[jira] Commented: (GERONIMO-342) Expose embedded Derby to network clients

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view

[jira] Commented: (GERONIMO-342) Expose embedded Derby to network clients

Development mailing list
    [ http://issues.apache.org/jira/browse/GERONIMO-342?page=comments#action_12314116 ]

John Sisson commented on GERONIMO-342:

Including mail conversation from Jan 2005 in relation to security issues.

Jeremy Boynes <[hidden email]> wrote on 31/01/2005 10:33:58 AM:

> [hidden email] wrote:
> > Derby's DRDA (Distributed Relational Database Architecture) Network Server
> > by default only listens for connections on the loopback address (which
> > a good default) and does not have authentication turned on.
> > Therefore on a multiuser O/S this level of security seems inadequate
> > any user on the localhost could connect to it using the DB2 Universal
> > Connector (specifying any userid and password as it will be ignored by the
> > server) and start creating databases/tables etc.
> >
> Hmm - I thought that a username and password had to be supplied for a network connection.

Yes, the IBM JCC driver forces you to specify a userid and password, but
the username and password is only validated on the server if
authentication is turned on.  By default authentication is turned off.
Also the username is used as the current schema for the connection.   See:


Also for authorization, by default users are given read/write access
(fullAccess) :



> > Q1. Are there any plans on how a default Geronimo configuration would
> > secure the embedded Derby Network Server?
> >
> At the moment we are relying on Derby database security. Ultimately I
> hope to integrate that into the JACC authentication providers used by
> the rest of the container, and have a dream at some point of integrating

> Derby's authorization with the JACC policy provider.
> > Q2. What would be the best way to restrict the remote IP addresses that
> > Derby will accept connections from (e.g. particular IP addresses)? Should
> > a policy file be used and passed to the JVM when starting Geronimo (see
> > http://incubator.apache.org/derby/manuals/admin/hubprnt30.html ) or is

> > there a better way for Geronimo?
> I haven't looked at that.
> > Q3. Should we have some simple authentication enabled by shipping a

> >
> > geronimo\var\derby\derby.properties file that has something like the
> > following?
> >
> > #
> > #Security settings
> > #
> > derby.connection.requireAuthentication=true
> > derby.authentication.provider=BUILTIN
> > #
> > # User and password list for Derby BUILTIN authentication provider
> > #
> > derby.user.system=manager
> > derby.user.myapp=myapppswd
> >
> I would prefer not to and at least integrate with the user/password
> realm we use for securing JMX remoting - that would mean in the default
> case the usernames/passwords would be the same. Of course, an admin
> could also set up a separate realm for the database.
> --
> Jeremy

> Expose embedded Derby to network clients
> ----------------------------------------
>          Key: GERONIMO-342
>          URL: http://issues.apache.org/jira/browse/GERONIMO-342
>      Project: Geronimo
>         Type: New Feature
>     Reporter: Jeremy Boynes
>     Assignee: Jeremy Boynes

> Derby provides a network server that allows access from external clients as well as in-VM usage. We should integrate this as a GBean with exposed management attributes for network and port address. Some form of security might be in order too :)

This message is automatically generated by JIRA.
If you think it was sent incorrectly contact one of the administrators:
For more information on JIRA, see: