread, a completely different suggestion might
be to investigate encryption at the file/filesystem level.

Robbie


On 10 December 2012 22:09, <Da...@ubs.com> wrote:

> Hi, Rajith,
>
> I know qpid supports ssl but in terms of the password in connection url
> below, how? This is tied up with Synapse, which read the url, parse out
> user name and password and tries to sign up with Synapse server. Maybe
> you are talking about checking if Synapse supports SSL authentication &
> Kerberos?
>
> connectionfactory.QueueConnectionFactory =
> amqp://user:password@clientID/test?brokerlist=..&ssl="true"&.
>
> David
>
> -----Original Message-----
> From: Rajith Attapattu [mailto:rajith77@gmail.com]
> Sent: Monday, December 10, 2012 4:25 PM
> To: users@qpid.apache.org
> Subject: Re: How to encrypt user password in connection url
>
> David,
>
> If you have security concerns, I think rather than trying to write a
> custom JMS listener, it would probably be worthwhile looking at using a
> more secure mechanism like SSL certificates or Kerberos.
>
> Rajith
>
> On Mon, Dec 10, 2012 at 3:25 PM,  <Da...@ubs.com> wrote:
> > Hi, Phil,
> >
> > Got it. It seems that we need to write our own JMS listener, extending
>
> > from the default one, org.apache.axis2.transport.jms.JMSListener .
> >
> > Thanks for the help.
> > David
> >
> > -----Original Message-----
> > From: philharveyonline@googlemail.com
> > [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> > Sent: Sunday, December 09, 2012 12:57 AM
> > To: users@qpid.apache.org
> > Subject: RE: How to encrypt user password in connection url
> >
> > Hi David,
> >
> > I was actually thinking containers such as WebSphere which allow JNDI
> > objects to be securely stored by an administrator. Sounds like that
> > might not be useful in your case though.
> >
> > I don't know the best way of securely storing the connection URL in
> > Synapse. Writing a custom JMSListener may be an option. You could try
> > asking for advice on the Synapse mailing list.
> >
> > Finally, note that Qpid does support client SSL authentication. This
> > may provide the level of security that you need. If you think this
> > might be useful we can help you set it up.
> >
> > Incidentally, which version of the Qpid client and broker are you
> using?
> >
> > Phil
> > On Dec 8, 2012 4:47 PM, <Da...@ubs.com> wrote:
> >
> >> Hi, Phil,
> >>
> >> Thanks for the info.
> >>
> >> We are trying to embed qpid in Synapse where qpid connection
> >> information is stored in a property file in the format like -
> >>
> >> connectionfactory.QueueConnectionFactory =
> >> amqp://user:password@clientID/test?brokerlist=...
> >>
> >> So what you mean is that we need to create customized listener to
> >> read
> >
> >> the property file and decrypt the password where the password can be
> >> encrypted?
> >>
> >> It seems out of the box in Synapse, it uses
> >> org.apache.axis2.transport.jms.JMSListener and there is no such an
> >> option.
> >>
> >> Thanks,
> >> David
> >>
> >>
> >>
> >> -----Original Message-----
> >> From: philharveyonline@googlemail.com
> >> [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> >> Sent: Saturday, December 08, 2012 2:11 AM
> >> To: users@qpid.apache.org
> >> Subject: Re: How to encrypt user password in connection url
> >>
> >> Hi David,
> >>
> >> I assume you're talking about encrypting the stored URL string, and
> >> not about encrypting the details sent over the wire to the broker.  I
>
> >> think the only way to do this is to store it in a secure JNDI
> >> context,
> > e.g.
> >> one provided by a Java application server.  This is in line with the
> >> approach commonly taken for making JDBC connections from JEE apps.
> >>
> >> Phil
> >>
> >>
> >> On 8 December 2012 00:27, <Da...@ubs.com> wrote:
> >>
> >> > **
> >> > Hi, Guys,
> >> >
> >> > Is there a way to encrypt password in the connection URL below?
> >> >
> >> > amqp://[<user>:<pass>@][<clientid>]<virtualhost>[..]
> >> >
> >> > David
> >> >
> >> > Visit our website at http://www.ubs.com
> >> >
> >> > This message contains confidential information and is intended only
>
> >> > for the individual named.  If you are not the named addressee you
> >> > should not disseminate, distribute or copy this e-mail.  Please
> >> > notify
> >>
> >> > the sender immediately by e-mail if you have received this e-mail
> >> > by
> >
> >> > mistake and delete this e-mail from your system.
> >> >
> >> > E-mails are not encrypted and cannot be guaranteed to be secure or
> >> > error-free as information could be intercepted, corrupted, lost,
> >> > destroyed, arrive late or incomplete, or contain viruses.  The
> >> > sender therefore does not accept liability for any errors or
> >> > omissions in the
> >>
> >> > contents of this message which arise as a result of e-mail
> >> transmission.
> >> > If verification is required please request a hard-copy version.
> >> > This message is provided for informational purposes and should not
> >> > be construed as a solicitation or offer to buy or sell any
> >> > securities or related financial instruments.
> >> >
> >> >
> >> > UBS reserves the right to retain all messages. Messages are
> >> > protected and accessed only in legally justified cases.
> >> >
> >> >
> >> > -------------------------------------------------------------------
> >> > -
> >> > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> >> > additional commands, e-mail: users-help@qpid.apache.org
> >> >
> >> Visit our website at http://www.ubs.com
> >>
> >> This message contains confidential information and is intended only
> >> for the individual named.  If you are not the named addressee you
> >> should not disseminate, distribute or copy this e-mail.  Please
> >> notify
> >
> >> the sender immediately by e-mail if you have received this e-mail by
> >> mistake and delete this e-mail from your system.
> >>
> >> E-mails are not encrypted and cannot be guaranteed to be secure or
> >> error-free as information could be intercepted, corrupted, lost,
> >> destroyed, arrive late or incomplete, or contain viruses.  The sender
>
> >> therefore does not accept liability for any errors or omissions in
> >> the
> >
> >> contents of this message which arise as a result of e-mail
> > transmission.
> >> If verification is required please request a hard-copy version.  This
>
> >> message is provided for informational purposes and should not be
> >> construed as a solicitation or offer to buy or sell any securities or
>
> >> related financial instruments.
> >>
> >>
> >> UBS reserves the right to retain all messages. Messages are protected
>
> >> and accessed only in legally justified cases.
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> >> additional commands, e-mail: users-help@qpid.apache.org
> >>
> >>
> > Visit our website at http://www.ubs.com
> >
> > This message contains confidential information and is intended only
> > for the individual named.  If you are not the named addressee you
> > should not disseminate, distribute or copy this e-mail.  Please notify
>
> > the sender immediately by e-mail if you have received this e-mail by
> > mistake and delete this e-mail from your system.
> >
> > E-mails are not encrypted and cannot be guaranteed to be secure or
> > error-free as information could be intercepted, corrupted, lost,
> > destroyed, arrive late or incomplete, or contain viruses.  The sender
> > therefore does not accept liability for any errors or omissions in the
>
> > contents of this message which arise as a result of e-mail
> transmission.
> > If verification is required please request a hard-copy version.  This
> > message is provided for informational purposes and should not be
> > construed as a solicitation or offer to buy or sell any securities or
> > related financial instruments.
> >
> >
> > UBS reserves the right to retain all messages. Messages are protected
> > and accessed only in legally justified cases.
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> > additional commands, e-mail: users-help@qpid.apache.org
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For additional
> commands, e-mail: users-help@qpid.apache.org
>
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only
> for the individual named.  If you are not the named addressee you
> should not disseminate, distribute or copy this e-mail.  Please
> notify the sender immediately by e-mail if you have received this
> e-mail by mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or
> error-free as information could be intercepted, corrupted, lost,
> destroyed, arrive late or incomplete, or contain viruses.  The sender
> therefore does not accept liability for any errors or omissions in the
> contents of this message which arise as a result of e-mail transmission.
> If verification is required please request a hard-copy version.  This
> message is provided for informational purposes and should not be
> construed as a solicitation or offer to buy or sell any securities
> or related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected
> and accessed only in legally justified cases.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>
>

