You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Mohamed Tagari <ta...@ebi.ac.uk> on 2003/06/05 11:40:21 UTC
security of server.xml
Hi,
Is there any way of taking the password and username for connecting to a
database out of the server.xml, and placing it in code before the lookup
is done on this?? As having the username and password as plain text is not
very secure..
// java code
Context init = new InitialContext();
Context ctx = (Context) init.lookup("java:comp/env");
DataSource ds = (DataSource) ctx.lookup("jdbc/myoracle");
// extract from server.xml
<Resource name="jdbc/myoracle" auth="Container"
type="javax.sql.DataSource"/>
<ResourceParams name="jdbc/myoracle">
.
.
.
<parameter>
<name>username</name>
<value>scott</value>
</parameter>
<parameter>
<name>password</name>
<value>tiger</value>
</parameter>
.
.
</ResourceParams>
mo
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: security of server.xml
Posted by Bill Barker <wb...@wilshire.com>.
TC 3.3.x has a variable-replacement option, which is very nice for this sort
of thing. Unfortunately, it hasn't been ported to TC 4.x.
"Mohamed Tagari" <ta...@ebi.ac.uk> wrote in message
news:Pine.LNX.4.44.0306051035420.25765-100000@flinders.ebi.ac.uk...
> Hi,
>
> Is there any way of taking the password and username for connecting to a
> database out of the server.xml, and placing it in code before the lookup
> is done on this?? As having the username and password as plain text is not
> very secure..
>
> // java code
> Context init = new InitialContext();
> Context ctx = (Context) init.lookup("java:comp/env");
> DataSource ds = (DataSource) ctx.lookup("jdbc/myoracle");
>
>
>
> // extract from server.xml
> <Resource name="jdbc/myoracle" auth="Container"
> type="javax.sql.DataSource"/>
>
> <ResourceParams name="jdbc/myoracle">
> .
> .
> .
> <parameter>
> <name>username</name>
> <value>scott</value>
> </parameter>
> <parameter>
> <name>password</name>
> <value>tiger</value>
> </parameter>
> .
> .
> </ResourceParams>
>
> mo
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: security of server.xml
Posted by John Turner <to...@johnturner.com>.
Java code can be decompiled. Easily.
Rogue classes can be inserted into improperly configured packages. There's
plenty more.
If your UNIX-like OS is unstable enough to allow a file owned by root with
permissions of 700 be viewable to various untrusted users, you've got
bigger concerns on your hands besides hiding the database connection
password. Keep in mind, too, that the password is most like going to be
transmitted in the clear...its trivial to have a packet sniffer retrieve
it.
I hate to self-promote, but perhaps you might want to consider picking up a
copy of the Apache Tomcat Security Handbook from Wrox Press, ISBN
1861008309.
John
On Thu, 5 Jun 2003 16:04:43 +0100 (BST), Mohamed Tagari <ta...@ebi.ac.uk>
wrote:
> HI,
>
> the database contains sensitive information and so the password and
> username should not be available even as a read only..
>
> Due to the sensitivity of the data it could be seen viable to recompile
> the code, and redeploy your application.
>
> mo
>
> On Thu, 5 Jun 2003, John Turner wrote:
>
>>
>> Well, if you put in code, then every time it changes you need to
>> recompile your code, and redeploy your application.
>>
>> If you put it in server.xml, you don't ever have to do that.
>>
>> The security on server.xml is easy:
>>
>> chmod 700 TOMCAT_USER
>>
>> TOMCAT_USER = whatever user Tomcat runs as
>>
>> John
>>
>> On Thu, 5 Jun 2003 10:40:21 +0100 (BST), Mohamed Tagari
>> <ta...@ebi.ac.uk> wrote:
>>
>> > Hi,
>> >
>> > Is there any way of taking the password and username for connecting to
>> a > database out of the server.xml, and placing it in code before the
>> lookup > is done on this?? As having the username and password as plain
>> text is > not very secure..
>> >
>> > // java code
>> > Context init = new InitialContext();
>> > Context ctx = (Context) init.lookup("java:comp/env");
>> > DataSource ds = (DataSource) ctx.lookup("jdbc/myoracle");
>> >
>> >
>> >
>> > // extract from server.xml
>> > <Resource name="jdbc/myoracle" auth="Container"
>> > type="javax.sql.DataSource"/>
>> >
>> > <ResourceParams name="jdbc/myoracle">
>> > .
>> > .
>> > .
>> > <parameter>
>> > <name>username</name>
>> > <value>scott</value>
>> > </parameter>
>> > <parameter>
>> > <name>password</name>
>> > <value>tiger</value>
>> > </parameter>
>> > .
>> > .
