Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.java.programmer > #39899
| From | Arne Vajhøj <arne@vajhoej.dk> |
|---|---|
| Newsgroups | comp.lang.java.programmer |
| Subject | Re: Alternative for properties like javax.net.ssl.trustStorePassword ... |
| Date | 2023-01-26 16:50 -0500 |
| Organization | A noiseless patient Spider |
| Message-ID | <tqusjt$1bq63$1@dont-email.me> (permalink) |
| References | <slrntt5jd0.pa7s.avl@logic.at> |
On 1/26/2023 1:59 PM, Andreas Leitgeb wrote: > If some java appliation is supposed to use a trustStore, then apparently > all hits on google for the obvious words will suggest to start the application > with an option "-Djavax.net.ssl.trustStorePassword=..." passed to the java > executable... > > Assuming I do not want everyone on the machine to see the password in clear > text in the "ps -ef" output, what would be "safer" alternatives? > > The most obvious one might be to set the property from my own code, (after > reading the pw from a file that not everyone on the machine has access to) > but my code comes too late: some beans already got initialized and didn't > see the property, before the program gets to set the properties. -- > I'm not a master of beans... maybe I could just add another bean that > would do the "setProperty" as a sideeffect just in time before the other > bean needs the property... haven't thought this through, yet. > > Maybe I'm still in the stone-age, and there is already some new property that > would allow me to just specify another file holding the relevant passwords, > or something else? > > Any ideas? Is passing a password as argument to a process nothing to worry > about? A password in visible plain text is at least a potential problem. But there are no miracles. You have some code that are not yours that use this property. Your regular code that runs later cannot change that property when needed. You need to get some code to run before the code using this property. Startup servlet may be too unreliable timing wise. Some googling indicate that a ServletContextListener and doing it in contextInitialized may be better. If everything is using Spring you may be able to sneak some code in via Spring early enough. If they will allow you to use sledgehammer then a Java agent will run before anything! Arne
Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Alternative for properties like javax.net.ssl.trustStorePassword ... Andreas Leitgeb <avl@logic.at> - 2023-01-26 18:59 +0000
Re: Alternative for properties like javax.net.ssl.trustStorePassword ... "e.d.pro...@gmail.com" <e.d.programmer@gmail.com> - 2023-01-26 12:50 -0800
Re: Alternative for properties like javax.net.ssl.trustStorePassword ... Andreas Leitgeb <avl@logic.at> - 2023-01-31 23:30 +0000
Re: Alternative for properties like javax.net.ssl.trustStorePassword ... "e.d.pro...@gmail.com" <e.d.programmer@gmail.com> - 2023-02-01 04:25 -0800
Re: Alternative for properties like javax.net.ssl.trustStorePassword ... Arne Vajhøj <arne@vajhoej.dk> - 2023-01-26 16:50 -0500
Re: Alternative for properties like javax.net.ssl.trustStorePassword ... Andreas Leitgeb <avl@logic.at> - 2023-01-31 23:51 +0000
Re: Alternative for properties like javax.net.ssl.trustStorePassword ... Daniele Futtorovic <da.futt.news@laposte-dot-net.invalid> - 2023-02-08 15:37 +0100
csiph-web