You are viewing a plain text version of this content. The canonical link for it is here.
Posted to server-user@james.apache.org by Hut Carspecken <hu...@privacyinc.com> on 2003/09/09 23:45:58 UTC
Securing JAMES database connections
Good Evening,
I have been looking at JAMES and it occurred to me that the JAMES server
advertises itself in the email trace information in an email message.
i.e. <James 2.2.0a8>
If a hacker sees this and knows anything about JAMES, they could take
advantage that the config.xml file is clear text and easily displays a
database username and password to someone who could hack into the
computer.
My question is two part. First, is there anyway that I can remove the
JAMES name and version from the email trace information. Second, how do
people protect vital files such as the config.xml file. If a server is
behind a firewall and all ports are closed, there is a chance that a
hacker could break into a server. Is there a way to encrypt the
config.xml file?
Thank you,
Hut
Re: Securing JAMES database connections
Posted by tobe <to...@swipnet.se>.
To protect config.xml, I would create a special user to run James and
make sure only that user can read the config.xml
/tobe
Hut Carspecken wrote:
>
>Good Evening,
>
>I have been looking at JAMES and it occurred to me that the JAMES server
>advertises itself in the email trace information in an email message.
>i.e. <James 2.2.0a8>
>
>If a hacker sees this and knows anything about JAMES, they could take
>advantage that the config.xml file is clear text and easily displays a
>database username and password to someone who could hack into the
>computer.
>
>My question is two part. First, is there anyway that I can remove the
>JAMES name and version from the email trace information. Second, how do
>people protect vital files such as the config.xml file. If a server is
>behind a firewall and all ports are closed, there is a chance that a
>hacker could break into a server. Is there a way to encrypt the
>config.xml file?
>
>Thank you,
>
>Hut
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: Securing JAMES database connections
Posted by Stephen McConnell <mc...@apache.org>.
Steve Brewin wrote:
>The parsing of an encrypted field is something that could be supported by
>Avalon, James' host framework. If it is added to
>org.apache.avalon.framework.configuration.Configuration then James could use
>it.
>
>
+1 Good idea.
Needs some thinking bacause this is potentially getting into
configuration meta-info.
Cheers, Steve.
>-- Steve
>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
>For additional commands, e-mail: server-user-help@james.apache.org
>
>
>
>
--
Stephen J. McConnell
mailto:mcconnell@apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: Securing JAMES database connections
Posted by Stephen McConnell <mc...@apache.org>.
Steve Brewin wrote:
>The parsing of an encrypted field is something that could be supported by
>Avalon, James' host framework. If it is added to
>org.apache.avalon.framework.configuration.Configuration then James could use
>it.
>
>
+1 Good idea.
Needs some thinking bacause this is potentially getting into
configuration meta-info.
Cheers, Steve.
>-- Steve
>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
>For additional commands, e-mail: server-user-help@james.apache.org
>
>
>
>
--
Stephen J. McConnell
mailto:mcconnell@apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@avalon.apache.org
For additional commands, e-mail: dev-help@avalon.apache.org
RE: Securing JAMES database connections
Posted by "Noel J. Bergman" <no...@devtech.com>.
Steve,
There is little point to having a reversibly encrypted password. Such
things are easily broken. Just make make config.xml readable only by the
account running the James server.
--- Noel
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
RE: Securing JAMES database connections
Posted by Steve Brewin <sb...@synsys.com>.
Hut,
> -----Original Message-----
> From: Hut Carspecken [mailto:hutson.carspecken@privacyinc.com]
> Sent: 09 September 2003 22:46
> To: 'James Users List'
> Subject: Securing JAMES database connections
>
>
>
> Good Evening,
>
> I have been looking at JAMES and it occurred to me that the
> JAMES server
> advertises itself in the email trace information in an email message.
> i.e. <James 2.2.0a8>
>
> If a hacker sees this and knows anything about JAMES, they could take
> advantage that the config.xml file is clear text and easily displays a
> database username and password to someone who could hack into the
> computer.
>
> My question is two part. First, is there anyway that I can remove the
> JAMES name and version from the email trace information.
> Second, how do
> people protect vital files such as the config.xml file. If a
> server is
> behind a firewall and all ports are
NOT - I assume?
> closed, there is a chance that a
> hacker could break into a server. Is there a way to encrypt the
> config.xml file?
Don't assume the hacker is outside. It doesn't make good press, but far more
damage is done maliciously or incompetently from the inside.
Personally, I believe that encrypting the whole of the config. file is going
too far. Having a mechanism for encrypting passwords would be good. This is
especially pertinent to James tasks such as fetchpop and fetchmail which
currently must declare any number of account credentials in plain text
within the config.
The parsing of an encrypted field is something that could be supported by
Avalon, James' host framework. If it is added to
org.apache.avalon.framework.configuration.Configuration then James could use
it.
-- Steve
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
RE: Securing JAMES database connections
Posted by "Noel J. Bergman" <no...@devtech.com>.
> If a hacker sees this and knows anything about JAMES, they could take
> advantage that the config.xml file is clear text and easily displays a
> database username and password to someone who could hack into the
> computer.
If someone can see the fact that you are running any particular service, and
by that fact gain access to your file system, then you've got other
problems.
Your priority should be to run a secure server. Typically, that means ABW.
My server is running James and MySQL. In fact, I have other servers
elsewhere in the city that perform real-time replication with the primary
database.
Here are the open TCP ports on my production server:
22/tcp open ssh
25/tcp open smtp
80/tcp open http
110/tcp open pop-3
You'll notice that MySQL is nowhere to be found.
--- Noel
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org