>> > </ResourceParams>
>> >
>> > mo
>> >
>> >
>> > ---------------------------------------------------------------------
>> > To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
>> > For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
>> >
>> >
>>
>>
>>
>> -- Using M2, Opera's revolutionary e-mail client:
>> http://www.opera.com/m2/
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
>> For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
>>
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
>
>
--
Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: security of server.xml
Posted by Mohamed Tagari <ta...@ebi.ac.uk>.
HI,
the database contains sensitive information and so the password and
username should not be available even as a read only..
Due to the sensitivity of the data it could be seen viable to recompile
the code, and redeploy your application.
mo
On Thu, 5 Jun 2003, John Turner wrote:
>
> Well, if you put in code, then every time it changes you need to recompile
> your code, and redeploy your application.
>
> If you put it in server.xml, you don't ever have to do that.
>
> The security on server.xml is easy:
>
> chmod 700 TOMCAT_USER
>
> TOMCAT_USER = whatever user Tomcat runs as
>
> John
>
> On Thu, 5 Jun 2003 10:40:21 +0100 (BST), Mohamed Tagari <ta...@ebi.ac.uk>
> wrote:
>
> > Hi,
> >
> > Is there any way of taking the password and username for connecting to a
> > database out of the server.xml, and placing it in code before the lookup
> > is done on this?? As having the username and password as plain text is
> > not very secure..
> >
> > // java code
> > Context init = new InitialContext();
> > Context ctx = (Context) init.lookup("java:comp/env");
> > DataSource ds = (DataSource) ctx.lookup("jdbc/myoracle");
> >
> >
> >
> > // extract from server.xml
> > <Resource name="jdbc/myoracle" auth="Container"
> > type="javax.sql.DataSource"/>
> >
> > <ResourceParams name="jdbc/myoracle">
> > .
> > .
> > .
> > <parameter>
> > <name>username</name>
> > <value>scott</value>
> > </parameter>
> > <parameter>
> > <name>password</name>
> > <value>tiger</value>
> > </parameter>
> > .
> > .
> > </ResourceParams>
> >
> > mo
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
> > For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
> >
> >
>
>
>
> --
> Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: security of server.xml
Posted by John Turner <to...@johnturner.com>.
Well, if you put in code, then every time it changes you need to recompile
your code, and redeploy your application.
If you put it in server.xml, you don't ever have to do that.
The security on server.xml is easy:
chmod 700 TOMCAT_USER
TOMCAT_USER = whatever user Tomcat runs as
John
On Thu, 5 Jun 2003 10:40:21 +0100 (BST), Mohamed Tagari <ta...@ebi.ac.uk>
wrote:
> Hi,
>
> Is there any way of taking the password and username for connecting to a
> database out of the server.xml, and placing it in code before the lookup
> is done on this?? As having the username and password as plain text is
> not very secure..
>
> // java code
> Context init = new InitialContext();
> Context ctx = (Context) init.lookup("java:comp/env");
> DataSource ds = (DataSource) ctx.lookup("jdbc/myoracle");
>
>
>
> // extract from server.xml
> <Resource name="jdbc/myoracle" auth="Container"
> type="javax.sql.DataSource"/>
>
> <ResourceParams name="jdbc/myoracle">
> .
> .
> .
> <parameter>
> <name>username</name>
> <value>scott</value>
> </parameter>
> <parameter>
> <name>password</name>
> <value>tiger</value>
> </parameter>
> .
> .
> </ResourceParams>
>
> mo
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
>
>
--
Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Java Bean Question
Posted by Joe <jo...@sgweb.com.sg>.
Hi people, i have some confusion with Java Bean Search Path. When i
created a bean and put into my /Webapps/test/WEB-INF/classes/bean.class
and use it by
<jsp:useBean id="beanid" class="bean" />
i won't be able to retrieve it. It will return a
=======================================================================
type Exception report
message
description The server encountered an internal error () that prevented
it from fulfilling this request.
exception
org.apache.jasper.JasperException: Unable to compile class for JSP
An error occurred at line: -1 in the jsp file: null
Generated servlet error:
[javac] Since fork is true, ignoring compiler setting.
[javac] Compiling 1 source file
[javac] Since fork is true, ignoring compiler setting.
[javac] C:\Tomcat\work\Standalone\localhost\joeWEB\jsp\Test_jsp.java:48:
cannot resolve symbol
[javac] symbol : class sqlBean
[javac] location: class org.apache.jsp.Test_jsp
[javac] sqlBean sql = null;
[javac] ^
========================================================================
i guess the system is unable to find this particular bean.However, if i
were to package the bean say into Package pack.bean;
and place this bean file in /Webapps/WEB-INF/classes/pack/bean.class
I AM ABLE TO CALL IT.
My question is, where is the default path tomcat will search for the the
bean w/o package name? I thought it should be inside
/Webapps/myWeb/WEB-INF/classes/ ?
Regards,
Joe
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org