Re: How to encrypt user password in connection url

[Phil Harvey <ph...@philharveyonline.com>]

David,

You'll need to set the keystore and truststore system properties in your
client application.  This obviates the need to put credentials in the URL.
Other than that, you should be able to use your Synapse-configured client
as-is.

To get a quick idea how to do this, take a look at our system test,
especially the testCreateSSLConnectionUsingSystemProperties method:

http://svn.apache.org/viewvc/qpid/trunk/qpid/java/systests/src/main/java/org/apache/qpid/client/ssl/SSLTest.java?revision=1413364&view=markup

Phil


On 10 December 2012 22:09, <Da...@ubs.com> wrote:

> Hi, Rajith,
>
> I know qpid supports ssl but in terms of the password in connection url
> below, how? This is tied up with Synapse, which read the url, parse out
> user name and password and tries to sign up with Synapse server. Maybe
> you are talking about checking if Synapse supports SSL authentication &
> Kerberos?
>
> connectionfactory.QueueConnectionFactory =
> amqp://user:password@clientID/test?brokerlist=..&ssl="true"&.
>
> David
>
> -----Original Message-----
> From: Rajith Attapattu [mailto:rajith77@gmail.com]
> Sent: Monday, December 10, 2012 4:25 PM
> To: users@qpid.apache.org
> Subject: Re: How to encrypt user password in connection url
>
> David,
>
> If you have security concerns, I think rather than trying to write a
> custom JMS listener, it would probably be worthwhile looking at using a
> more secure mechanism like SSL certificates or Kerberos.
>
> Rajith
>
> On Mon, Dec 10, 2012 at 3:25 PM,  <Da...@ubs.com> wrote:
> > Hi, Phil,
> >
> > Got it. It seems that we need to write our own JMS listener, extending
>
> > from the default one, org.apache.axis2.transport.jms.JMSListener .
> >
> > Thanks for the help.
> > David
> >
> > -----Original Message-----
> > From: philharveyonline@googlemail.com
> > [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> > Sent: Sunday, December 09, 2012 12:57 AM
> > To: users@qpid.apache.org
> > Subject: RE: How to encrypt user password in connection url
> >
> > Hi David,
> >
> > I was actually thinking containers such as WebSphere which allow JNDI
> > objects to be securely stored by an administrator. Sounds like that
> > might not be useful in your case though.
> >
> > I don't know the best way of securely storing the connection URL in
> > Synapse. Writing a custom JMSListener may be an option. You could try
> > asking for advice on the Synapse mailing list.
> >
> > Finally, note that Qpid does support client SSL authentication. This
> > may provide the level of security that you need. If you think this
> > might be useful we can help you set it up.
> >
> > Incidentally, which version of the Qpid client and broker are you
> using?
> >
> > Phil
> > On Dec 8, 2012 4:47 PM, <Da...@ubs.com> wrote:
> >
> >> Hi, Phil,
> >>
> >> Thanks for the info.
> >>
> >> We are trying to embed qpid in Synapse where qpid connection
> >> information is stored in a property file in the format like -
> >>
> >> connectionfactory.QueueConnectionFactory =
> >> amqp://user:password@clientID/test?brokerlist=...
> >>
> >> So what you mean is that we need to create customized listener to
> >> read
> >
> >> the property file and decrypt the password where the password can be
> >> encrypted?
> >>
> >> It seems out of the box in Synapse, it uses
> >> org.apache.axis2.transport.jms.JMSListener and there is no such an
> >> option.
> >>
> >> Thanks,
> >> David
> >>
> >>
> >>
> >> -----Original Message-----
> >> From: philharveyonline@googlemail.com
> >> [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> >> Sent: Saturday, December 08, 2012 2:11 AM
> >> To: users@qpid.apache.org
> >> Subject: Re: How to encrypt user password in connection url
> >>
> >> Hi David,
> >>
> >> I assume you're talking about encrypting the stored URL string, and
> >> not about encrypting the details sent over the wire to the broker.  I
>
> >> think the only way to do this is to store it in a secure JNDI
> >> context,
> > e.g.
> >> one provided by a Java application server.  This is in line with the
> >> approach commonly taken for making JDBC connections from JEE apps.
> >>
> >> Phil
> >>
> >>
> >> On 8 December 2012 00:27, <Da...@ubs.com> wrote:
> >>
> >> > **
> >> > Hi, Guys,
> >> >
> >> > Is there a way to encrypt password in the connection URL below?
> >> >
> >> > amqp://[<user>:<pass>@][<clientid>]<virtualhost>[..]
> >> >
> >> > David
> >> >
> >> > Visit our website at http://www.ubs.com
> >> >
> >> > This message contains confidential information and is intended only
>
> >> > for the individual named.  If you are not the named addressee you
> >> > should not disseminate, distribute or copy this e-mail.  Please
> >> > notify
> >>
> >> > the sender immediately by e-mail if you have received this e-mail
