Storing password in property file

i have an application which needs to read some values from property file but one problem is
i need to store the password there as well. storing password as a plaintext is not acceptable for this case. is there any suggestion how to do it? and ofcourse this property file needs must be easy to modify.

Instead of storing the password as plaintext you can
just store its digest with an algorithm like MD5 or
SHA. In order to check the user password your
application just have to compute the hash of the user
password and compare it with the stored digest.
In this case, be VERY carrefully with your
implementation: there's a lot of tricks that can
collapse all your application security features.Storing a digest is appropriate if you are trying to implement an authentication mechanism, but I expect the original poster is storing passwords in a properties file so his program can read them in and use them when connecting to external resources.
For such purpose, storing a digest would not be useful. It is this scenario that is discussed in the thread I directed him too.
Regards.

Similar Messages

Problem set parameters of PS (queries stored on a property file)

I am wrinting a small jsp application and storing the queries that it will use in a property file. Some fields on the main form are optional. How I can "build" the query correctly (leaving out the conditions that weren't filled in the form)?
I know it is trivial when you have the query on the page or class, but I can't think of a solution to keep storing the "dynamic" queries on a property file.
Any ideais?

I wanted to store all queries on the same file.
I don't need to retrive the query, I already have it but based on the user decisions it will change. Consider a form with 3 fields: name, id and number, all of them are optional. If the user fills all fields the query will be:
"SELECT id, nm, number
FROM a_table
WHERE id = 10
AND nm = 'foo'
AND num = '843'
ORDER BY nm
If the user fills only the "name" field the query will be:
"SELECT id, nm, number
FROM a_table
AND nm = 'foo
ORDER BY nm
As I said in my first post, it is trivial to this when storing the query on a jsp page or class file, but is it possible to with a property file?
thank you.

How do I load property files and images stored in the jar file?

Hi
So, if I have a structure like this:
/com.myfirm.myproject.SomeClass
/images/
/properties/
And I pack this structure into a jar file, how do I then access the images under "/images/" and the property files under "/properties/"? A link to a good tutorial on this would be perfect, or a description/hint/howto :)

Im having problems even loading direcly from the directory..? I have this structure:
src (source dir)
classes (classes dir)
lang/textRb_en_US.properties (the file I want to load)
Then I have this code:
Locale currentLocale = new Locale("en", "US");
ResourceBundle textRb = ResourceBundle.getBundle("/lang/textRb", currentLocale);But it gives me a "java.util.MissingResourceException: Can't find bundle for base name /lang/textRb, locale en_US". I start my application from within Eclipse, and I have tried to move "lang/textRb_en_US.properties" into the classes dir, but same error.
Im confused as to there Java looks for ressources, and I need this to work no matter where I put my classes/jar. Could you help me out here?

Reading Encrypted Password from Configuration File and Decrypt it at login

Hi All,
My application reads a configuration file to connect to the ORACLE database. The values defined for password are clear text as given below:
user: 'mh'
password='abcd1234'
Is there is any way I can give an encrypted password in the configuration file instead of a clear text file and at the time of login ORACLE decrypts it. I am using ORACLE 11g Database.
My company have a requirement that passwords are not stored in the clear in properties files. the reason being I suppose that if the password is stored in plaintext someone could hit the property file directly, get the password and then connect to the database with it.
For a regular user connecting through an Oracle client or SQL Developer they would need to have the plaintext password in order to connect.
its based on the requirements of
International Standards Organization Guidance
ISO 17799 � 9.5.4 requires password management systems to:
� enforce the use of individual passwords
� allow users to select and change their own passwords if appropriate
� enforce a choice of quality passwords
� force regular changes of passwords
� maintain a record of previous user passwords to prevent re-use
� not display passwords when they are being entered
� store password files separately from application system data
� store passwords in encrypted form using a one way encryption algorithm
� alter default vendor passwords following installation of software
So if I can store the password encrypted using a one way algorithm then hacker/user couldn't decrypt it and then access the database.
I have feeling there is a way of configuring this in Oracle advanced Security, but just can't quite get it to work.
Edited by: user5568473 on 20-May-2013 00:05

