You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@geronimo.apache.org by si...@insession.com on 2005/07/15 08:02:30 UTC
Deploy tool and user and password security
Currently if someone specifies a userid and password on the command line
to the deploy tool, it could be visible to other UNIX users via ps
commands.
Should we enable the user to point the deployer to a properties file
(stored in a secured location) that contains the userid and password. That
would be more secure for cases where the tool is being called by scripts
and the userid/password prompting is not desired.
Our documentation should also remind users about this security issue.
Does this sound reasonable for a new JIRA task?
John
Re: Deploy tool and user and password security
Posted by Dain Sundstrom <da...@iq80.com>.
Seams reasonable.
Is there a defacto standard in linux tools that we can copy for the
file format?
-dain
On Jul 14, 2005, at 11:02 PM, sissonj@insession.com wrote:
> Currently if someone specifies a userid and password on the command
> line
> to the deploy tool, it could be visible to other UNIX users via ps
> commands.
>
> Should we enable the user to point the deployer to a properties file
> (stored in a secured location) that contains the userid and
> password. That
> would be more secure for cases where the tool is being called by
> scripts
> and the userid/password prompting is not desired.
>
> Our documentation should also remind users about this security issue.
>
> Does this sound reasonable for a new JIRA task?
>
> John
>
Re: Deploy tool and user and password security
Posted by Aaron Mulder <am...@alumni.princeton.edu>.
It doesn't matter what the monitor shows, because I'll be
controlling your mind directly.
Aaron
P.S. Which is to say, quite right. :)
On Sat, 16 Jul 2005 sissonj@insession.com wrote:
> Wouldn't this alternative still require that the script pass the userid
> and password on the command line using -D arguments and therefore still
> visible on the ps command?
>
> Created JIRA issue http://issues.apache.org/jira/browse/GERONIMO-766
>
> John
>
> Aaron Mulder <am...@alumni.princeton.edu> wrote on 15/07/2005 09:59:45
> PM:
>
> > Another alternative is to let the user put the username and
> > password in environment variables, and then have a deployer start script
>
> > that sends them in as system properties.
> >
> > Aaron
> >
> > On Fri, 15 Jul 2005 sissonj@insession.com wrote:
> > > Currently if someone specifies a userid and password on the command
> line
> > > to the deploy tool, it could be visible to other UNIX users via ps
> > > commands.
> > >
> > > Should we enable the user to point the deployer to a properties file
> > > (stored in a secured location) that contains the userid and password.
> That
> > > would be more secure for cases where the tool is being called by
> scripts
> > > and the userid/password prompting is not desired.
> > >
> > > Our documentation should also remind users about this security issue.
> > >
> > > Does this sound reasonable for a new JIRA task?
> > >
> > > John
> > >
>
>
Re: Deploy tool and user and password security
Posted by si...@insession.com.
Wouldn't this alternative still require that the script pass the userid
and password on the command line using -D arguments and therefore still
visible on the ps command?
Created JIRA issue http://issues.apache.org/jira/browse/GERONIMO-766
John
Aaron Mulder <am...@alumni.princeton.edu> wrote on 15/07/2005 09:59:45
PM:
> Another alternative is to let the user put the username and
> password in environment variables, and then have a deployer start script
> that sends them in as system properties.
>
> Aaron
>
> On Fri, 15 Jul 2005 sissonj@insession.com wrote:
> > Currently if someone specifies a userid and password on the command
line
> > to the deploy tool, it could be visible to other UNIX users via ps
> > commands.
> >
> > Should we enable the user to point the deployer to a properties file
> > (stored in a secured location) that contains the userid and password.
That
> > would be more secure for cases where the tool is being called by
scripts
> > and the userid/password prompting is not desired.
> >
> > Our documentation should also remind users about this security issue.
> >
> > Does this sound reasonable for a new JIRA task?
> >
> > John
> >
Re: Deploy tool and user and password security
Posted by Aaron Mulder <am...@alumni.princeton.edu>.
Another alternative is to let the user put the username and
password in environment variables, and then have a deployer start script
that sends them in as system properties.
Aaron
On Fri, 15 Jul 2005 sissonj@insession.com wrote:
> Currently if someone specifies a userid and password on the command line
> to the deploy tool, it could be visible to other UNIX users via ps
> commands.
>
> Should we enable the user to point the deployer to a properties file
> (stored in a secured location) that contains the userid and password. That
> would be more secure for cases where the tool is being called by scripts
> and the userid/password prompting is not desired.
>
> Our documentation should also remind users about this security issue.
>
> Does this sound reasonable for a new JIRA task?
>
> John
>
Re: Deploy tool and user and password security
Posted by Jacek Laskowski <jl...@apache.org>.
sissonj@insession.com wrote:
> Does this sound reasonable for a new JIRA task?
Certainly. Each and every task should be in JIRA os people could easily
track who does what.
> John
Jacek