2:54 p.m.
PATCH: Support obfuscated System Properties
-------------------------------------------
Key: JBAS-8353
URL: https://jira.jboss.org/browse/JBAS-8353
Project: JBoss Application Server
Issue Type: Patch
Security Level: Public (Everyone can see)
Environment: ALL
Reporter: Andrew Oliver
Assignee: Andrew Oliver
when you put -Djboss.sysprop.obfuscation in your run.conf JBOSS_OPTS, the
SecurityIdentityLoginModule decode function is used to decode properties ending in
_OBFUSCATED
i.e.
server/default/conf/test.properties
mypassword_OBFUSCATED=5dfc52b51bd35553df8592078de921bc
server/default/deploy/properties-service.xml
<mbean code="org.jboss.varia.property.SystemPropertiesService"
name="jboss:type=Service,name=SystemProperties">
<attribute name="URLList">
./conf/test.properties
</attribute>
</mbean>
then in your System.getProperties you have:
mypassword password
mypassword_OBFUSCATED 5dfc52b51bd35553df8592078de921bc
So you can then use those properties in your config files with ${mypassword}
you can use the same tool in:
http://community.jboss.org/wiki/EncryptingDataSourcePasswords to obfuscate passwords in
the property file...
This helps you pass dumb security audits that require you to do dumb things that have
nothing to do with security but fake security through needless labor is an industry
standard that we have to live with.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:56 p.m.
New subject: [JBoss JIRA] Updated: (JBAS-8353) PATCH: Support obfuscated System Properties
[
https://jira.jboss.org/browse/JBAS-8353?page=com.atlassian.jira.plugin.sy...
]
Andrew Oliver updated JBAS-8353:
--------------------------------
Attachment: patch
PATCH: Support obfuscated System Properties
-------------------------------------------
Key: JBAS-8353
URL: https://jira.jboss.org/browse/JBAS-8353
Project: JBoss Application Server
Issue Type: Patch
Security Level: Public(Everyone can see)
Environment: ALL
Reporter: Andrew Oliver
Assignee: Andrew Oliver
Attachments: patch
when you put -Djboss.sysprop.obfuscation in your run.conf JBOSS_OPTS, the
SecurityIdentityLoginModule decode function is used to decode properties ending in
_OBFUSCATED
i.e.
server/default/conf/test.properties
mypassword_OBFUSCATED=5dfc52b51bd35553df8592078de921bc
server/default/deploy/properties-service.xml
<mbean code="org.jboss.varia.property.SystemPropertiesService"
name="jboss:type=Service,name=SystemProperties">
<attribute name="URLList">
./conf/test.properties
</attribute>
</mbean>
then in your System.getProperties you have:
mypassword password
mypassword_OBFUSCATED 5dfc52b51bd35553df8592078de921bc
So you can then use those properties in your config files with ${mypassword}
you can use the same tool in:
http://community.jboss.org/wiki/EncryptingDataSourcePasswords to obfuscate passwords in
the property file...
This helps you pass dumb security audits that require you to do dumb things that have
nothing to do with security but fake security through needless labor is an industry
standard that we have to live with.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:58 p.m.
New subject: [JBoss JIRA] Updated: (JBAS-8353) PATCH: Support obfuscated System Properties
[
https://jira.jboss.org/browse/JBAS-8353?page=com.atlassian.jira.plugin.sy...
]
Andrew Oliver updated JBAS-8353:
--------------------------------
Priority: Minor (was: Major)
PATCH: Support obfuscated System Properties
-------------------------------------------
Key: JBAS-8353
URL: https://jira.jboss.org/browse/JBAS-8353
Project: JBoss Application Server
Issue Type: Patch
Security Level: Public(Everyone can see)
Environment: ALL
Reporter: Andrew Oliver
Assignee: Andrew Oliver
Priority: Minor
Attachments: patch
when you put -Djboss.sysprop.obfuscation in your run.conf JBOSS_OPTS, the
SecurityIdentityLoginModule decode function is used to decode properties ending in
_OBFUSCATED
i.e.