> >> > by
> >
> >> > mistake and delete this e-mail from your system.
> >> >
> >> > E-mails are not encrypted and cannot be guaranteed to be secure or
> >> > error-free as information could be intercepted, corrupted, lost,
> >> > destroyed, arrive late or incomplete, or contain viruses.  The
> >> > sender therefore does not accept liability for any errors or
> >> > omissions in the
> >>
> >> > contents of this message which arise as a result of e-mail
> >> transmission.
> >> > If verification is required please request a hard-copy version.
> >> > This message is provided for informational purposes and should not
> >> > be construed as a solicitation or offer to buy or sell any
> >> > securities or related financial instruments.
> >> >
> >> >
> >> > UBS reserves the right to retain all messages. Messages are
> >> > protected and accessed only in legally justified cases.
> >> >
> >> >
> >> > -------------------------------------------------------------------
> >> > -
> >> > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> >> > additional commands, e-mail: users-help@qpid.apache.org
> >> >
> >> Visit our website at http://www.ubs.com
> >>
> >> This message contains confidential information and is intended only
> >> for the individual named.  If you are not the named addressee you
> >> should not disseminate, distribute or copy this e-mail.  Please
> >> notify
> >
> >> the sender immediately by e-mail if you have received this e-mail by
> >> mistake and delete this e-mail from your system.
> >>
> >> E-mails are not encrypted and cannot be guaranteed to be secure or
> >> error-free as information could be intercepted, corrupted, lost,
> >> destroyed, arrive late or incomplete, or contain viruses.  The sender
>
> >> therefore does not accept liability for any errors or omissions in
> >> the
> >
> >> contents of this message which arise as a result of e-mail
> > transmission.
> >> If verification is required please request a hard-copy version.  This
>
> >> message is provided for informational purposes and should not be
> >> construed as a solicitation or offer to buy or sell any securities or
>
> >> related financial instruments.
> >>
> >>
> >> UBS reserves the right to retain all messages. Messages are protected
>
> >> and accessed only in legally justified cases.
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> >> additional commands, e-mail: users-help@qpid.apache.org
> >>
> >>
> > Visit our website at http://www.ubs.com
> >
> > This message contains confidential information and is intended only
> > for the individual named.  If you are not the named addressee you
> > should not disseminate, distribute or copy this e-mail.  Please notify
>
> > the sender immediately by e-mail if you have received this e-mail by
> > mistake and delete this e-mail from your system.
> >
> > E-mails are not encrypted and cannot be guaranteed to be secure or
> > error-free as information could be intercepted, corrupted, lost,
> > destroyed, arrive late or incomplete, or contain viruses.  The sender
> > therefore does not accept liability for any errors or omissions in the
>
> > contents of this message which arise as a result of e-mail
> transmission.
> > If verification is required please request a hard-copy version.  This
> > message is provided for informational purposes and should not be
> > construed as a solicitation or offer to buy or sell any securities or
> > related financial instruments.
> >
> >
> > UBS reserves the right to retain all messages. Messages are protected
> > and accessed only in legally justified cases.
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> > additional commands, e-mail: users-help@qpid.apache.org
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For additional
> commands, e-mail: users-help@qpid.apache.org
>
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only
> for the individual named.  If you are not the named addressee you
> should not disseminate, distribute or copy this e-mail.  Please
> notify the sender immediately by e-mail if you have received this
> e-mail by mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or
> error-free as information could be intercepted, corrupted, lost,
> destroyed, arrive late or incomplete, or contain viruses.  The sender
> therefore does not accept liability for any errors or omissions in the
> contents of this message which arise as a result of e-mail transmission.
> If verification is required please request a hard-copy version.  This
> message is provided for informational purposes and should not be
> construed as a solicitation or offer to buy or sell any securities
> or related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected
> and accessed only in legally justified cases.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>
>

