Mailing-List: contact users-help@jackrabbit.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@jackrabbit.apache.org
Received-SPF: pass (nike.apache.org: domain of chadmichaeldavis@gmail.com
 designates 209.85.214.42 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        b=cEvtiu36pcq8lYs4gyFb4UiePS5SuhYiZBAgELD1wqTObdNKknHnlYXKH8P4Md+VyI
         9imJ+ONWcR7ZREVX41gjkpMEd+2B9+0ztw+8/2Fk32YQhQlNWZL12r2wyujmbQ9kdIPL
         vHeYUmRYE8WknU0aGBTKXuXetIKNa8U826MAs=
MIME-Version: 1.0
In-Reply-To: <4E043AE3.2070703@adobe.com>
References: <BANLkTinY1qvV8cFRzuXwzpd1N3-SxCeTjQ@mail.gmail.com>
	<4E043AE3.2070703@adobe.com>
Date: Fri, 24 Jun 2011 11:39:18 -0600
Message-ID: <BANLkTi=YPma_CKG51r0z6QcxfJnmaTz=8w@mail.gmail.com>
Subject: Re: Security Questions
From: ChadDavis <chadmichaeldavis@gmail.com>
To: users@jackrabbit.apache.org
Content-Type: text/plain; charset=ISO-8859-1

Thanks Angela!

>> 3) how do you configure the passowrd for the default admin and
>> anonymous users?
>
> the passwords cannot be configured.
> as far as the anonymous is concerned: this authorizable represents
> the user for 'guestlogin' (GuestCredentials) and login without any
> credentials.
>

If you can't configure the password on the default admin credentials,
how are you supposed to close that security gap.  Is the default admin
intended as a bootstrap admin id?  Can you disable the admin user,
and, if so, how?