server/default/conf/test.properties
mypassword_OBFUSCATED=5dfc52b51bd35553df8592078de921bc
server/default/deploy/properties-service.xml
<mbean code="org.jboss.varia.property.SystemPropertiesService"
name="jboss:type=Service,name=SystemProperties">
<attribute name="URLList">
./conf/test.properties
</attribute>
</mbean>
then in your System.getProperties you have:
mypassword password
mypassword_OBFUSCATED 5dfc52b51bd35553df8592078de921bc
So you can then use those properties in your config files with ${mypassword}
you can use the same tool in:
http://community.jboss.org/wiki/EncryptingDataSourcePasswords to obfuscate passwords in
the property file...
This helps you pass dumb security audits that require you to do dumb things that have
nothing to do with security but fake security through needless labor is an industry
standard that we have to live with.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:28 p.m.
New subject: [JBoss JIRA] Updated: (JBAS-8353) PATCH: Support obfuscated System Properties
[
https://jira.jboss.org/browse/JBAS-8353?page=com.atlassian.jira.plugin.sy...
]
Andrew Oliver updated JBAS-8353:
--------------------------------
JBoss Forum Reference: https://community.jboss.org/thread/155569
PATCH: Support obfuscated System Properties
-------------------------------------------
Key: JBAS-8353
URL: https://jira.jboss.org/browse/JBAS-8353
Project: JBoss Application Server
Issue Type: Patch
Security Level: Public(Everyone can see)
Environment: ALL
Reporter: Andrew Oliver
Assignee: Andrew Oliver
Priority: Minor
Attachments: patch
when you put -Djboss.sysprop.obfuscation in your run.conf JBOSS_OPTS, the
SecurityIdentityLoginModule decode function is used to decode properties ending in
_OBFUSCATED
i.e.
server/default/conf/test.properties
mypassword_OBFUSCATED=5dfc52b51bd35553df8592078de921bc
server/default/deploy/properties-service.xml
<mbean code="org.jboss.varia.property.SystemPropertiesService"
name="jboss:type=Service,name=SystemProperties">
<attribute name="URLList">
./conf/test.properties
</attribute>
</mbean>
then in your System.getProperties you have:
mypassword password
mypassword_OBFUSCATED 5dfc52b51bd35553df8592078de921bc
So you can then use those properties in your config files with ${mypassword}
you can use the same tool in:
http://community.jboss.org/wiki/EncryptingDataSourcePasswords to obfuscate passwords in
the property file...
This helps you pass dumb security audits that require you to do dumb things that have
nothing to do with security but fake security through needless labor is an industry
standard that we have to live with.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:52 a.m.
New subject: [JBoss JIRA] Updated: (JBAS-8353) PATCH: Support obfuscated System Properties
[
https://jira.jboss.org/browse/JBAS-8353?page=com.atlassian.jira.plugin.sy...
]
Andrew Oliver updated JBAS-8353:
--------------------------------
Attachment: jbosssx.jar
patched JBoss 5.02 jbosssx.jar to put in jboss-as/common/lib/ dir overwriting the
existing.
(still testing this patch)
PATCH: Support obfuscated System Properties
-------------------------------------------
Key: JBAS-8353
URL: https://jira.jboss.org/browse/JBAS-8353
Project: JBoss Application Server
Issue Type: Patch
Security Level: Public(Everyone can see)
Environment: ALL
Reporter: Andrew Oliver
Assignee: Andrew Oliver
Priority: Minor
Attachments: jbosssx.jar, patch
when you put -Djboss.sysprop.obfuscation in your run.conf JBOSS_OPTS, the
SecurityIdentityLoginModule decode function is used to decode properties ending in
_OBFUSCATED
i.e.
server/default/conf/test.properties
mypassword_OBFUSCATED=5dfc52b51bd35553df8592078de921bc
server/default/deploy/properties-service.xml
<mbean code="org.jboss.varia.property.SystemPropertiesService"
name="jboss:type=Service,name=SystemProperties">
<attribute name="URLList">
./conf/test.properties
</attribute>
</mbean>
then in your System.getProperties you have:
mypassword password
mypassword_OBFUSCATED 5dfc52b51bd35553df8592078de921bc
So you can then use those properties in your config files with ${mypassword}
you can use the same tool in:
http://community.jboss.org/wiki/EncryptingDataSourcePasswords to obfuscate passwords in
the property file...
