Mailing-List: contact user-help@geronimo.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@geronimo.apache.org
Received-SPF: pass (herse.apache.org: domain of ammulder@gmail.com designates
 64.233.184.230 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth;
        b=Ov9JXrLFIJAGONvdXTubo/+o37suCaGlRQqFKcwkLWaPZaU8NwjTK2M19gMZDdjo4b/rXukdfJ6s5bxjuf/IpGf6heTSBdTVwjiow8FkvZfuKFesWxzM99ihz4KPoVMMZkz7/99b41bcRB2yte8ER/GNRYluOxBjv62GebxL9AU=
Message-ID: <74e15baa0702220935s5ab3b312m445b36576017a135@mail.gmail.com>
Date: Thu, 22 Feb 2007 12:35:11 -0500
From: "Aaron Mulder" <ammulder@alumni.princeton.edu>
Sender: ammulder@gmail.com
To: user@geronimo.apache.org
Subject: Re: Plaintext passwords in Geronimo plans and config files
In-Reply-To: 
 <OF336CB9BD.EBF29E1E-ON8525728A.004D3E72-8525728A.004E0295@mxi.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: 
 <OF336CB9BD.EBF29E1E-ON8525728A.004D3E72-8525728A.004E0295@mxi.com>

There is some built-in encryption available.  My recollection was that
the server tried to apply it to settings with "password" in the name,
but it may have changed in 1.2-beta.

Thanks,
       Aaron

On 2/22/07, Aman Nanner/MxI Technologies <aman.nanner@mxi.com> wrote:
>
> Hi,
>
> I have noticed that passwords in plans and configuration files in Geronimo
> (1.2-beta) are not encrypted by the server, and remain in plaintext.  For
> example, passwords in:
>
> 1) Datasource connector plans
> 2) ActiveMQ connector plans
> 3) TomcatWebSSL Keystore passwords
> 4) Geronimo properties realm passwords
>
> Having these plaintext passwords in these configuration files pose an
> inherent security risk that would prevent us from deploying Geronimo out to
> customer sites.  Are there any plans to have all these passwords encrypted?
>
> Thanks,
> Aman
>
> __________________________________________________________________________________
> * This message is intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. Unless you are the addressee (or authorized to receive for the addressee), you may not use, copy or disclose the message or any information contained in the message. If you have received this message in error, please advise the sender by reply e-mail , and delete the message, or call (collect) 001 613 747 4698. *
>
>