Password connection parameters are stored to the catalog.xml file in plain text.
--------------------------------------------------------------------------------
Key: GEOS-1793
URL: http://jira.codehaus.org/browse/GEOS-1793
Project: GeoServer
Issue Type: Improvement
Components: ArcSDE, Configuration
Affects Versions: 1.6.0-RC3
Environment: Windows XP Pro, SP2. BEA Weblogic Server 9.2, ArcSDE 9.2, deployed geoserver.war exploded, 1.6.0-RC3 initially downloaded and later built from svn co of 1.6.0-RC3.
Reporter: Michael Runnals
Assignee: Andrea Aime
Fix For: 1.6.0-RC3
Attachments: GeoServer1.6.0-RC3_NGC_Security_Fixes_SVNPatch.txt
When configuring an ArcSDE DataStore, the password connection parameter is stored to the geoserver/data/catalog.xml file in plain text. The XMLConfigWriter.storeDataStore() method should be modified to encrypt any connection parameter with the keyword "password". When passwords are stored encrypted, the XML attribute value should be renamed "encryptedValue" as opposed to "value". The XMLConfigReader should then use the corresponding decryption algorithm to decrypt any "encryptedValue" attributes when reading in connection parameters. Note: this will allow for someone to "bootstrap" GeoServer config by hand-editing the connection parameters in the catalog.xml file and replacing any "encryptedValue" attribute with a "value" attribute and setting it to the proper plain text password. This encryption should only take place if a system property is set with the full path to a jks KeyStore containing a Secret Key used for encrypt/decrypt, otherwise passwords will be stored in plain text and a warning level statement to that effect will be logged.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.codehaus.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira