Securing the JASS CONF file

Question

Hi,
I have put the JASS conf file as a resource in a signed JAR file. I did this so someone cannot alter this file. I also set the location of the file in the code right before I use it by setting the environment variable java.security.auth.login.config. Can anyone find a hole in this technique? The other option is to set the location as a URL on the web server and set the location of the file by using the environment variable java.security.auth.login.config.
Thanks,
- Bob

Answer 1

Thanks for your reply. Do you have any specifics on
how the JAAS conf file in a signed jar could be
hacked.The security issues of client-side JAAS have been brought up several times in this forum. Securing the config file as you do it eliminates the easiest way of replacing a login module on the client, but I remember another forum message where the author replaced the related login module in rt.jar by his own, malicious implementation. You cannot prevent that with your approach.
Another other issue (not security-related) with the client-side JAAS config, delivered in a signed JAR, is that you are giving up one key advantage of JAAS, the ease of exchanging the authentication mechanism.
Accessing it via a (secure) web connection from the server is a way to address that, though, as you suggest.