[ http://issues.apache.org/jira/browse/DERBY-1056?page=comments#action_12368012 ]
Kathey Marsden commented on DERBY-1056: --------------------------------------- That sounds good as at least that would be a clear issue. I think also as you say it would be good to explore this scenario more fully to see if security manager would also be needed in such a scenario. Enabling such a warning would make DERBY-474 all the more important as users are bound to have questions once the warning starts showing up. > Print a security warning to derby.log and network server console if network > server is started with remote connections enabled and security manager, user > authentication, and ecrypted userid are not on > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- > > Key: DERBY-1056 > URL: http://issues.apache.org/jira/browse/DERBY-1056 > Project: Derby > Type: Improvement > Components: Network Server, Security > Reporter: Kathey Marsden > Fix For: 10.2.0.0 > > Information and questions from the user list seem to indicate that often > users enable remote connections by starting network server with the -h > 0.0.0.0 or -h <machinename> option without taking proper security measures. > I think it would be worthwhile to print a security warning the console and > derby.log if network server is starated without the proper security in place. > Serious security issues exist when starting network server and allowing > remote connections unless users: > - Run in security manager with permissions restricted as much as possible. > - Enable user authentication > - Use encrypted userid/password (Currently only available with IBMJCE) > - Maybe also print a warning if bootPassword is sent in the > connectionAttributes, since this cannot be encrypted. (I had thought there > was a jira issue for this but can't find it.) > An example of such an attack might include creating databases until the host > machine disk filled up, deleting all user data etc. > Related issues: > DERBY-65 > DERBY-474 > DERBY -528 > DERBY-962 -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira
