Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: neutral (herse.apache.org: 24.24.2.59 is neither permitted nor
 denied by domain of dns4@cornell.edu)
Message-ID: <4681D2A9.3020602@cornell.edu>
Date: Tue, 26 Jun 2007 22:59:53 -0400
From: David Smith <dns4@cornell.edu>
User-Agent: Thunderbird 1.5 (X11/20051201)
MIME-Version: 1.0
To: Tomcat Users List <users@tomcat.apache.org>
Subject: Re: (More) Hiding Password from server.xml
References: <11312799.post@talk.nabble.com>
In-Reply-To: <11312799.post@talk.nabble.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Best I can think of is to write your own class to initialize a db pool 
and pull the password from a file encrypted with the server's public key 
(assuming it has a ssl cert.).  To get  the password from such a file 
requires the server's private ssl key which should be protected like the 
Hope Diamond anyway.

I'll let you do the rest from there or modify it to fit your needs.

--David


jmaltais wrote:
> Hi gang!
>
> I know this has been discussed before.  I want to completely remove the
> password from the server.xml file.  It is only readable by root but that is
> not good enough for me.  
> Some ideas:
> * Hardcoding in a JDBC driver but then it can be taken and used by anybody.
> * What about a subclassed Datasource with the specific login info there? 
> The problem is I don't want to have to always need to build tomcat from
> source.  Anyone have an answer or have tried this before?
>
> More thoughts?
>
> Cheers!
> J
>   


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org