Improve Network Server security documentation

• Key: DERBY-474
• Type: Improvement
• Status: Closed
• Resolution: Fixed
• Priority: Major
• Assignee: Unassigned
• Reporter: Kathey Marsden
• Component/s: Documentation
• Affects Version/s: 10.2.1.6

Description

The network server security documentation should document security manager permissions needed separate from the example policy file.

The example policy file should separate permissions by jar file.

There should not be examples of starting network server with the -h 0.0.0.0 option without using security manager.

Risks of running outside of security manager and without user authentication should be documented.

Discussion should be included about client encrypted user id password and associated limitations.

The section should mention that there is no data stream encryption with network server.

http://incubator.apache.org/derby/docs/adminguide/tadminnetservrun.html

Comments

[Kathey Marsden]

Documentation should also be updated to have an appropriate warning about using the bootPassword attribute from a client. .

Currently with Network Client embeded attributes are sent as clear text to the server even when encrypted user id and password are specified as the security mechanism.

[Laura Stewart]

Kathey - It seems that some (if not all) of these issues have been addressed.
If that is true, can you please close this issue? If not, please let me know what else needs to be addressed.

[Kathey Marsden]

I think these issues have already been addressed through documentation and product changes.