You are viewing a plain text version of this content. The canonical link for it is here.
Posted to derby-dev@db.apache.org by "Daniel John Debrunner (JIRA)" <de...@db.apache.org> on 2006/02/26 18:54:04 UTC
[jira] Commented: (DERBY-1056) Print a security warning to
derby.log and network server console if network server is started with -h
0.0.0.0 and security manager, user authentication, and ecrypted userid are
not on
[ http://issues.apache.org/jira/browse/DERBY-1056?page=comments#action_12367842 ]
Daniel John Debrunner commented on DERBY-1056:
----------------------------------------------
Should this warning also be generated when the server is listening on an address that is not localhost?
-h mymachine.mydomain.com
> Print a security warning to derby.log and network server console if network server is started with -h 0.0.0.0 and security manager, user authentication, and ecrypted userid are not on
> ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-1056
> URL: http://issues.apache.org/jira/browse/DERBY-1056
> Project: Derby
> Type: Improvement
> Components: Network Server, Security
> Reporter: Kathey Marsden
> Fix For: 10.2.0.0
>
> Information and questions from the user list seem to indicate that often users start network server with the -h 0.0.0.0 option without taking proper security measures. I think it would be worthwhile to print a security warning the console and derby.log if network server is starated without the proper security in place.
> Serious security issues exist when starting network server with the -h 0.0.0.0 option unless users
> - Run in security manager with permissions restricted as much as possible.
> - Enable user authentication
> - Use encrypted userid/password (Currently only available with IBMJCE)
> Even when started with the localhost default there can be security issues if the machine itself is not secure.
> An example of such an attack might include creating databases until the host machine disk filled up, deleting all user data etc.
> Related issues:
> DERBY-65
> DERBY-474
> DERBY -528
> DERBY-962
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira