<div dir="ltr">Why not do use the same technology like JBoss DataSource password encryption? <a href="http://docs.jboss.org/jbosssecurity/docs/6.0/security_guide/html/Encrypting_Data_Source_Passwords.html">http://docs.jboss.org/jbosssecurity/docs/6.0/security_guide/html/Encrypting_Data_Source_Passwords.html</a></div>
<div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, May 1, 2013 at 3:45 AM, Eli Mesika <span dir="ltr"><<a href="mailto:emesika@redhat.com" target="_blank">emesika@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb"><div class="h5"><br>
<br>
----- Original Message -----<br>
> From: "Alon Bar-Lev" <<a href="mailto:alonbl@redhat.com">alonbl@redhat.com</a>><br>
> To: "engine-devel" <<a href="mailto:engine-devel@ovirt.org">engine-devel@ovirt.org</a>><br>
> Cc: "Yair Zaslavsky" <<a href="mailto:yzaslavs@redhat.com">yzaslavs@redhat.com</a>>, "Eli Mesika" <<a href="mailto:emesika@redhat.com">emesika@redhat.com</a>>, "Juan Hernandez" <<a href="mailto:jhernand@redhat.com">jhernand@redhat.com</a>><br>
> Sent: Tuesday, April 30, 2013 10:41:20 PM<br>
> Subject: Dropping encryption of database password<br>
><br>
> Hello,<br>
><br>
> Currently we store database password encrypted using<br>
> org.picketbox.datasource.security.SecureIdentityLoginModule.<br>
><br>
> This is reverse encryption with common knowledge shared secret.<br>
><br>
> Using encryption with common knowledge shared secret is close to void<br>
> protection.<br>
><br>
> So far we also stored the password as plain text at<br>
> /etc/ovirt-engine/.pgpass, this is going to be removed as no component<br>
> actually uses the .pgpass, however we do need to store non-java specific<br>
> password in for utilities.<br>
><br>
> In master (aiming to 3.3), we store the database connection details in own<br>
> file /etc/ovirt-engine/engine.conf.d/50-setup-database.conf owned by ovirt<br>
> user and not world readable.<br>
><br>
> I would like to use the same 50-setup-database.conf to store plain text<br>
> password and remove the java specific reversible encrypted password usage.<br>
><br>
> Bottom line...<br>
> 1. We drop the .pgpass file.<br>
> 2. We store database connection information in<br>
> /etc/ovirt-engine/engine.conf.d/<file> that is readable only by ovirt usage.<br>
> 3. We drop the java specific reversible encryption in favor of plain text.<br>
><br>
> Thoughts?<br>
<br>
</div></div>I see no problem in the .pgpass , only root can access it (it has 0600 mode , if it doesn't it is ignored by PG)<br>
Apart from that , this is the standard way used by PG so why not using it , AFAIK this is considered safe & secured<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
> Alon<br>
><br>
_______________________________________________<br>
Engine-devel mailing list<br>
<a href="mailto:Engine-devel@ovirt.org">Engine-devel@ovirt.org</a><br>
<a href="http://lists.ovirt.org/mailman/listinfo/engine-devel" target="_blank">http://lists.ovirt.org/mailman/listinfo/engine-devel</a><br>
</div></div></blockquote></div><br></div>