Mailing-List: contact dev-help@geronimo.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@geronimo.apache.org
Received-SPF: neutral (asf.osuosl.org: local policy)
Mime-Version: 1.0 (Apple Message framework v730)
In-Reply-To: 
 <OF7AA3B069.9BD11129-ONCA25703F.00205EA8-CA25703F.0021300F@tsainc.com>
References: 
 <OF7AA3B069.9BD11129-ONCA25703F.00205EA8-CA25703F.0021300F@tsainc.com>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <403B5B04-53A7-41C7-98AD-AB778C99D882@iq80.com>
Content-Transfer-Encoding: 7bit
From: Dain Sundstrom <dain@iq80.com>
Subject: Re: Deploy tool and user and password security
Date: Fri, 15 Jul 2005 08:20:21 -0700
To: dev@geronimo.apache.org

Seams reasonable.

Is there a defacto standard in linux tools that we can copy for the  
file format?

-dain

On Jul 14, 2005, at 11:02 PM, sissonj@insession.com wrote:

> Currently if someone specifies a userid and password on the command  
> line
> to the deploy tool, it could be visible to other UNIX users via ps
> commands.
>
> Should we enable the user to point the deployer to a properties file
> (stored in a secured location) that contains the userid and  
> password. That
> would be more secure for cases where the tool is being called by  
> scripts
> and the userid/password prompting is not desired.
>
> Our documentation should also remind users about this security issue.
>
> Does this sound reasonable for a new JIRA task?
>
> John
>