[jira] Commented: (GERONIMO-411) Add Hash Password Rewrite to File Realm

["Aaron Mulder (JIRA)" <de...@geronimo.apache.org>]

    [ http://issues.apache.org/jira/browse/GERONIMO-411?page=comments#action_12320293 ] 

Aaron Mulder commented on GERONIMO-411:
---------------------------------------

Jeff says: "Is this something we should do in the plans as well (i.e. SSL certs, etc)?"

I guess ultimately we'll want some sort of utility class that can have a method like

public boolean isMatchingPassword(String one, String two)

Then it can handle comparing password regardless of whether they're null, plain text, hashed, etc.  And we can invoke that anywhere we need to compare passwords.

That said, we can't hash the passwords for SSL certs since AFAIK we have to reproduce the passwords in order to pass it to the keystore API to access the keystore and pricate key.  Likewise the DB password for a connection pool, etc.  We could encrypt the passwords, but I don't know what encryption key we could use that wouldn't be subject to change and also wouldn't be transparent to anyone with the source code -- in other words, it would only defeat the most casual attackers, and it's probably overengineering for that compared to, say, ROT-13.  :)

> Add Hash Password Rewrite to File Realm
> ---------------------------------------
>
>          Key: GERONIMO-411
>          URL: http://issues.apache.org/jira/browse/GERONIMO-411
>      Project: Geronimo
>         Type: Improvement
>   Components: security
>     Versions: 1.0-M2
>     Reporter: Aaron Mulder
>     Priority: Minor
>      Fix For: 1.0

>
> It would be nice if the properties file realm could rewrite your properties file with hashed passwords when it reads it.  We would need to be able to recognize hashed vs. unhashed entries and perhaps even different algorithms.  Perhaps it could go like this:
> user1=plaintext
> user2=MD5{...}
> user3=SHA1{...}
> Anyway, the idea is that this could be a reasonably secure alternative, but you still wouldn't need to manually hash things to add or update entries -- just put a plain text entry in and the next time the server reads the file it would hash it for you.
> I guess we'd need to synchronize on the hash operation to avoid threading problems if multiple apps or whatever use the same properties file, but it shouldn't be bad if we only rewrite the file if we find any plain text entries.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
   http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
   http://www.atlassian.com/software/jira