This helps you pass dumb security audits that require you to do dumb things that have
nothing to do with security but fake security through needless labor is an industry
standard that we have to live with.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:37 p.m.
New subject: [JBoss JIRA] Updated: (JBAS-8353) PATCH: Support obfuscated System Properties
[
https://jira.jboss.org/browse/JBAS-8353?page=com.atlassian.jira.plugin.sy...
]
Andrew Oliver updated JBAS-8353:
--------------------------------
Attachment: jbosssx.jar
corrected patch for jboss 5.0x
PATCH: Support obfuscated System Properties
-------------------------------------------
Key: JBAS-8353
URL: https://jira.jboss.org/browse/JBAS-8353
Project: JBoss Application Server
Issue Type: Patch
Security Level: Public(Everyone can see)
Environment: ALL
Reporter: Andrew Oliver
Assignee: Andrew Oliver
Priority: Minor
Attachments: jbosssx.jar, jbosssx.jar, patch
when you put -Djboss.sysprop.obfuscation in your run.conf JBOSS_OPTS, the
SecurityIdentityLoginModule decode function is used to decode properties ending in
_OBFUSCATED
i.e.
server/default/conf/test.properties
mypassword_OBFUSCATED=5dfc52b51bd35553df8592078de921bc
server/default/deploy/properties-service.xml
<mbean code="org.jboss.varia.property.SystemPropertiesService"
name="jboss:type=Service,name=SystemProperties">
<attribute name="URLList">
./conf/test.properties
</attribute>
</mbean>
then in your System.getProperties you have:
mypassword password
mypassword_OBFUSCATED 5dfc52b51bd35553df8592078de921bc
So you can then use those properties in your config files with ${mypassword}
you can use the same tool in:
http://community.jboss.org/wiki/EncryptingDataSourcePasswords to obfuscate passwords in
the property file...
This helps you pass dumb security audits that require you to do dumb things that have
nothing to do with security but fake security through needless labor is an industry
standard that we have to live with.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:12 p.m.
New subject: [JBoss JIRA] Updated: (JBAS-8353) PATCH: Support obfuscated System Properties
[
https://jira.jboss.org/browse/JBAS-8353?page=com.atlassian.jira.plugin.sy...
]
Andrew Oliver updated JBAS-8353:
--------------------------------
Description:
when you put -Djboss.sysprop.obfuscation=true in your run.conf JBOSS_OPTS, the
SecurityIdentityLoginModule decode function is used to decode properties ending in
_OBFUSCATED
i.e.
server/default/conf/test.properties
mypassword_OBFUSCATED=5dfc52b51bd35553df8592078de921bc
server/default/deploy/properties-service.xml
<mbean code="org.jboss.varia.property.SystemPropertiesService"
name="jboss:type=Service,name=SystemProperties">
<attribute name="URLList">
./conf/test.properties
</attribute>
</mbean>
then in your System.getProperties you have:
mypassword password
mypassword_OBFUSCATED 5dfc52b51bd35553df8592078de921bc
So you can then use those properties in your config files with ${mypassword}
you can use the same tool in:
http://community.jboss.org/wiki/EncryptingDataSourcePasswords to obfuscate passwords in
the property file...
