Versions Compared

Old Version 3

changes.mady.by.user Mark Thomas

Saved on

compared with

New Version 4

changes.mady.by.user ASF Infrabot

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Correction: character encoding of server.xml does not matter

...

  • Use properties replacement so that in the xml config you have ${db.password} and in conf/catalina.properties you put the password there. You are not safer, but the auditors may be happy.
  • Since server.xml uses utf-8 encoding - is an XML file — you can use xml XML entities. For example: "woot" becomes "woot" which is a way to obscure the password
  • Write your own datasource implementation which wraps your datasource and obscure your brains out. See the docs on how to do this.
  • (Tomcat 7) Write your own org.apache.tomcat.util.IntrospectionUtils.PropertySource implementation to 'decrypt' passwords that are 'encrypted' in catalina.properties and referenced via ${...} in server.xml. You'll need to set the system property org.apache.tomcat.util.digester.PROPERTY_SOURCE to point to your PropertySource implmentation. This won't provide any real security, it just adds another level of indirection - i.e. 'security by obscurity'.