So if I can store the password encrypted using a one way algorithm then hacker/user couldn't decrypt it and then access the database.... and neither can your application. Encryption is needed in this case. The decryption must be written into your application. I've written my own in some cases, but finding a library for your development language is a smarter solution.
One alternative is using an Oracle wallet. It doesn't fit every circumstance and does have some maintenance headaches.
You can set up a basic secure password store to encrypt and store the password for a given user@instance combination, and then connect to the database without passing a password. SQL*Net adds in the appropriate password from the wallet for when you connect.
http://www.oracle.com/technetwork/database/security/twp-db-security-secure-ext-pwd-stor-133399.pdf
Advanced Security Option also allows you to set up a Public Key Infrastructure connections (SSL encryption and/or authentication). It also uses a wallet to store the SSL certificates and credentials. I don't have personal experience on this approach.
SSL and the wallet allow you to connect to the database similar to CONNECT/@net_service_name or sqlplus /@net_service_namehttp://docs.oracle.com/cd/B28359_01/network.111/b28530/asossl.htm#CIHCBIEG

Character '\' is lost when reading a String from a property file.

Hi all,
I have encrypted information inside a property file, but when loading properties in my program, the String object used to store the value is changed by the lost of all �\� characters
# EIS password saved in the property file
password=WPLqQE0DlVF8Sg\=\=
#Value loaded in my String object
WPLqQE0DlVF8Sg==
Why is this happening? I use java.util.Properties java class to store and load my properties, and it is supposed to do it with the same encoding (ISO 8859-1).
Please, can someone explain me why this happened and how to solve it?
Best regards.

      public static void main(String[] args) throws IOException {
           OutputStream props = new FileOutputStream("test.properties");
           Properties p = new Properties();
           p.put("password", "pass=word#is!dumb");
           p.put("user", "    I am a Dummy");
           p.store(props, "Java forum demo props file");
           props.close();
           /* Properties file after store
            * user=\    I am a Dummy
            * password=pass\=word\#is\!dumb
           Properties post = new Properties();
           post.load(new FileInputStream("test.properties"));
           for(Iterator it = post.entrySet().iterator(); it.hasNext();)
            System.out.println(it.next());
            * After load from test.properties
            * user=    I am a Dummy
            * password=pass=word#is!dumb
      }Notice that the special chars are only in the file, not actually in the props. If you think otherwise, I don't know what to say. The \ is a special character that is used to escape other special chars, including itself. You can't create a string in java containing only one backslash, as java assumes the next char is being escaped. when you create a string in Java with one backslash, you have to have 2 backslashes. If you are storing data in the property file using something other than store, than you need to ensure that you are escaping all special charachters that the store method does
~Tim

How can you change property files of a EJB at Runtime?

Hi,
I have got an ejb and want to change my variables which I stored in property file at Runtime.
But the property file isn´t in the jar-file of my ejb...
How can I add it.
Or How can I change the property file without new compilation.
Thanks
Uli

Hi Uli,
the previous post is generally correct, but without taking any part in the sensibility of this (there are valid reasons why you would not store the values in a DB) it would be necessary for you to be a bit more specific.
Is your problem that you can not see the file from your EJB or that you don't know how to change a property file entry in general?
Cheers,
Kalle

Read a property file and store it in a hashmap

Hi,
I have tried to read a property file and store it in a hashmap. The property-names should be stored in keys and the property-values (after = symbol) in values of the hashmap. any ideas? Is it possible to do this?