This helps you pass dumb security audits that require you to do dumb things that have
nothing to do with security but fake security through needless labor is an industry
standard that we have to live with.
was:
when you put -Djboss.sysprop.obfuscation in your run.conf JBOSS_OPTS, the
SecurityIdentityLoginModule decode function is used to decode properties ending in
_OBFUSCATED
i.e.
server/default/conf/test.properties
mypassword_OBFUSCATED=5dfc52b51bd35553df8592078de921bc
server/default/deploy/properties-service.xml
<mbean code="org.jboss.varia.property.SystemPropertiesService"
name="jboss:type=Service,name=SystemProperties">
<attribute name="URLList">
./conf/test.properties
</attribute>
</mbean>
then in your System.getProperties you have:
mypassword password
mypassword_OBFUSCATED 5dfc52b51bd35553df8592078de921bc
So you can then use those properties in your config files with ${mypassword}
you can use the same tool in:
http://community.jboss.org/wiki/EncryptingDataSourcePasswords to obfuscate passwords in
the property file...
This helps you pass dumb security audits that require you to do dumb things that have
nothing to do with security but fake security through needless labor is an industry
standard that we have to live with.
PATCH: Support obfuscated System Properties
-------------------------------------------
Key: JBAS-8353
URL: https://jira.jboss.org/browse/JBAS-8353
Project: JBoss Application Server
Issue Type: Patch
Security Level: Public(Everyone can see)
Environment: ALL
Reporter: Andrew Oliver
Assignee: Andrew Oliver
Priority: Minor
Attachments: jbosssx.jar, jbosssx.jar, patch
when you put -Djboss.sysprop.obfuscation=true in your run.conf JBOSS_OPTS, the
SecurityIdentityLoginModule decode function is used to decode properties ending in
_OBFUSCATED
i.e.
server/default/conf/test.properties
mypassword_OBFUSCATED=5dfc52b51bd35553df8592078de921bc
server/default/deploy/properties-service.xml
<mbean code="org.jboss.varia.property.SystemPropertiesService"
name="jboss:type=Service,name=SystemProperties">
<attribute name="URLList">
./conf/test.properties
</attribute>
</mbean>
then in your System.getProperties you have:
mypassword password
mypassword_OBFUSCATED 5dfc52b51bd35553df8592078de921bc
So you can then use those properties in your config files with ${mypassword}
you can use the same tool in:
http://community.jboss.org/wiki/EncryptingDataSourcePasswords to obfuscate passwords in
the property file...
This helps you pass dumb security audits that require you to do dumb things that have
nothing to do with security but fake security through needless labor is an industry
standard that we have to live with.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:14 p.m.
New subject: [JBoss JIRA] Commented: (JBAS-8353) PATCH: Support obfuscated System Properties
[
https://jira.jboss.org/browse/JBAS-8353?page=com.atlassian.jira.plugin.sy...
]
Andrew Oliver commented on JBAS-8353:
-------------------------------------
note the binary patch only works if you unsign all jboss jars.
PATCH: Support obfuscated System Properties
-------------------------------------------
Key: JBAS-8353
URL: https://jira.jboss.org/browse/JBAS-8353
Project: JBoss Application Server
Issue Type: Patch
Security Level: Public(Everyone can see)
Environment: ALL
Reporter: Andrew Oliver
Assignee: Andrew Oliver
Priority: Minor
Attachments: jbosssx.jar, jbosssx.jar, patch
when you put -Djboss.sysprop.obfuscation=true in your run.conf JBOSS_OPTS, the
SecurityIdentityLoginModule decode function is used to decode properties ending in
_OBFUSCATED
i.e.
server/default/conf/test.properties
mypassword_OBFUSCATED=5dfc52b51bd35553df8592078de921bc
server/default/deploy/properties-service.xml
<mbean code="org.jboss.varia.property.SystemPropertiesService"
name="jboss:type=Service,name=SystemProperties">
<attribute name="URLList">
./conf/test.properties
</attribute>
</mbean>
then in your System.getProperties you have:
mypassword password
mypassword_OBFUSCATED 5dfc52b51bd35553df8592078de921bc
So you can then use those properties in your config files with ${mypassword}
you can use the same tool in:
http://community.jboss.org/wiki/EncryptingDataSourcePasswords to obfuscate passwords in
the property file...