RE: How to encrypt user password in connection url

[Da...@ubs.com]

Hi, Rajith, 

I know qpid supports ssl but in terms of the password in connection url
below, how? This is tied up with Synapse, which read the url, parse out
user name and password and tries to sign up with Synapse server. Maybe
you are talking about checking if Synapse supports SSL authentication &
Kerberos? 

connectionfactory.QueueConnectionFactory =
amqp://user:password@clientID/test?brokerlist=..&ssl="true"&.

David

-----Original Message-----
From: Rajith Attapattu [mailto:rajith77@gmail.com] 
Sent: Monday, December 10, 2012 4:25 PM
To: users@qpid.apache.org
Subject: Re: How to encrypt user password in connection url

David,

If you have security concerns, I think rather than trying to write a
custom JMS listener, it would probably be worthwhile looking at using a
more secure mechanism like SSL certificates or Kerberos.

Rajith

On Mon, Dec 10, 2012 at 3:25 PM,  <Da...@ubs.com> wrote:
> Hi, Phil,
>
> Got it. It seems that we need to write our own JMS listener, extending

> from the default one, org.apache.axis2.transport.jms.JMSListener .
>
> Thanks for the help.
> David
>
> -----Original Message-----
> From: philharveyonline@googlemail.com
> [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> Sent: Sunday, December 09, 2012 12:57 AM
> To: users@qpid.apache.org
> Subject: RE: How to encrypt user password in connection url
>
> Hi David,
>
> I was actually thinking containers such as WebSphere which allow JNDI 
> objects to be securely stored by an administrator. Sounds like that 
> might not be useful in your case though.
>
> I don't know the best way of securely storing the connection URL in 
> Synapse. Writing a custom JMSListener may be an option. You could try 
> asking for advice on the Synapse mailing list.
>
> Finally, note that Qpid does support client SSL authentication. This 
> may provide the level of security that you need. If you think this 
> might be useful we can help you set it up.
>
> Incidentally, which version of the Qpid client and broker are you
using?
>
> Phil
> On Dec 8, 2012 4:47 PM, <Da...@ubs.com> wrote:
>
>> Hi, Phil,
>>
>> Thanks for the info.
>>
>> We are trying to embed qpid in Synapse where qpid connection 
>> information is stored in a property file in the format like -
>>
>> connectionfactory.QueueConnectionFactory = 
>> amqp://user:password@clientID/test?brokerlist=...
>>
>> So what you mean is that we need to create customized listener to 
>> read
>
>> the property file and decrypt the password where the password can be 
>> encrypted?
>>
>> It seems out of the box in Synapse, it uses 
>> org.apache.axis2.transport.jms.JMSListener and there is no such an 
>> option.
>>
>> Thanks,
>> David
>>
>>
>>
>> -----Original Message-----
>> From: philharveyonline@googlemail.com 
>> [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
>> Sent: Saturday, December 08, 2012 2:11 AM
>> To: users@qpid.apache.org
>> Subject: Re: How to encrypt user password in connection url
>>
>> Hi David,
>>
>> I assume you're talking about encrypting the stored URL string, and 
>> not about encrypting the details sent over the wire to the broker.  I

>> think the only way to do this is to store it in a secure JNDI 
>> context,
> e.g.
>> one provided by a Java application server.  This is in line with the 
>> approach commonly taken for making JDBC connections from JEE apps.
>>
>> Phil
>>
>>
>> On 8 December 2012 00:27, <Da...@ubs.com> wrote:
>>
>> > **
>> > Hi, Guys,
>> >
>> > Is there a way to encrypt password in the connection URL below?
>> >
>> > amqp://[<user>:<pass>@][<clientid>]<virtualhost>[..]
>> >
>> > David
>> >
>> > Visit our website at http://www.ubs.com
>> >
>> > This message contains confidential information and is intended only

>> > for the individual named.  If you are not the named addressee you 
>> > should not disseminate, distribute or copy this e-mail.  Please 
>> > notify
>>
>> > the sender immediately by e-mail if you have received this e-mail 
>> > by
>
>> > mistake and delete this e-mail from your system.
>> >
>> > E-mails are not encrypted and cannot be guaranteed to be secure or 
>> > error-free as information could be intercepted, corrupted, lost, 
>> > destroyed, arrive late or incomplete, or contain viruses.  The 
>> > sender therefore does not accept liability for any errors or 
>> > omissions in the
>>
>> > contents of this message which arise as a result of e-mail
>> transmission.
>> > If verification is required please request a hard-copy version.
>> > This message is provided for informational purposes and should not 
>> > be construed as a solicitation or offer to buy or sell any 
>> > securities or related financial instruments.
>> >
>> >
>> > UBS reserves the right to retain all messages. Messages are 
>> > protected and accessed only in legally justified cases.
>> >
>> >
>> > -------------------------------------------------------------------
>> > -
>> > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
>> > additional commands, e-mail: users-help@qpid.apache.org
>> >
>> Visit our website at http://www.ubs.com
>>
>> This message contains confidential information and is intended only 
>> for the individual named.  If you are not the named addressee you 
>> should not disseminate, distribute or copy this e-mail.  Please 
>> notify
>
>> the sender immediately by e-mail if you have received this e-mail by 
>> mistake and delete this e-mail from your system.
>>
>> E-mails are not encrypted and cannot be guaranteed to be secure or 
>> error-free as information could be intercepted, corrupted, lost, 
>> destroyed, arrive late or incomplete, or contain viruses.  The sender

