[
https://issues.apache.org/jira/browse/CONNECTORS-486?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13431734#comment-13431734
]
Erlend Garåsen commented on CONNECTORS-486:
-------------------------------------------
I suggest that we encrypt the files using AES. DES is not considered to be
sufficient safe enough. The only thing I'm not sure about is whether the U.S.
Export Restrictions hamper this approach. As far as I know, there are some
restrictions in China and Russia about strong encryption in software. When it
comes to open source software, my knowledge is weak.
In order to have a sufficient safe encryption, we should also generate random
keys and store them in the database. I think we should avoid using a static key
for encryption since this approach will be vulnerable for abuse.
Of course, this makes the implementation a little bit more complex. It could be
implemented in the following way:
1. Keys are generated and stored in PG when running
org.apache.manifoldcf.agents.Install
2. This key will be used for encryption and decryption of the exporting and
importing tools respectively
Any comments?
> Optionally export crawler configuration without passwords
> ---------------------------------------------------------
>
> Key: CONNECTORS-486
> URL: https://issues.apache.org/jira/browse/CONNECTORS-486
> Project: ManifoldCF
> Issue Type: Improvement
> Components: Framework agents process
> Reporter: Erlend Garåsen
> Assignee: Erlend Garåsen
> Priority: Minor
> Fix For: ManifoldCF 0.7
>
>
> The "org.apache.manifoldcf.crawler.ExportConfiguration" command class is
> exporting passwords, for instance to the configured Solr server (Solr Output
> Connector). This may be a security problem if the export file is
> version-controlled or placed on a public server.
> We should add an extra "no password" argument to the command class in order
> to skip such passwords.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