This helps you pass dumb security audits that require you to do dumb things that have
nothing to do with security but fake security through needless labor is an industry
standard that we have to live with.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:16 p.m.
New subject: [JBoss JIRA] Updated: (JBAS-8353) PATCH: Support obfuscated System Properties
[
https://jira.jboss.org/browse/JBAS-8353?page=com.atlassian.jira.plugin.sy...
]
Andrew Oliver updated JBAS-8353:
--------------------------------
Attachment: patch.jar
This version of the patch works even in signed versions of EAP 5.0.2 but you must change
the classname of the system properties service in the config to
com.shadowsoft.patches.SystemPropertyService
PATCH: Support obfuscated System Properties
-------------------------------------------
Key: JBAS-8353
URL: https://jira.jboss.org/browse/JBAS-8353
Project: JBoss Application Server
Issue Type: Patch
Security Level: Public(Everyone can see)
Environment: ALL
Reporter: Andrew Oliver
Assignee: Andrew Oliver
Priority: Minor
Attachments: jbosssx.jar, jbosssx.jar, patch, patch.jar
when you put -Djboss.sysprop.obfuscation=true in your run.conf JBOSS_OPTS, the
SecurityIdentityLoginModule decode function is used to decode properties ending in
_OBFUSCATED
i.e.
server/default/conf/test.properties
mypassword_OBFUSCATED=5dfc52b51bd35553df8592078de921bc
server/default/deploy/properties-service.xml
<mbean code="org.jboss.varia.property.SystemPropertiesService"
name="jboss:type=Service,name=SystemProperties">
<attribute name="URLList">
./conf/test.properties
</attribute>
</mbean>
then in your System.getProperties you have:
mypassword password
mypassword_OBFUSCATED 5dfc52b51bd35553df8592078de921bc
So you can then use those properties in your config files with ${mypassword}
you can use the same tool in:
http://community.jboss.org/wiki/EncryptingDataSourcePasswords to obfuscate passwords in
the property file...
This helps you pass dumb security audits that require you to do dumb things that have
nothing to do with security but fake security through needless labor is an industry
standard that we have to live with.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:18 p.m.
New subject: [JBoss JIRA] Updated: (JBAS-8353) PATCH: Support obfuscated System Properties
[
https://jira.jboss.org/browse/JBAS-8353?page=com.atlassian.jira.plugin.sy...
]
Andrew Oliver updated JBAS-8353:
--------------------------------
Attachment: test.properties
example password in property (password is password)
PATCH: Support obfuscated System Properties
-------------------------------------------
Key: JBAS-8353
URL: https://jira.jboss.org/browse/JBAS-8353
Project: JBoss Application Server
Issue Type: Patch
Security Level: Public(Everyone can see)
Environment: ALL
Reporter: Andrew Oliver
Assignee: Andrew Oliver
Priority: Minor
Attachments: jbosssx.jar, jbosssx.jar, patch, patch.jar, properties-service.xml,
run.conf, test.properties
when you put -Djboss.sysprop.obfuscation=true in your run.conf JBOSS_OPTS, the
SecurityIdentityLoginModule decode function is used to decode properties ending in
_OBFUSCATED
i.e.
server/default/conf/test.properties
mypassword_OBFUSCATED=5dfc52b51bd35553df8592078de921bc
server/default/deploy/properties-service.xml
<mbean code="org.jboss.varia.property.SystemPropertiesService"
name="jboss:type=Service,name=SystemProperties">
<attribute name="URLList">
./conf/test.properties
</attribute>
</mbean>
then in your System.getProperties you have:
mypassword password
mypassword_OBFUSCATED 5dfc52b51bd35553df8592078de921bc
So you can then use those properties in your config files with ${mypassword}
you can use the same tool in:
http://community.jboss.org/wiki/EncryptingDataSourcePasswords to obfuscate passwords in
the property file...
This helps you pass dumb security audits that require you to do dumb things that have
nothing to do with security but fake security through needless labor is an industry
standard that we have to live with.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:18 p.m.
New subject: [JBoss JIRA] Updated: (JBAS-8353) PATCH: Support obfuscated System Properties
[
https://jira.jboss.org/browse/JBAS-8353?page=com.atlassian.jira.plugin.sy...
]
Andrew Oliver updated JBAS-8353:
--------------------------------
Attachment: run.conf
example run.conf adding the required property
PATCH: Support obfuscated System Properties
-------------------------------------------
Key: JBAS-8353
URL: https://jira.jboss.org/browse/JBAS-8353
Project: JBoss Application Server
Issue Type: Patch
Security Level: Public(Everyone can see)
Environment: ALL
Reporter: Andrew Oliver
Assignee: Andrew Oliver
Priority: Minor
Attachments: jbosssx.jar, jbosssx.jar, patch, patch.jar, properties-service.xml,
run.conf, test.properties
when you put -Djboss.sysprop.obfuscation=true in your run.conf JBOSS_OPTS, the
SecurityIdentityLoginModule decode function is used to decode properties ending in
_OBFUSCATED
i.e.
server/default/conf/test.properties
mypassword_OBFUSCATED=5dfc52b51bd35553df8592078de921bc
server/default/deploy/properties-service.xml
<mbean code="org.jboss.varia.property.SystemPropertiesService"
name="jboss:type=Service,name=SystemProperties">
<attribute name="URLList">
./conf/test.properties
</attribute>
</mbean>
then in your System.getProperties you have:
mypassword password
mypassword_OBFUSCATED 5dfc52b51bd35553df8592078de921bc
So you can then use those properties in your config files with ${mypassword}
you can use the same tool in:
http://community.jboss.org/wiki/EncryptingDataSourcePasswords to obfuscate passwords in
the property file...
This helps you pass dumb security audits that require you to do dumb things that have
nothing to do with security but fake security through needless labor is an industry
standard that we have to live with.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:18 p.m.
New subject: [JBoss JIRA] Updated: (JBAS-8353) PATCH: Support obfuscated System Properties
[
https://jira.jboss.org/browse/JBAS-8353?page=com.atlassian.jira.plugin.sy...
]
Andrew Oliver updated JBAS-8353:
--------------------------------
Attachment: properties-service.xml
example for use with patch.jar with system properties service pointing at test.properties
and com.shadowsoft version
PATCH: Support obfuscated System Properties
-------------------------------------------
Key: JBAS-8353
URL: https://jira.jboss.org/browse/JBAS-8353
Project: JBoss Application Server
Issue Type: Patch
Security Level: Public(Everyone can see)
Environment: ALL
Reporter: Andrew Oliver
Assignee: Andrew Oliver
Priority: Minor
Attachments: jbosssx.jar, jbosssx.jar, patch, patch.jar, properties-service.xml,
run.conf, test.properties
when you put -Djboss.sysprop.obfuscation=true in your run.conf JBOSS_OPTS, the
SecurityIdentityLoginModule decode function is used to decode properties ending in
_OBFUSCATED
i.e.
server/default/conf/test.properties
mypassword_OBFUSCATED=5dfc52b51bd35553df8592078de921bc
server/default/deploy/properties-service.xml
<mbean code="org.jboss.varia.property.SystemPropertiesService"
name="jboss:type=Service,name=SystemProperties">
<attribute name="URLList">
./conf/test.properties
</attribute>
</mbean>
then in your System.getProperties you have:
mypassword password
mypassword_OBFUSCATED 5dfc52b51bd35553df8592078de921bc
So you can then use those properties in your config files with ${mypassword}
you can use the same tool in:
http://community.jboss.org/wiki/EncryptingDataSourcePasswords to obfuscate passwords in
the property file...
This helps you pass dumb security audits that require you to do dumb things that have
nothing to do with security but fake security through needless labor is an industry
standard that we have to live with.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:55 p.m.
New subject: [JBoss JIRA] Updated: (JBAS-8353) PATCH: Support obfuscated System Properties
[
https://jira.jboss.org/browse/JBAS-8353?page=com.atlassian.jira.plugin.sy...