>> therefore does not accept liability for any errors or omissions in 
>> the
>
>> contents of this message which arise as a result of e-mail
> transmission.
>> If verification is required please request a hard-copy version.  This

>> message is provided for informational purposes and should not be 
>> construed as a solicitation or offer to buy or sell any securities or

>> related financial instruments.
>>
>>
>> UBS reserves the right to retain all messages. Messages are protected

>> and accessed only in legally justified cases.
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
>> additional commands, e-mail: users-help@qpid.apache.org
>>
>>
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only 
> for the individual named.  If you are not the named addressee you 
> should not disseminate, distribute or copy this e-mail.  Please notify

> the sender immediately by e-mail if you have received this e-mail by 
> mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or 
> error-free as information could be intercepted, corrupted, lost, 
> destroyed, arrive late or incomplete, or contain viruses.  The sender 
> therefore does not accept liability for any errors or omissions in the

> contents of this message which arise as a result of e-mail
transmission.
> If verification is required please request a hard-copy version.  This 
> message is provided for informational purposes and should not be 
> construed as a solicitation or offer to buy or sell any securities or 
> related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected 
> and accessed only in legally justified cases.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> additional commands, e-mail: users-help@qpid.apache.org
>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For additional
commands, e-mail: users-help@qpid.apache.org

Visit our website at http://www.ubs.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.
	
E-mails are not encrypted and cannot be guaranteed to be secure or 
error-free as information could be intercepted, corrupted, lost, 
destroyed, arrive late or incomplete, or contain viruses.  The sender 
therefore does not accept liability for any errors or omissions in the 
contents of this message which arise as a result of e-mail transmission.  
If verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities 
or related financial instruments.

 
UBS reserves the right to retain all messages. Messages are protected
and accessed only in legally justified cases.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org

Re: How to encrypt user password in connection url

[Rajith Attapattu <ra...@gmail.com>]

David,

If you have security concerns, I think rather than trying to write a
custom JMS listener, it would probably be worthwhile looking at using
a more secure mechanism like SSL certificates or Kerberos.

