Secure Database Connection Details In Java App Servers

Question

Our app runs on Tomcat. On startup, we read a properties file that is expected to be at a certain location on the server. Among other things the properties file contains the details for connecting to a database.

Each of our clients have their own instance of the app. It is either hosted by us or is run on a server in their facility.

One of our clients is worried about the password required to connect to the database being stored as plain text in this properties file. A lot of ideas are being discussed in the team about encrypting the password in the file using a shared key or public-private key etc. But none seem like a good solution to me. The fact that a key would have to be hardcoded in the source code seems like a bad idea.

I feel it would be better to prompt the client somehow for a password anytime they start tomcat and let them manually specify the password.

Have you dealt with a similar situation? What solutions have you used.

Thanks.

Ingo · Accepted Answer · 2014-04-30 22:50:51Z

5

You may want to review: http://wiki.apache.org/tomcat/FAQ/Password

That said, any configuration file that does contain a password needs to be appropriately secured. That means limiting access to the file so that it could be read only by the user that Tomcat process runs as and root (or the administrator on Windows).

Hope this helps!

edited Apr 30, 2014 at 22:50

Ingo

1,5821 gold badge10 silver badges31 bronze badges

answered Apr 30, 2014 at 22:44

Mark McBride

662 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Secure Database Connection Details In Java App Servers

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related