tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Jason Pyeron" <>
Subject RE: [tomcat-users] Password encryption in Tomcat 8.5.35
Date Mon, 16 Sep 2019 04:20:45 GMT
While there is no real value in doing so - you can provide your own datasource factory class.

This class should extend the provided datasource, and would use a "method" to decrypt the
password field.

Keep in mind as you have described, the decryption mechanism(s) would be just as available
to the attacker as the context.xml. We frequently have to reverse engineer such passwords
for our customers.

Now, if the decryption method obtains information from a "password oracle source", you could
end up with your implied security goals. We strive to obtain such keys from TPMs, Smart Cards,
networked sources, etc.


Jason Pyeron

> -----Original Message-----
> From: Mohan T <>
> Sent: Monday, September 16, 2019 12:05 AM
> To:
> Subject: [tomcat-users] Password encryption in Tomcat 8.5.35
> Hi,
> We are using tomcat 8.5.35, on Red Hat Enterprise Linux Server release 7.4.
> Is it possible to encrypt or mask passwords that is being used in the datasource for
connecting to
> database. I am mentioning the credentials in server.xml
> Thanks
> Mohan
> DISCLAIMER: This communication contains information which is confidential and the copyright
of Ramco
> Systems Ltd, its subsidiaries or a third party ("Ramco"). This email may also contain
> privileged information. Confidentiality and legal privilege attached to this communication
are not
> waived or lost by reason of mistaken delivery to you.This email is intended to be read
or used by the
> addressee only. If you are not the intended recipient, any use, distribution, disclosure
or copying of
> this email is strictly prohibited without the express written approval of Ramco. Please
delete and
> destroy all copies and email Ramco at immediately. Any views expressed
in this
> communication are those of the individual sender, except where the sender specifically
states them to
> be the views of Ramco. Except as required by law, Ramco does not represent, warrant and/or
> that the integrity of this communication has been maintained nor that the communication
is free of
> errors, virus, interception or interference. If you do not wish to receive such communications,
> forward this communication to and express your wish not to receive
> communications henceforth.

To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message