> -----Original Message----- > From: André Warnier [mailto:a...@ice-sa.com] > Sent: Tuesday, February 12, 2013 3:47 AM > To: Tomcat Users List > Subject: Re: Need to Specify keystorePass on Command Line > > Harris, Jeffrey E. wrote: > > > > All, > > > > I understand that there is no good, secure solution. However, my > hands are tied on this matter, and I would appreciate if you would > focus on providing technical assistance in implementing a solution > within the constraints I have been given. > > > Jeffrey, > > We all understand that you have been given rules, and are supposed to > follow them. > But if these rules themselves make no logical sense, nothing in this > Universe is going to help you overcome that. > > What is the concern really, about the password remaining somewhere on > that server when the system is shut down ? > Is it that the server, in its shut down state, could be subrepticiously > broken apart, its disk stolen and then inspected by foreign spooks to > discover that password, which could then be used to further nefarious > ends, or what /exactly/ ? > > What is wrong with the following scenario : > - a physical Windows server with a console and a keyboard > - boot Windows and login as a "tomcat" user (created beforehand) > - open a command window > - start Tomcat as an application (not a Service) in that command window > - tomcat will ask for the passphrase of the keystore. Type it in. (*) > - when Tomcat is running, enter CTRL-ALT-DEL and freeze the console (do > not logout from > Windows) > - walk away > > > (*) having made sure beforehand that there is no trojen on that machine > which records your > keystrokes and writes them to the disk > > --------------------------------------------------------------------- > To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org > For additional commands, e-mail: users-h...@tomcat.apache.org
Andre, Tomcat will host a web-app that will connect as a proxy to another organization's system to retrieve data that we will use in our applications. It is the other organization that is mandating the "no password" requirement, and there is no other option than to use their data. Our customer requires that the Tomcat server be up 24/7 (with minor outages), hence the need to design a solution that satisfies the requirements of both our customer, and the other organization. Obviously, if we cannot create a way to automate the process, we may have to do something akin to what you do above. However, when I run Tomcat from the console, I am never prompted for the password. Instead, Tomcat just fails to start the listener on the specified SSL port. This e-mail and any attachments are intended only for the use of the addressee(s) named herein and may contain proprietary information. If you are not the intended recipient of this e-mail or believe that you received this email in error, please take immediate action to notify the sender of the apparent error by reply e-mail; permanently delete the e-mail and any attachments from your computer; and do not disseminate, distribute, use, or copy this message and any attachments. --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
