Re: Prevent cleartext keystore/truststore passwords via JMX

2012-04-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Randy, On 4/12/12 8:13 AM, Randy Gray wrote: > Actually, a entry with the correct type attribute was > needed: Could you file an issue in Bugzilla and reference this email thread? Thanks, - -chris -BEGIN PGP SIGNATURE- Version: GnuPG/MacGPG

Re: Prevent cleartext keystore/truststore passwords via JMX

2012-04-12 Thread Randy Gray
Actually, a entry with the correct type attribute was needed: On Thu, Apr 12, 2012 at 2:58 PM, Randy Gray wrote: > Hi, > > I've added mbeans-descriptors.xml to the package > org.apache.tomcat.util.net (the same package where JIOEndpoint is) in > the classpath with this (almost) emp

Re: Prevent cleartext keystore/truststore passwords via JMX

2012-04-12 Thread Randy Gray
Hi, I've added mbeans-descriptors.xml to the package org.apache.tomcat.util.net (the same package where JIOEndpoint is) in the classpath with this (almost) empty content: org.apache.tomcat.util.modeler.Registry looks in the current package down to the parents package, and if it finds a mbeans-

Re: Prevent cleartext keystore/truststore passwords via JMX

2012-04-06 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Randy, On 4/6/12 7:41 AM, Randy Gray wrote: > Hi, > > I've been upgrading from Tomcat 6 to Tomcat 7 (7.27) and I've > noticed that the keystore and truststore passwords are exposed via > JMX in cleartext (in the bean JIoEndpoint). This was not the ca

Prevent cleartext keystore/truststore passwords via JMX

2012-04-06 Thread Randy Gray
Hi, I've been upgrading from Tomcat 6 to Tomcat 7 (7.27) and I've noticed that the keystore and truststore passwords are exposed via JMX in cleartext (in the bean JIoEndpoint). This was not the case in Tomcat 6, for example JIoEndpoint bean which was exposed had much fewer attributes. I have speci