Why not do use the same technology like JBoss DataSource password encryption? http://docs.jboss.org/jbosssecurity/docs/6.0/security_guide/html/Encrypting_Data_Source_Passwords.html
On Wed, May 1, 2013 at 3:45 AM, Eli Mesika <emes...@redhat.com> wrote: > > > ----- Original Message ----- > > From: "Alon Bar-Lev" <alo...@redhat.com> > > To: "engine-devel" <engine-devel@ovirt.org> > > Cc: "Yair Zaslavsky" <yzasl...@redhat.com>, "Eli Mesika" < > emes...@redhat.com>, "Juan Hernandez" <jhern...@redhat.com> > > Sent: Tuesday, April 30, 2013 10:41:20 PM > > Subject: Dropping encryption of database password > > > > Hello, > > > > Currently we store database password encrypted using > > org.picketbox.datasource.security.SecureIdentityLoginModule. > > > > This is reverse encryption with common knowledge shared secret. > > > > Using encryption with common knowledge shared secret is close to void > > protection. > > > > So far we also stored the password as plain text at > > /etc/ovirt-engine/.pgpass, this is going to be removed as no component > > actually uses the .pgpass, however we do need to store non-java specific > > password in for utilities. > > > > In master (aiming to 3.3), we store the database connection details in > own > > file /etc/ovirt-engine/engine.conf.d/50-setup-database.conf owned by > ovirt > > user and not world readable. > > > > I would like to use the same 50-setup-database.conf to store plain text > > password and remove the java specific reversible encrypted password > usage. > > > > Bottom line... > > 1. We drop the .pgpass file. > > 2. We store database connection information in > > /etc/ovirt-engine/engine.conf.d/<file> that is readable only by ovirt > usage. > > 3. We drop the java specific reversible encryption in favor of plain > text. > > > > Thoughts? > > I see no problem in the .pgpass , only root can access it (it has 0600 > mode , if it doesn't it is ignored by PG) > Apart from that , this is the standard way used by PG so why not using it > , AFAIK this is considered safe & secured > > > > Alon > > > _______________________________________________ > Engine-devel mailing list > Engine-devel@ovirt.org > http://lists.ovirt.org/mailman/listinfo/engine-devel >
_______________________________________________ Engine-devel mailing list Engine-devel@ovirt.org http://lists.ovirt.org/mailman/listinfo/engine-devel