Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.kamp.net!newsfeed.kamp.net!feeder1.cambriumusenet.nl!82.197.223.108.MISMATCH!feeder2.cambriumusenet.nl!feed.tweaknews.nl!217.73.144.44.MISMATCH!ecngs!feeder.ecngs.de!Xl.tags.giganews.com!border1.nntp.ams.giganews.com!nntp.giganews.com!local2.nntp.ams.giganews.com!nntp.bt.com!news.bt.com.POSTED!not-for-mail NNTP-Posting-Date: Thu, 04 Sep 2014 09:12:52 -0500 From: "Chris Uppal" Newsgroups: comp.lang.java.programmer References: Subject: Re: java unix domain sockets ... or substitute Date: Thu, 4 Sep 2014 15:11:04 +0100 X-Priority: 3 X-MSMail-Priority: Normal X-Newsreader: Microsoft Outlook Express 6.00.2900.5512 X-RFC2646: Format=Flowed; Original X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512 Message-ID: Lines: 30 X-Usenet-Provider: http://www.giganews.com X-AuthenticatedUsername: NoAuthUser X-Trace: sv3-X1VdKbDjoQALoL0mZc2OUVfU8RykWDQS/LSrNaymNdbUYP+duGaGw77aldCy//NdwN190K/gGkP1sAb!5eeTV5Z5UlyXC8BZ+n0EVX0f36hwsKxnnLtKr9uXyrKhjVzcIGdgnxUTzNEBSf8SHF4zhY/capc= X-Complaints-To: abuse@btinternet.com X-DMCA-Complaints-To: abuse@btinternet.com X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly X-Postfilter: 1.3.40 X-Original-Bytes: 2586 Xref: csiph.com comp.lang.java.programmer:29906 Andreas Leitgeb wrote: > - a way to negotiate a bidirectional channel between a client and > the server that doesn't involve creating pipe nodes in the > filesystem. Seems quite obvious that this calls for the server to listen on a local TCP/IP port (and probably only accept incoming connections from localhost), then layer whatever kind of security you want over that. If you must use Unix group permissions, then Nigel Wade's suggestion of having the server write a random number to a file that only it can write and only they can read, and using that for validation, seems adequate. But note that that is vulnerable to network sniffing. But that may not matter to you. Even if not, I'd be inclined to change the number after each connection attempt (sucessfull or not), and have the clients retry in case of failure (race conditions, etc). A better solution for many (most?) purposes would be to use SSL/TLS instead of raw TCP/IP. The server would need a certificate, but you could use a self-signed cert. If you go that route then you could still use Nigel's idea to validate by group, or you could set up your own password system that was submitted/checked over SSL. Alternatively you could use client certificates at the SSL level. A lot -- in fact everything -- depends on what /kind/ of security you want, and how /much/ security you want. -- chris