mandy2001ir wrote:
yes, but I need the hashmap for another reason. Actually I'm trying to use the properties file to have a dynamic hachmap. I don't want to change the code anytime I want to put a value in the hashmap. therefor I write the "keys" and "values" in a property file and change the property file. That's the reasn why we have property files, isn't it?What's a "dynamic hashmap"? There's no other kind! Whenever someone starts bandying around the word "dynamic" in contexts like this, it usually means there's a simple solution to their problem, that they haven't yet considered, or mistakenly don't believe is applicable to them, because of this "unique" need for something "dynamic". Trust me, you just need to load the file using a Properties object, and you're done. Properties extends Hashtable, which is virtually the same thing as a HashMap. Properties does exactly what you want it to. it's the very reason the class exists
Have you even looked at the javadoc for java.util.Properties yet? I'm betting not, because if you had, you'd know exactly what I meant. And since you haven't, I'm at a bit of a loss as to how you can so easily dismiss the class as useless, despite existing to do exactly what you need

I have no folder for firefox in application support... where can I find the stored passwords from my time machine back up!!?

Everywhere I look it says I should have a folder for Firefox in library/applicationsupport/ BUT I don't have one! I'm looking to restore passwords from a time machine back up but there's no Firefox folder so I don't where to look. I even did a fresh install of Firefox on my mac and even then it never created a Firefox folder in library/applicationsupport/... they must be store somewhere in my back up...!?

Hello kamilr, check also in :
~/Library/Mozilla/Firefox/Profiles/<profile folder>
The tilde character (~) refers to the current user's Home folder, so ~/Library is the /Macintosh HD/Users/<username>/Library folder.
note that in mac 10.7 and above, the ~/Library folder is hidden by default, see : http://kb.mozillazine.org/Show_hidden_files_and_folders#Mac_OS_X
when you find the file seek for '''key3.db''' and '''signons.sqlite''' files.
Your passwords are stored in two different files, both of which are required:
'''key3.db''' - This file stores your key database for your passwords. To transfer your saved passwords, you must copy this file along with the following file.
'''signons.sqlite''' - Saved passwords
thank you

Set the password for zip file in unix

Hi All,
I have used the below command to zip the file and it is working fine.
cd /YYYY;zip -r ZZZZ.zip ZZZZ.TXT
While using the below command to set the password on zip file , I am getting error like "zip error: Invalid command arguments (encryption not supported)
zip -P password -r ZZZZ.zip ZZZZ.TXT
Can you please help me how to set the password for zip file in UNIX.
Thanks,

Do you use any characters in the password that might confuse the zip command? (like '-' or ';'?)
If I use the command in RHEL4:
cd /tmp
zip -P password -r tt.zip gconfd-oracle
adding: gconfd-oracle/ (stored 0%)
adding: gconfd-oracle/lock/ (stored 0%)
adding: gconfd-oracle/lock/ior (deflated 67%)

How to read a property file..urgent

Hi ,
This is kinda urgent if you can help! I am a new bee to servlet and java.
My JSP calls a java class file. In the class file i establish my connection to database.
My requirement is to read a property file for the database name, username and password and connet to the database using JDBC(database is oracle).
which class to use. I know something about properties class. Is there any other class which can read my property file.
Or is there any other all together a better way to do it.
thanks in advance
Amit

Inside your WAR file somewhere under the WEB-INF directory. This space is protected, whereas the ROOT (of course) is not. Unless you would like someone else to read your properties file...
Once you decide where you want it, post the section of code where you load the properties file, we can probably help you figure out where you path is wrong.

SQL Developer 2.1 removes the stored password in SVN Application Data

Hello everybody
SQL Developer is a great Tool and I use it together with the SVN Versioning System. I also use TortoiseSVN on my Windows XP Operating System, that's why I found out that either the SQL Developer or its SVN Extension has a bug.
I have installed the latest SQL Developer 2.1.0.63.73 and the extension "*Versioning Support for Subversion* 11.1.1.2.36.55.30".
Both Tools the SVN Extension for SQL Developer and the TortoiseSVN save Authentification Data automatically in the same Folder "C:\Documents and Settings\UserXYZ\Application Data\Subversion\auth\svn.simple\" into some Files.
When I use TortoiseSVN, the password can be stored in those mentioned Files. That's very useful, so I don't have to enter my password every time I perform a SVN command. But when I later use SQL Developer and update/commit some file, the password will be removed from the above mentioned Files, even though my Password is stored in the SQL Developer's Subversion Navigator inside the Connection Setup of my Repository.
I would be happy to get some feedback from your point of view. Are there other people who have the same problem?
I turned already to google, but I haven't found a hint that it could be something you can configure in some properties.
Thanks in advance,
Ben

In the meantime I found the solution:
just add those two lines to the *%appdata%\Subversion\config* File
store-auth-creds = no
store-passwords = yes
It looks like the SVN Extension in SQL Developer has different Default Values for the properties than TortoiseSVN has.

