Sun Microsystems 820433510 Managing Security of Passwords

Formore information on using certutil,pk12util, and other NSS security tools, see NSS
SecurityTools at http://www.mozilla.org/projects/security/pki/nss/tools.
Managing Security of Passwords
Inthe Enterprise Server, the le domain.xml, which contains the specications for a particular
domain,initially contains the password of the Message Queue broker in clear text. The element
inthe domain.xml le that contains this password is the admin-password attribute of the
jms-hostelement. Because this password is not changeable at installation time, it is not a
signicantsecurity impact.
However,use the Admin Console to add users and resources and assign passwords to these
usersand resources. Some of these passwords are written to the domain.xml le in clear text, for
example,passwords for accessing a database. Having these passwords in clear text in the
domain.xmlle can present a security hazard. You can encrypt any password in domain.xml,
includingthe admin-password attribute or a database password. Instructions for managing the
securitypasswords is included in the following topics:
■“Encryptinga Password in the domain.xml File” on page 99
■“ProtectingFiles with Encoded Passwords” on page 100
■“Changingthe Master Password” on page 100
■“Workingwith the Master Password and Keystores” on page 101
■“Changingthe Admin Password” on page 101
Encrypting a Passwordin the domain.xml File
Toencrypt a password in the domain.xml le. Follow these steps:
1. Fromthe directory where the domain.xml le resides (domain-dir/config by default), run
thefollowing asadmin command:
asadmin create-password-alias --user admin alias-name
Forexample,
asadmin create-password-alias --user admin jms-password
Apassword prompt appears (admin in this case). Refer to the man pages for the
create-password-alias,list-password-aliases,delete-password-aliascommands
formore information.
2. Removeand replace the password in domain.xml. This is accomplished using the asadmin
setcommand. An example of using the set command for this purpose is as follows:
asadmin set --user admin server.jms-service.jms-host.
default_JMS_host.admin-password=’${ALIAS=jms-password}’
ManagingSecurity of Passwords
Chapter9 •Conguring Security 99