Rajith

On Mon, Dec 10, 2012 at 3:25 PM,  <Da...@ubs.com> wrote:
> Hi, Phil,
>
> Got it. It seems that we need to write our own JMS listener, extending
> from the default one, org.apache.axis2.transport.jms.JMSListener .
>
> Thanks for the help.
> David
>
> -----Original Message-----
> From: philharveyonline@googlemail.com
> [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> Sent: Sunday, December 09, 2012 12:57 AM
> To: users@qpid.apache.org
> Subject: RE: How to encrypt user password in connection url
>
> Hi David,
>
> I was actually thinking containers such as WebSphere which allow JNDI
> objects to be securely stored by an administrator. Sounds like that
> might not be useful in your case though.
>
> I don't know the best way of securely storing the connection URL in
> Synapse. Writing a custom JMSListener may be an option. You could try
> asking for advice on the Synapse mailing list.
>
> Finally, note that Qpid does support client SSL authentication. This may
> provide the level of security that you need. If you think this might be
> useful we can help you set it up.
>
> Incidentally, which version of the Qpid client and broker are you using?
>
> Phil
> On Dec 8, 2012 4:47 PM, <Da...@ubs.com> wrote:
>
>> Hi, Phil,
>>
>> Thanks for the info.
>>
>> We are trying to embed qpid in Synapse where qpid connection
>> information is stored in a property file in the format like -
>>
>> connectionfactory.QueueConnectionFactory =
>> amqp://user:password@clientID/test?brokerlist=...
>>
>> So what you mean is that we need to create customized listener to read
>
>> the property file and decrypt the password where the password can be
>> encrypted?
>>
>> It seems out of the box in Synapse, it uses
>> org.apache.axis2.transport.jms.JMSListener and there is no such an
>> option.
>>
>> Thanks,
>> David
>>
>>
>>
>> -----Original Message-----
>> From: philharveyonline@googlemail.com
>> [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
>> Sent: Saturday, December 08, 2012 2:11 AM
>> To: users@qpid.apache.org
>> Subject: Re: How to encrypt user password in connection url
>>
>> Hi David,
>>
>> I assume you're talking about encrypting the stored URL string, and
>> not about encrypting the details sent over the wire to the broker.  I
>> think the only way to do this is to store it in a secure JNDI context,
> e.g.
>> one provided by a Java application server.  This is in line with the
>> approach commonly taken for making JDBC connections from JEE apps.
>>
>> Phil
>>
>>
>> On 8 December 2012 00:27, <Da...@ubs.com> wrote:
>>
>> > **
>> > Hi, Guys,
>> >
>> > Is there a way to encrypt password in the connection URL below?
>> >
>> > amqp://[<user>:<pass>@][<clientid>]<virtualhost>[..]
>> >
>> > David
>> >
>> > Visit our website at http://www.ubs.com
>> >
>> > This message contains confidential information and is intended only
>> > for the individual named.  If you are not the named addressee you
>> > should not disseminate, distribute or copy this e-mail.  Please
>> > notify
>>
>> > the sender immediately by e-mail if you have received this e-mail by
>
>> > mistake and delete this e-mail from your system.
>> >
>> > E-mails are not encrypted and cannot be guaranteed to be secure or
>> > error-free as information could be intercepted, corrupted, lost,
>> > destroyed, arrive late or incomplete, or contain viruses.  The
>> > sender therefore does not accept liability for any errors or
>> > omissions in the
>>
>> > contents of this message which arise as a result of e-mail
>> transmission.
>> > If verification is required please request a hard-copy version.
>> > This message is provided for informational purposes and should not
>> > be construed as a solicitation or offer to buy or sell any
>> > securities or related financial instruments.
>> >
>> >
>> > UBS reserves the right to retain all messages. Messages are
>> > protected and accessed only in legally justified cases.
>> >
>> >
>> > --------------------------------------------------------------------
>> > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
>> > additional commands, e-mail: users-help@qpid.apache.org
>> >
>> Visit our website at http://www.ubs.com
>>
>> This message contains confidential information and is intended only
>> for the individual named.  If you are not the named addressee you
>> should not disseminate, distribute or copy this e-mail.  Please notify
>
>> the sender immediately by e-mail if you have received this e-mail by
>> mistake and delete this e-mail from your system.
>>
>> E-mails are not encrypted and cannot be guaranteed to be secure or
>> error-free as information could be intercepted, corrupted, lost,
>> destroyed, arrive late or incomplete, or contain viruses.  The sender
>> therefore does not accept liability for any errors or omissions in the
>
>> contents of this message which arise as a result of e-mail
> transmission.
>> If verification is required please request a hard-copy version.  This
>> message is provided for informational purposes and should not be
>> construed as a solicitation or offer to buy or sell any securities or
>> related financial instruments.
>>
>>
>> UBS reserves the right to retain all messages. Messages are protected
>> and accessed only in legally justified cases.
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
>> additional commands, e-mail: users-help@qpid.apache.org
>>
>>
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only
> for the individual named.  If you are not the named addressee you
> should not disseminate, distribute or copy this e-mail.  Please
> notify the sender immediately by e-mail if you have received this
> e-mail by mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or
> error-free as information could be intercepted, corrupted, lost,
> destroyed, arrive late or incomplete, or contain viruses.  The sender
> therefore does not accept liability for any errors or omissions in the
> contents of this message which arise as a result of e-mail transmission.
> If verification is required please request a hard-copy version.  This
> message is provided for informational purposes and should not be
> construed as a solicitation or offer to buy or sell any securities
> or related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected
> and accessed only in legally justified cases.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org

RE: How to encrypt user password in connection url

[Da...@ubs.com]

Hi, Phil, 

Got it. It seems that we need to write our own JMS listener, extending
from the default one, org.apache.axis2.transport.jms.JMSListener . 

Thanks for the help. 
David

-----Original Message-----
From: philharveyonline@googlemail.com
[mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
Sent: Sunday, December 09, 2012 12:57 AM
To: users@qpid.apache.org
Subject: RE: How to encrypt user password in connection url

Hi David,

I was actually thinking containers such as WebSphere which allow JNDI
objects to be securely stored by an administrator. Sounds like that
might not be useful in your case though.

I don't know the best way of securely storing the connection URL in
Synapse. Writing a custom JMSListener may be an option. You could try
asking for advice on the Synapse mailing list.

Finally, note that Qpid does support client SSL authentication. This may
provide the level of security that you need. If you think this might be
useful we can help you set it up.

Incidentally, which version of the Qpid client and broker are you using?

Phil
On Dec 8, 2012 4:47 PM, <Da...@ubs.com> wrote:

> Hi, Phil,
>
> Thanks for the info.
>
> We are trying to embed qpid in Synapse where qpid connection 
> information is stored in a property file in the format like -
>
> connectionfactory.QueueConnectionFactory = 
> amqp://user:password@clientID/test?brokerlist=...
>
> So what you mean is that we need to create customized listener to read

> the property file and decrypt the password where the password can be 
> encrypted?
>
> It seems out of the box in Synapse, it uses 
> org.apache.axis2.transport.jms.JMSListener and there is no such an 
> option.
>
> Thanks,
> David
>
>
>
> -----Original Message-----
> From: philharveyonline@googlemail.com
> [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> Sent: Saturday, December 08, 2012 2:11 AM
> To: users@qpid.apache.org
> Subject: Re: How to encrypt user password in connection url
>
> Hi David,
>
> I assume you're talking about encrypting the stored URL string, and 
> not about encrypting the details sent over the wire to the broker.  I 
> think the only way to do this is to store it in a secure JNDI context,
e.g.
> one provided by a Java application server.  This is in line with the 
> approach commonly taken for making JDBC connections from JEE apps.
>
> Phil
>
>
> On 8 December 2012 00:27, <Da...@ubs.com> wrote:
>
> > **
> > Hi, Guys,
> >
> > Is there a way to encrypt password in the connection URL below?
> >
> > amqp://[<user>:<pass>@][<clientid>]<virtualhost>[..]
> >
> > David
> >
> > Visit our website at http://www.ubs.com
> >
> > This message contains confidential information and is intended only 
> > for the individual named.  If you are not the named addressee you 
> > should not disseminate, distribute or copy this e-mail.  Please 
> > notify
>
> > the sender immediately by e-mail if you have received this e-mail by