Restore Password Manager .pwd File from Backup Image after HDD crash

Hi
After a HDD crash i try to recover my Password Manager pwd File from a Backup Image. In the Image the file is located in "C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Lenovo\Client Security Solution"
But if i try to import it the PW-Manager asks for a Password. But no PW works. Not the Windows PW (same as before) or not the Sec-Chip PW works. I tryed to copy the pwd File into the same folder but it´s not recordniced from the PW Manager.
Can somebody help me please to get my Passwords back?
thanks
Coolskin

Hi,
that saved passwords were stored also in TPM chip, so if Password maanger can not find them there , what is obvious, then I dont think, that this will work.
However it would be a test to install CSS withtou TPM recognision. Uninstall CSS and install CSS with EMULATIONMODE =1, this will install CSS in software emulation mode and do not need to contact with hardware TPM.
To be honest I never tried this scenario, but in if I would be in your situation, then I would test it just to see.
However I don't give it a big chance, that this will work.
Sorry for bad news
Rgrds

Configuration parameter which are stored in automationBuild.xml file

Do you know the correct path for below configuration parameter which are stored in automationBuild.xml file which is kept in src folder of osm project?
<property name="studio.weblogic.home" value=""/>
<property name="studio.java.sdk.home" value=""/>
<property name="studio.osm.sdk.home" value=""/>

Hi Sachin,
Here is the info,
studio.weblogic.home=<Weblogic_Installated Dir>/wlserver_10.3
studio.java.sdk.home= <JDK Installed Dir> +(C:\jdk1.6.0_11, Something like this)+
studio.osm.sdk.home=<OSM Installed Dir>/SDK
Thanks,
Naveen Jabade

I loaded what I guess is the new version of Firefox and it completely changed my whole task bar. I don't have my Norton Logins with stored passwords, and it's hard to find my favorites. Help get it back to how it was.

I loaded what I guess is the new version of Firefox and it completely changed my whole task bar. I don't have my Norton Logins with stored passwords, and it's hard to find my favorites. Help get it back to how it was.

Credit Tony E
To downgrade to Firefox 3.6 first uninstall Firefox 4, but do not select the option to "Remove my Firefox personal data". If you select that option it will delete your bookmarks, passwords and other user data. See https://support.mozilla.com/kb/Uninstalling+Firefox
You can then install the latest version of Firefox 3.6 available from http://www.mozilla.com/en-US/firefox/all-older.html - it will automatically use your current bookmarks, passwords etc.
To avoid possible problems with downgrading, I recommend going to your profile folder and deleting the following files if they exist - extensions.cache, extensions.rdf, extensions.ini, extensions.sqlite and localstore.rdf. Deleting these files will force Firefox to rebuild the list of installed extensions, checking their compatibility, and reset toolbar customizations.
For details of how to find your profile folder see https://support.mozilla.com/kb/Profiles

Credentials for hw_services in jndi property file

Hi All,
I have i doubt regarding the credentials in hw_worklist_jndi.properties file.
My property file includes following entries
java.naming.factory.initial=com.evermind.server.rmi.RMIInitialContextFactory
java.naming.provider.url=ormi://172.16.1.42:12407/hw_services
java.naming.security.principal=admin
java.naming.security.credentials=welcome
dedicated.connection=true
the doubt is : Which user name and password should i give in property file.
Why should i use only the admin user name over there.
Please let me know if i am not clear

Any answer to this?

Storing password in property file

Similar Messages

Maybe you are looking for