JDK-5016517 : Replace plaintext passwords by hashed passwords for out-of-the-box JMX Agent
  • Type: Enhancement
  • Component: core-svc
  • Sub-Component: java.lang.management
  • Affected Version: 5.0,9,10
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • OS: generic
  • CPU: generic
  • Submitted: 2004-03-19
  • Updated: 2017-12-16
  • Resolved: 2017-11-28
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 10
10 b36Fixed
Related Reports
Duplicate :  
JDK-6740543 - Add support for encrypted passwords in the jmxremote.password file
Relates :  
JDK-8192909 - Invalid username or password in HashedPasswordFileTest.java
Sub Tasks
JDK-8193315 :  
Release Note: Hashed Passwords for Out-of-the-Box JMX Agent - Closed
Description
Name: mc120937			Date: 03/18/2004


Currently, user/password are stored in cleartext in jmxremote.password
file.  jmxmreote.password file must be read-only by owner only.

Hashing the password is a good refinement scheme and will
also allow sharing of a password file by multiple users 
of a group.

--------------------------------------
Vincent Ryan wrote:

Here are some details on the password hashing mechanism
that's used in the prototype:

   http://developer.netscape.com/docs/technote/ldap/pass_sha.html

The Salted Secure Hash Algorithm (SSHA) mechanism is the default password
storage mechanism used in our LDAP Directory Server product today:

   http://docs.sun.com/source/816-6700-10/aci.html#14932

The one-way hash protects against password disclosure, the salt protects
against pre-computed-hash dictionary attacks.

------------------------

Changes included:
* Replace plaintext passwords by hashed passwords

======================================================================
Comments
Telling a sysadmin to write a few lines of code is very unfriendly, even if it is done with python or other accessible scriptable language.
25-04-2017
One plausible solution would be to let the user provide password in clear text and during authentication process replace clear text password with its hash. Passwords will be in cleartext only till first login or when passsword is changed. For subsequent logins, hash of the password will be compared. Hashed password string must be follow format [<salt>] [<Base64 Encoded hash>] in order to distinguish it from clear text string. This is required to know if user-supplied password must be hashed or not before validation. This helps during first login or when password has been changed and serve as marker that clear text password must be replaced by its hash. This solution is simple and backward compatible and does not require running any tools or pre-setup from user. This solution may not work if password file is write-protected. We can put a recommendation in release notes and JMX guide to grant appropriate permissions so that java process can read/write the password file
14-02-2017
EVALUATION 5016508 will introduce a pluggable authentication mechanism and the currently file based authentication will be converted into a JAAS login module. If a hashed password file, or alternative authentication solution (LDAP for example) is required then these can be configured using properties. ###@###.### 2004-03-22
22-03-2004