> > mistake and delete this e-mail from your system.
> >
> > E-mails are not encrypted and cannot be guaranteed to be secure or 
> > error-free as information could be intercepted, corrupted, lost, 
> > destroyed, arrive late or incomplete, or contain viruses.  The 
> > sender therefore does not accept liability for any errors or 
> > omissions in the
>
> > contents of this message which arise as a result of e-mail
> transmission.
> > If verification is required please request a hard-copy version.  
> > This message is provided for informational purposes and should not 
> > be construed as a solicitation or offer to buy or sell any 
> > securities or related financial instruments.
> >
> >
> > UBS reserves the right to retain all messages. Messages are 
> > protected and accessed only in legally justified cases.
> >
> >
> > --------------------------------------------------------------------
> > - To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> > additional commands, e-mail: users-help@qpid.apache.org
> >
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only 
> for the individual named.  If you are not the named addressee you 
> should not disseminate, distribute or copy this e-mail.  Please notify

> the sender immediately by e-mail if you have received this e-mail by 
> mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or 
> error-free as information could be intercepted, corrupted, lost, 
> destroyed, arrive late or incomplete, or contain viruses.  The sender 
> therefore does not accept liability for any errors or omissions in the

> contents of this message which arise as a result of e-mail
transmission.
> If verification is required please request a hard-copy version.  This 
> message is provided for informational purposes and should not be 
> construed as a solicitation or offer to buy or sell any securities or 
> related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected 
> and accessed only in legally justified cases.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> additional commands, e-mail: users-help@qpid.apache.org
>
>
Visit our website at http://www.ubs.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.
	
E-mails are not encrypted and cannot be guaranteed to be secure or 
error-free as information could be intercepted, corrupted, lost, 
destroyed, arrive late or incomplete, or contain viruses.  The sender 
therefore does not accept liability for any errors or omissions in the 
contents of this message which arise as a result of e-mail transmission.  
If verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities 
or related financial instruments.

 
UBS reserves the right to retain all messages. Messages are protected
and accessed only in legally justified cases.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org

RE: How to encrypt user password in connection url

[Phil Harvey <ph...@philharveyonline.com>]

Hi David,

I was actually thinking containers such as WebSphere which allow JNDI
objects to be securely stored by an administrator. Sounds like that might
not be useful in your case though.

I don't know the best way of securely storing the connection URL in
Synapse. Writing a custom JMSListener may be an option. You could try
asking for advice on the Synapse mailing list.

Finally, note that Qpid does support client SSL authentication. This may
provide the level of security that you need. If you think this might be
useful we can help you set it up.

Incidentally, which version of the Qpid client and broker are you using?

Phil
On Dec 8, 2012 4:47 PM, <Da...@ubs.com> wrote:

> Hi, Phil,
>
> Thanks for the info.
>
> We are trying to embed qpid in Synapse where qpid connection information
> is stored in a property file in the format like -
>
> connectionfactory.QueueConnectionFactory =
> amqp://user:password@clientID/test?brokerlist=...
>
> So what you mean is that we need to create customized listener to read
> the property file and decrypt the password where the password can be
> encrypted?
>
> It seems out of the box in Synapse, it uses
> org.apache.axis2.transport.jms.JMSListener and there is no such an
> option.
>
> Thanks,
> David
>
>
>
> -----Original Message-----
> From: philharveyonline@googlemail.com
> [mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
> Sent: Saturday, December 08, 2012 2:11 AM
> To: users@qpid.apache.org
> Subject: Re: How to encrypt user password in connection url
>
> Hi David,
>
> I assume you're talking about encrypting the stored URL string, and not
> about encrypting the details sent over the wire to the broker.  I think
> the only way to do this is to store it in a secure JNDI context, e.g.
> one provided by a Java application server.  This is in line with the
> approach commonly taken for making JDBC connections from JEE apps.
>
> Phil
>
>
> On 8 December 2012 00:27, <Da...@ubs.com> wrote:
>
> > **
> > Hi, Guys,
> >
> > Is there a way to encrypt password in the connection URL below?
> >
> > amqp://[<user>:<pass>@][<clientid>]<virtualhost>[..]
> >
> > David
> >
> > Visit our website at http://www.ubs.com
> >
> > This message contains confidential information and is intended only
> > for the individual named.  If you are not the named addressee you
> > should not disseminate, distribute or copy this e-mail.  Please notify
>
> > the sender immediately by e-mail if you have received this e-mail by
> > mistake and delete this e-mail from your system.
> >
> > E-mails are not encrypted and cannot be guaranteed to be secure or
> > error-free as information could be intercepted, corrupted, lost,
> > destroyed, arrive late or incomplete, or contain viruses.  The sender
> > therefore does not accept liability for any errors or omissions in the
>
> > contents of this message which arise as a result of e-mail
> transmission.
> > If verification is required please request a hard-copy version.  This
> > message is provided for informational purposes and should not be
> > construed as a solicitation or offer to buy or sell any securities or
> > related financial instruments.
> >
> >
> > UBS reserves the right to retain all messages. Messages are protected
> > and accessed only in legally justified cases.
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For
> > additional commands, e-mail: users-help@qpid.apache.org
> >
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only
> for the individual named.  If you are not the named addressee you
> should not disseminate, distribute or copy this e-mail.  Please
> notify the sender immediately by e-mail if you have received this
> e-mail by mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or
> error-free as information could be intercepted, corrupted, lost,
> destroyed, arrive late or incomplete, or contain viruses.  The sender
> therefore does not accept liability for any errors or omissions in the
> contents of this message which arise as a result of e-mail transmission.
> If verification is required please request a hard-copy version.  This
> message is provided for informational purposes and should not be
> construed as a solicitation or offer to buy or sell any securities
> or related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected
> and accessed only in legally justified cases.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>
>

