You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by "Dickson Lam (dilam)" <di...@cisco.com> on 2006/05/30 22:19:44 UTC
How to hide the keystorePass at the server.xml
Hi,
I am using Tomcat 5.5.16 window version. When I configure Tomcat to use
SSL, I need to put the "keystorePass" password on the Tomcat server.xml
file which is in plain text format.
Is it anyway I can hide the keystore password from the server.xml? or
configure Tomcat to read in an encrypted "keystorePass" password and
decrypted the password during startup?
Regards
Dickson
Re: Problem while deploying war
Posted by Mark Thomas <ma...@apache.org>.
When starting a new thread (ie sending a message to the list about a
new topic) please do not reply to an existing message and change the
subject line. To many of the list archiving services and mail clients
used by list subscribers this makes your new message appear as part
of the old thread. This makes it harder for other users to find
relevant information when searching the lists.
This is known as thread hijacking and is behaviour that is frowned
upon on this list. Frequent offenders will be removed from the list.
It should also be noted that many list subscribers automatically
ignore any messages that hijack another thread.
The correct procedure is to create a new message with a new subject.
This will start a new thread.
Mark
tomcat-user-owner
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Problem while deploying war
Posted by Venkatesh Babu <ve...@yahoo.com>.
Hi all,
I'm using Tomcat 4.1.31.
I have a war file and I'm using the ant target
"<deploy>" to deploy this war. Here is the code
snippet of my build.xml :
<property name="tomcat.server.name"
value="localhost"/>
<property name="tomcat.server.port" value="8080"/>
<property name="tomcat.user.name" value="admin"/>
<property name="tomcat.user.password"
value="admin"/>
<property name="app.deploy.manageurl"
value="http://${tomcat.server.name}:${tomcat.server.port}/manager"/>
<target name="deployapp" depends="war">
<deploy
url="${app.deploy.manageurl}"
path="/app1"
war="${basedir}/app1.war"
username="${tomcat.user.name}"
password="${tomcat.user.password}"/>
</target>
But when I call this target, I'm getting a strange
error:
BUILD FAILED
C:\temp\app1\build.xml:33:
java.net.MalformedURLException: unknown protocol: c
I have taken "catalina-ant.jar" from
${TOMCATHOME}/lib/ and placed that in ${ANT_HOME}/lib
but still having this problem.
Can anybody help me and point out what might be the
problem?
Thank you,
Venkatesh
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to hide the keystorePass at the server.xml
Posted by David Wall <d....@computer.org>.
Leon Rosenberg wrote:
> On 6/2/06, Bill Barker <wb...@wilshire.com> wrote:
>> TC 3.3.x had an optional module to do this. It never got ported.
>>
>> I generally agree with most of the people that say that this is the
>> least of
>> your problems. If you are usings a self-signed cert, then you are just
>> getting what you deserve. Otherwise, you simply contact the CA and
>> revoke
>> the cert: At least this problem solved :). Now, how to deal with
>> the fact
>> that the hacker just uploaded 10,000 credit-card numbers, since my jdbc
>> password was in the clear :).
>
> Actually you are not allowed to save credit card numbers unless you
> are a certified payment provider (which implies major security
> constraints).
> Even a certified payment provider is not allowed to store cvc codes,
> and without the codes the credit card numbers are useless. (amazon of
> course is an exception to this rule...)
> However, if you saving cc-numbers or bank accounts or any other
> payment related data in your database unencrypted you belong in jail
> :-)
> But please feel free to tell us that you are doing one of the above,
> so we know which sites to avoid :-)
Somewhat true, but nearly every site that collects payment information
and charges at a later date stores that information until the card is
actually processed, and many businesses do not charge the card until the
product/service has been delivered.
Furthermore, that simply begs the issue, since it could be SSN,
salaries, student loan info, job histories, etc. that become vulnerable.
I don't think there's much argument that allowing the option to manually
enter the keystore password is a bad thing, just that protecting an SSL
cert is only a small concern if your filesystem has been compromised.
