3

I want to digest/encrypt tomcat's server.xml password. I have seen several codes in the internet which leads me to add factory inside Resource tag as you see below. Unfortunately I have Atomikos already added in the factory whick do not allow me to add second factory.

Could you please help me a second way in order to use encrypted password in the server. xml or do you know a way to add a second factory in the Resource tag of server.xml ?

If my question is not clear, I would give more examples. Any help is appreciated. Thanks.

<Resource auth="Container" driverClassName="net.sourceforge.jtds.jdbc.Driver" factory="com.atomikos.tomcat.EnhancedTomcatAtomikosBeanFactory" 
maxPoolSize="50" minPoolSize="1" name="global/EFaturaDS" testQuery="SELECT 1" type="com.atomikos.jdbc.nonxa.AtomikosNonXADataSourceBean" 
uniqueResourceName="global/EFaturaDS" url="jdbc:jtds:sqlserver://localhost:8080/application;instance=APP08;charset=cp1254;" />
Matías Cánepa
  • 5,770
  • 4
  • 57
  • 97
Tonyukuk
  • 5,745
  • 7
  • 35
  • 63
  • When you say tomcat's server.xml password, what exactly do you mean? There are a few potential passwords that you could be referring to. Also, scrubbing your `server.xml` and posting it here would go a long way in helping us help you. – rmlan May 05 '16 at 15:01
  • hello rmian. I meant the db password which resides in tag at server.xml. Such like – Tonyukuk May 06 '16 at 06:38

1 Answers1

4

This short answer is no: you cannot encrypt your password in your server.xml file. For the longer answer, you should read Tomcat's wiki page on passwords in configuration files.

Here is the relevant part answering the question "Why are plain text passwords in the config files?"

Because there is no good way to "secure" them. When Tomcat needs to connect to a database, it needs the original password. While the password could be encoded, there still needs to be a mechanism to decode it.

It goes on to explain in detail why this is only possible if you wrongly convince yourself that you are improving security, and why the Tomcat developers won't go out of their way to help you do it.

There is a section on how to "just do it" if you have an overly heavy-handed security assessment that you need to pass and just need to get it done, even though it does not protect you in any meaningful way.

Mark Rotteveel
  • 100,966
  • 191
  • 140
  • 197
Christopher Schultz
  • 20,221
  • 9
  • 60
  • 77
  • does it protect you from someone glancing over your shoulder once at an inopportune time? If so, that's a non-zero amount of protection. – charley Jan 17 '19 at 19:07