Skip to main content

Encrypting your jndi data source in Tomcat

I was shocked to discover at my new gig that the database password that Tomcat loaded up into JNDI were not encrypted on the live site.  I was even more shocked that Tomcat does not provide a quick fix for this.

So here's mine.  Encode the password in your text file, and figure out where the below goes in your code:


    /**
     * Get a DataSource for the given JNDI name (with caching of lookups)
     *
     * @param dataSourceJNDIName The DataSource name
     * @return A DataSource for JNDI name 'dataSourceJNDIName', or null if the
     * lookup fails.
     */
    public static DataSource getDataSource(String dataSourceJNDIName)
    {
        DataSource dataSource = null;
        if (null != dataSourceJNDIName) {
            dataSource = (DataSource)dataSourceCache.get(dataSourceJNDIName);
            if (null == dataSource) {
                try {
                    dataSource = (DataSource) jndiContext.lookup(JNDI_PREFIX + dataSourceJNDIName);
                    //cast the datasource to the Apache BasicDataSource class
                    BasicDataSource bds=(BasicDataSource)dataSource;
                    //decrypt the password
                    bds.setPassword(EncryptionHelper.decode(bds.getPassword()));
                    Logs.debug(JNDI_PREFIX + dataSourceJNDIName + " returns " + dataSource);
                    if (null != dataSource) {
                        dataSourceCache.put(dataSourceJNDIName, dataSource);
                    }
                } catch (NamingException name) {
                    Logs.error("Naming exception (" + name + ") on lookup of '"
                        + dataSourceJNDIName + "'.");
                }
            }
        }
        return dataSource;
    }
    

Comments

Unknown said…
It is really not a concern. If they get to ur datasource files, they have already penetrated ur network. Next it is not encryption it is encoding, base 64. Not a difficult thing to hack just one iteration. So it is wrong info. Not accurate info being shared by u.
1:48 PM
Dan Fishman said…
You want to encrypt the DB password so that when the web server is hacked, it doesn't give up the keys to the DB. The webserver is outward facing, the DB should not be. Keeping the passwords encrypted makes sense.

Regarding the encryption method, I agree -- use something stronger that base64. I just threw that in there as an example.
7:25 PM
Post a Comment

Popular posts from this blog

October is Cyber Security Month

The President has declared October as Cybersecurity month.  It's not a bad idea -- just like you change the batteries in your smoke detectors once a year, maybe you should review your electronic vulbnerabilities? My top ten security tips: 1) Change your passwords.  You've had them too long, you use the same password in too many places.  Somewhere someone has hacked a site that has your username and password in plain text.  Now they are getting ready to try that username/password somewhere else.  Beat them to the punch. 2) Use a safe browser.  That means anything that's not Internet Explorer.   I prefer chrome. 3) Use 2 step verification for your email account.  If your email doesn't provide 2 step authentication consider switching. 4) Get a free credit report  and review it.  You are entitled to one free report a year.   BE VERY CAREFUL!  There are man scam sites that offer free credit reports.  Go through the s...
16 comments
Read more

So You're Looking for Work in Tech

So You're Looking for Work in Tech It's a more competitive market than it's ever been—but don't despair! There are still plenty of jobs out there for humans who can demonstrate insight, creativity, and the ability to execute. Here's a practical guide to help you prove you can do just that. 0. File for Unemployment (If Applicable) If you were recently laid off, file for unemployment right now . This won’t help your job search directly, but it will help you financially. Get that support—you earned it. 1. Buy a Domain and Invest in Yourself If you don’t own a domain, buy one today. Get a GSuite (Google Workspace) account and start using a professional email like yourname@yourdomain.com . Avoid using email services like GoDaddy, Zoho, or Office365. Google is the gold standard—invest in the best. 2. Hire Yourself Give yourself a tech project—because this is your job now. Choose a project that will add value to your life while forcing you to learn new ...
4 comments
Read more

Using hosts.deny against bad guys.

Executive Summary: This article details how to minimize hack attempts on open facing ports on a *nix machine, by reading the attackers IP addresses from a log file, and adding the address to hosts.deny Chances are pretty good if you've got a port open to the internet you're seeing unwanted traffic on it. If you've got a service such as telnet or FTP or POP that transmits passwords unencrypted, you're significantly at risk for a breach from a packet being intercepted, but even if you're using a secure protocol such as SSH, you're vulnerable to a brute force attempt to break into your site. As an example, here is a sample of a log file showing a break-in attempt on one of my servers: Oct 8 13:54:18 chapelle sshd(pam_unix)[4554]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.13.157.12 Oct 8 13:54:22 chapelle sshd(pam_unix)[4557]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.13.157.12 Oct 8 13:54:27 chapelle ssh...
3 comments
Read more