David
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to hide the keystorePass at the server.xml
Posted by Leon Rosenberg <ro...@googlemail.com>.
On 6/2/06, Bill Barker <wb...@wilshire.com> wrote:
> TC 3.3.x had an optional module to do this. It never got ported.
>
> I generally agree with most of the people that say that this is the least of
> your problems. If you are usings a self-signed cert, then you are just
> getting what you deserve. Otherwise, you simply contact the CA and revoke
> the cert: At least this problem solved :). Now, how to deal with the fact
> that the hacker just uploaded 10,000 credit-card numbers, since my jdbc
> password was in the clear :).
Actually you are not allowed to save credit card numbers unless you
are a certified payment provider (which implies major security
constraints).
Even a certified payment provider is not allowed to store cvc codes,
and without the codes the credit card numbers are useless. (amazon of
course is an exception to this rule...)
However, if you saving cc-numbers or bank accounts or any other
payment related data in your database unencrypted you belong in jail
:-)
But please feel free to tell us that you are doing one of the above,
so we know which sites to avoid :-)
regards
leon
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to hide the keystorePass at the server.xml
Posted by Bill Barker <wb...@wilshire.com>.
TC 3.3.x had an optional module to do this. It never got ported.
I generally agree with most of the people that say that this is the least of
your problems. If you are usings a self-signed cert, then you are just
getting what you deserve. Otherwise, you simply contact the CA and revoke
the cert: At least this problem solved :). Now, how to deal with the fact
that the hacker just uploaded 10,000 credit-card numbers, since my jdbc
password was in the clear :).
"Dickson Lam (dilam)" <di...@cisco.com> wrote in message
news:C99477645D09FA43ADF9A3B8874E7E7701DA7170@xmb-sjc-21c.amer.cisco.com...
Hi,
I am using Tomcat 5.5.16 window version. When I configure Tomcat to use
SSL, I need to put the "keystorePass" password on the Tomcat server.xml
file which is in plain text format.
Is it anyway I can hide the keystore password from the server.xml? or
configure Tomcat to read in an encrypted "keystorePass" password and
decrypted the password during startup?
Regards
Dickson
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to hide the keystorePass at the server.xml
Posted by David Wall <d....@computer.org>.
> No, you just have the keystore encrypted with a password and _don't_
> specify it in the config file. Then when tomcat starts up, and can't open
> the keystore w/o a password, it knows it has to ask for it, but it isn't
> stored anywhere on the machine. That's what apache httpd does if the
> cert file is password protected. Tomcat should do the same. It works
> quite well.
>
> eric
>
Excellent point. I should have considered httpd's solution. That's
pretty clean provided you are okay with it not being able to restart
fully on its own such as a power failure.
But it suffers from the fact that if I have access to the filesystem, I
can install a new keystore with a self cert and boot the system, though
it should be detected at some point because web browsers will pop up the
cert warning (that some users will click through because they never read
anything).
And it suffers from the fact that I can probably find the db password
somewhere in your web app so I can get to your data. And it suffers
from the fact that I can then install a new login page that steals
passwords and perhaps can install other forms of nastyware.
In the end, if you can't secure your filesystem, you probably cannot
secure much else on the web site. What's the downside if someone who
has access to your filesystem has access to the SSL cert keystore? They
can remove and install certs, but I could do that anyway by putting in a
new keystore. Somehow they'd need to take your keystore, put it on a
rogue system and then spoil DNS to trick users into that system? Why
bother since I already have access to your web server's file system?
David
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to hide the keystorePass at the server.xml
Posted by Eric Haszlakiewicz <er...@swapsimple.com>.