]
Andrew Oliver updated JBAS-8353:
--------------------------------
Attachment: patch-50
patch for Branch_5_0
PATCH: Support obfuscated System Properties
-------------------------------------------
Key: JBAS-8353
URL: https://jira.jboss.org/browse/JBAS-8353
Project: JBoss Application Server
Issue Type: Patch
Security Level: Public(Everyone can see)
Environment: ALL
Reporter: Andrew Oliver
Assignee: Andrew Oliver
Priority: Minor
Attachments: jbosssx.jar, jbosssx.jar, patch, patch-50, patch.jar,
properties-service.xml, run.conf, test.properties
when you put -Djboss.sysprop.obfuscation=true in your run.conf JBOSS_OPTS, the
SecurityIdentityLoginModule decode function is used to decode properties ending in
_OBFUSCATED
i.e.
server/default/conf/test.properties
mypassword_OBFUSCATED=5dfc52b51bd35553df8592078de921bc
server/default/deploy/properties-service.xml
<mbean code="org.jboss.varia.property.SystemPropertiesService"
name="jboss:type=Service,name=SystemProperties">
<attribute name="URLList">
./conf/test.properties
</attribute>
</mbean>
then in your System.getProperties you have:
mypassword password
mypassword_OBFUSCATED 5dfc52b51bd35553df8592078de921bc
So you can then use those properties in your config files with ${mypassword}
you can use the same tool in:
http://community.jboss.org/wiki/EncryptingDataSourcePasswords to obfuscate passwords in
the property file...
This helps you pass dumb security audits that require you to do dumb things that have
nothing to do with security but fake security through needless labor is an industry
standard that we have to live with.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:26 p.m.
New subject: [JBoss JIRA] Reopened: (JBAS-8353) PATCH: Support obfuscated System Properties
[
https://issues.jboss.org/browse/JBAS-8353?page=com.atlassian.jira.plugin....
]
Jason Greene reopened JBAS-8353:
--------------------------------
Due to feedback from the community, I have split the AS7 and AS6 projects and reopened all
unscheduled AS6 issues that are a year or less old. This will make it easier community
members to find and work on them.
Future releases beyond 6.1 can be done provided a community member steps up to coordinate
them.
PATCH: Support obfuscated System Properties
-------------------------------------------
Key: JBAS-8353
URL: https://issues.jboss.org/browse/JBAS-8353
Project: Legacy JBoss Application Server 6
Issue Type: Patch
Security Level: Public(Everyone can see)
Environment: ALL
Reporter: Andrew Oliver
Assignee: Andrew Oliver
Priority: Minor
Fix For: No Release
Attachments: jbosssx.jar, jbosssx.jar, patch, patch-50, patch.jar,
properties-service.xml, run.conf, test.properties
when you put -Djboss.sysprop.obfuscation=true in your run.conf JBOSS_OPTS, the
SecurityIdentityLoginModule decode function is used to decode properties ending in
_OBFUSCATED
i.e.
server/default/conf/test.properties
mypassword_OBFUSCATED=5dfc52b51bd35553df8592078de921bc
server/default/deploy/properties-service.xml
<mbean code="org.jboss.varia.property.SystemPropertiesService"
name="jboss:type=Service,name=SystemProperties">
<attribute name="URLList">
./conf/test.properties
</attribute>
</mbean>
then in your System.getProperties you have:
mypassword password
mypassword_OBFUSCATED 5dfc52b51bd35553df8592078de921bc
So you can then use those properties in your config files with ${mypassword}
you can use the same tool in:
http://community.jboss.org/wiki/EncryptingDataSourcePasswords to obfuscate passwords in
the property file...
This helps you pass dumb security audits that require you to do dumb things that have
nothing to do with security but fake security through needless labor is an industry
standard that we have to live with.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
5017
days inactive
5262
days old
13 comments
2 participants
participants (2)
-
Andrew Oliver (JIRA) -
Jason Greene (JIRA)