blocks|key|1744502|text|你的问题很常见。在linux中，用户密码存储在纯文本文件中。虽然只存储了密码散列，但如果攻击者获得了该文件的访问权限，他很快就会使用脱机字典攻击发现一些密码。在这种情况下，操作系统依靠文件权限拒绝未经授权的用户访问。在您的情况下，这并没有太大的不同。您必须正确配置密码文件权限，确保服务器的物理安全。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1744503|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Your problem is a common one. In linux, user passwords are stored in a plain text file. Although only the password hashes are stored, if an attacker gets access to that file, he will not take long to discover some password using an offline dictionary attack. In this case, the OS relies on file permissions to deny access to unauthorized users. In your case, it is not much different. You must configure the password file permissions properly and ensure the physical security of the server.

blocks|key|1744517|text|这是一个先有鸡后有蛋的问题。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1744518|然后，您将需要查找存储密钥库密码的位置，依此类推……|1744519|根据您的安全要求和需要，您可以使用对称加密对数据进行加密，并使用客户端证书身份验证通过远程服务器(您的服务器)检索密码。|1744520|或者，您可以使用对称加密对数据进行加密，并将密码硬编码到您的jar中，这是不安全的，但需要一些努力才能找到它，并且您可以将责任委派给文件系统权限，以确定谁可以访问您的文件。|1744521|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|L|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

This is a chicken-egg problem. 
You will then need to to find where to store the password for the keystore and and so on..... 

Depending on your security requirements and needs, you could enrypt the data using symmetric encryption and retrieve the password via a remote server (your server) using client side certificate authentication. 

Or you could encrypt the data using symmetric enryption and have the password hardcoded in your jar, which is not safe but requires some effort to find it and you could delegate responsibility to the file system permissions on who can access your files.

blocks|key|1957919|text|我已经成功地使用了Jasypt的StringEncrytor来加密属性文件中的敏感信息，以及一些内部生成盐和检索密码的过程。由于你正在使用web服务，你可以使用Jasypt的Web+PBE+Configuration在部署时手动输入密码，甚至使用你自己的类似解决方案。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1957920|entityMap|0|LINK|mutability|MUTABLE|url|http://www.jasypt.org/|1|http://www.jasypt.org/api/jasypt/apidocs/org/jasypt/encryption/StringEncryptor.html|2|3|http://www.jasypt.org/webconfiguration.html^0|G|E|9|6|0|G|E|1|28|6|2|2F|L|3|0^^$0|@$1|2|3|4|5|6|7|S|8|@$9|T|A|U|B|C]]|D|@$9|V|A|W|1|X]|$9|Y|A|Z|1|10]|$9|11|A|12|1|13]|$9|14|A|15|1|16]]|E|$]]|$1|F|3|-4|5|6|7|17|8|@]|D|@]|E|$]]]|G|$H|$5|I|J|K|E|$L|M]]|N|$5|I|J|K|E|$L|O]]|P|$5|I|J|K|E|$L|M]]|Q|$5|I|J|K|E|$L|R]]]]

I have had success using <a href="http://www.jasypt.org/" rel="nofollow">Jasypt</a>'s <a href="http://www.jasypt.org/api/jasypt/apidocs/org/jasypt/encryption/StringEncryptor.html" rel="nofollow"><code>StringEncrytor</code></a> to encrypt sensitive information in properties files and some in-house procedures for generating salts and retrieving the password. Since you're using a web service, you could use Jasypt's <a href="http://www.jasypt.org/webconfiguration.html" rel="nofollow">Web PBE Configuration</a> to manually enter the password at deploy time or even roll your own similar solution.

blocks|key|1744654|text|底线是某个地方需要以未加密的形式拥有“链的根”密码。受操作系统保护的本地文件、受操作系统保护的远程文件、在源代码中硬编码的文件等。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1744655|解决这个问题的唯一方法是要求用户在应用程序启动时输入初始密码，这对于需要自动启动的应用程序来说显然是不可能的。|1744656|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

The bottom line is that somewhere needs to have the "root-of-the-chain" password in an unencrypted form. An OS-protected local file, an OS-protected remote file, hardcoded in the source, etc. 

The only way around that is to require a human to type the initial password at application start, which obviously isn't possible for applications which need to autostart.

I have a java properties object with authentication information for a web service.
I need to encrypt that data, but I don't know where I need to store the encryption key for it to remain secure.

What are the best practices around encrypting this data and retrieving it in a secure way?

Is there any advantage to using a keystore?

<pre><code>ws_user=username
ws_password=password
ws_url=https://www.whatever.com/myservice
</code></pre>

How do I securely store encryption keys in java?

身份验证

对称加密

文件系统

服务器

我有一个带有web服务身份验证信息的java属性对象。我需要对数据进行加密，但我不知道需要将加密密钥存储在哪里才能保证数据的安全。对此数据进行加密并以安全的方式检索数据的最佳实践是什么？使用密钥库有什么好处吗？ws_user=usernamews_password=passwordws_url=https://www....

问如何在java中安全地存储加密密钥？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在java中安全地存储加密密钥？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在java中安全地存储加密密钥？
EN