On Tue, May 30, 2006 at 04:46:42PM -0700, David Wall wrote:
> A possible sounding solution would be to have tomcat start in a
> protected mode that requires an admin connect and enter a password
> before TC would allow the webapps to load. But even this would require
> that TC be configured to do so since most would not want this. And if
> you can access the filesystem, then you could change that configuration
> so that TC would start and NOT require that. You can even change the
> java security policy file. So you'd need to create a forked TC that
> always requires the password to be entered. But then again, if they can
> access the filesystem, they could just change out the version of TC.
No, you just have the keystore encrypted with a password and _don't_
specify it in the config file. Then when tomcat starts up, and can't open
the keystore w/o a password, it knows it has to ask for it, but it isn't
stored anywhere on the machine. That's what apache httpd does if the
cert file is password protected. Tomcat should do the same. It works
quite well.
eric
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to hide the keystorePass at the server.xml
Posted by David Wall <d....@computer.org>.
Shankar Unni wrote:
> Robert Harper wrote:
>> One thing to think of is that if you have to do that to protect it, then
>> everything else on that system is suspect.
>
> Yeah, yeah. I used to use this argument a lot, too. But that's like
> saying: if your harness isn't secure, then why bother with an
> additional safety net below you? You might as well fall and die..
>
> It's not that obfuscating or encrypting the keystorePass is a
> fool-proof answer, but that it adds an additional step of complexity
> in the way of anyone who might crack your system. Stuff happens. Just
> because a burglar got past your front door doesn't mean that you have
> to lay out your valuables in the foyer..
The problem is that if you encrypt the keystore password somewhere (or
even still embedded in the server.xml file), how do you tell Tomcat how
to decrypt that? In the end, you have to enter a password or other
credential into the system.
A possible sounding solution would be to have tomcat start in a
protected mode that requires an admin connect and enter a password
before TC would allow the webapps to load. But even this would require
that TC be configured to do so since most would not want this. And if
you can access the filesystem, then you could change that configuration
so that TC would start and NOT require that. You can even change the
java security policy file. So you'd need to create a forked TC that
always requires the password to be entered. But then again, if they can
access the filesystem, they could just change out the version of TC.
And if they can work on your file system, they can probably insert new
code into the WEB-INF/lib or WEB-INF/classes or any of the JSPs.
And if they can do all that, you probably have no security to begin with.
In the end, a secure version of Tomcat that always required a password
or other credential be provided before it starts, with an encrypted JSP
and configuration file store, etc. would be needed.
David
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to hide the keystorePass at the server.xml
Posted by Shankar Unni <sh...@netscape.net>.
Robert Harper wrote:
> One thing to think of is that if you have to do that to protect it, then
> everything else on that system is suspect.
Yeah, yeah. I used to use this argument a lot, too. But that's like
saying: if your harness isn't secure, then why bother with an additional
safety net below you? You might as well fall and die..
It's not that obfuscating or encrypting the keystorePass is a fool-proof
answer, but that it adds an additional step of complexity in the way of
anyone who might crack your system. Stuff happens. Just because a
burglar got past your front door doesn't mean that you have to lay out
your valuables in the foyer..
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: How to hide the keystorePass at the server.xml
Posted by Robert Harper <ro...@iat-cti.com>.
One thing to think of is that if you have to do that to protect it, then
everything else on that system is suspect. You should have your settings so
that the user cannot browse your computer and they can not get to that area.
That will also secure the rest of your file system. If they can read the
config files, they can also get at the user database and user information.
Robert S. Harper
Information Access Technology, Inc.
-----Original Message-----
From: Dickson Lam (dilam) [mailto:dilam@cisco.com]
Sent: Tuesday, May 30, 2006 2:20 PM
To: users@tomcat.apache.org
Subject: How to hide the keystorePass at the server.xml
Hi,
I am using Tomcat 5.5.16 window version. When I configure Tomcat to use
SSL, I need to put the "keystorePass" password on the Tomcat server.xml
file which is in plain text format.
Is it anyway I can hide the keystore password from the server.xml? or
configure Tomcat to read in an encrypted "keystorePass" password and
decrypted the password during startup?
Regards
Dickson
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org