RE: How to encrypt user password in connection url

[Da...@ubs.com]

Hi, Phil, 

Thanks for the info. 

We are trying to embed qpid in Synapse where qpid connection information
is stored in a property file in the format like - 

connectionfactory.QueueConnectionFactory =
amqp://user:password@clientID/test?brokerlist=... 

So what you mean is that we need to create customized listener to read
the property file and decrypt the password where the password can be
encrypted? 

It seems out of the box in Synapse, it uses
org.apache.axis2.transport.jms.JMSListener and there is no such an
option. 

Thanks, 
David



-----Original Message-----
From: philharveyonline@googlemail.com
[mailto:philharveyonline@googlemail.com] On Behalf Of Phil Harvey
Sent: Saturday, December 08, 2012 2:11 AM
To: users@qpid.apache.org
Subject: Re: How to encrypt user password in connection url

Hi David,

I assume you're talking about encrypting the stored URL string, and not
about encrypting the details sent over the wire to the broker.  I think
the only way to do this is to store it in a secure JNDI context, e.g.
one provided by a Java application server.  This is in line with the
approach commonly taken for making JDBC connections from JEE apps.

Phil


On 8 December 2012 00:27, <Da...@ubs.com> wrote:

> **
> Hi, Guys,
>
> Is there a way to encrypt password in the connection URL below?
>
> amqp://[<user>:<pass>@][<clientid>]<virtualhost>[..]
>
> David
>
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only 
> for the individual named.  If you are not the named addressee you 
> should not disseminate, distribute or copy this e-mail.  Please notify

> the sender immediately by e-mail if you have received this e-mail by 
> mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or 
> error-free as information could be intercepted, corrupted, lost, 
> destroyed, arrive late or incomplete, or contain viruses.  The sender 
> therefore does not accept liability for any errors or omissions in the

> contents of this message which arise as a result of e-mail
transmission.
> If verification is required please request a hard-copy version.  This 
> message is provided for informational purposes and should not be 
> construed as a solicitation or offer to buy or sell any securities or 
> related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected 
> and accessed only in legally justified cases.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org For 
> additional commands, e-mail: users-help@qpid.apache.org
>
Visit our website at http://www.ubs.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.
	
E-mails are not encrypted and cannot be guaranteed to be secure or 
error-free as information could be intercepted, corrupted, lost, 
destroyed, arrive late or incomplete, or contain viruses.  The sender 
therefore does not accept liability for any errors or omissions in the 
contents of this message which arise as a result of e-mail transmission.  
If verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities 
or related financial instruments.

 
UBS reserves the right to retain all messages. Messages are protected
and accessed only in legally justified cases.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org

Re: How to encrypt user password in connection url

[Phil Harvey <ph...@philharveyonline.com>]

Hi David,

I assume you're talking about encrypting the stored URL string, and not
about encrypting the details sent over the wire to the broker.  I think the
only way to do this is to store it in a secure JNDI context, e.g. one
provided by a Java application server.  This is in line with the approach
commonly taken for making JDBC connections from JEE apps.

Phil


On 8 December 2012 00:27, <Da...@ubs.com> wrote:

> **
> Hi, Guys,
>
> Is there a way to encrypt password in the connection URL below?
>
> amqp://[<user>:<pass>@][<clientid>]<virtualhost>[..]
>
> David
>
> Visit our website at http://www.ubs.com
>
> This message contains confidential information and is intended only
> for the individual named.  If you are not the named addressee you
> should not disseminate, distribute or copy this e-mail.  Please
> notify the sender immediately by e-mail if you have received this
> e-mail by mistake and delete this e-mail from your system.
>
> E-mails are not encrypted and cannot be guaranteed to be secure or
> error-free as information could be intercepted, corrupted, lost,
> destroyed, arrive late or incomplete, or contain viruses.  The sender
> therefore does not accept liability for any errors or omissions in the
> contents of this message which arise as a result of e-mail transmission.
> If verification is required please request a hard-copy version.  This
> message is provided for informational purposes and should not be
> construed as a solicitation or offer to buy or sell any securities
> or related financial instruments.
>
>
> UBS reserves the right to retain all messages. Messages are protected
> and accessed only in legally justified cases.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
> For additional commands, e-mail: users-help@qpid.apache.org
>

How to encrypt user password in connection url

[Da...@ubs.com]

Hi, Guys, 
 
Is there a way to encrypt password in the connection URL below? 
 
amqp://[<user>:<pass>@][<clientid>]<virtualhost>[..]
 
David