Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've setup my jboss app-server to use SSL. The relevant extract from my config is below. Everything is working ok, however some people have expressed concern over the keystorePass attribute being in plain text. Is there any way to obfuscate / encrypt this value?

I'm using JBoss 4.2.2.GA (on Red Hat Enterprise Edition, if that makes any difference)

<Connector port="8080" 
    protocol="HTTP/1.1" 
    SSLEnabled="true"
    maxThreads="150" 
    scheme="https" 
    secure="true"
    clientAuth="false" 
    sslProtocol="TLS"
    keystoreFile="/somewhere/some.keystore"
    keystorePass="somePassword"
    keyAlias="tomcat"/>

Edit, To get away from the security by obscurity approach, an alternative to obfuscating this would be to not supply it at all and have tomcat prompt for the p/w on startup. However as far as I know this isn't supported. Can anyone confirm or deny this?

share|improve this question
    
While it goes w/o saying, I'm going to say it anyway: Obfuscation / encoding of passwords provides no real security. At best, it's security-by-obscurity which is worse than no security, since it often gives a false sense of security. –  Evan Anderson Feb 17 '10 at 17:32
    
@Evan Anderson, I agree, however some people get nervous at seeing passwords like that. I've edited my question to outline a different approach, which I think is more secure, but as far as I know isn't supported. –  Glen Feb 17 '10 at 17:50

1 Answer 1

up vote 1 down vote accepted

It is possible according to this wiki entry by Anil Saldhana, Lead JBoss Security Architect for JBoss:

http://community.jboss.org/wiki/EncryptKeystorePasswordInTomcatConnector

I have not personally implemented this, but I would imagine Anil knows the subject pretty well.

share|improve this answer
    
Cool! There is also another wiki topic that explains how to do this for data source passwords: community.jboss.org/wiki/encryptingdatasourcepasswords –  Matt Solnit Feb 17 '10 at 18:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.