[CONNECTORS-1327] Put obfuscation password in an external file

• Type: Improvement
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: ManifoldCF 2.4
• Fix Version/s: ManifoldCF next
• Component/s: Framework core
• Labels: security
• Flags: Patch
• Assignee: Karl Wright
• Reporter: Aurélien
• Created: 22/Jul/16 14:12
• Updated: 05/Apr/17 12:05

Description

It seems that the obfuscation tool uses a symmetric encoding with password and salt to obfuscate/deobfuscate passwords. I can see that there is a way to change the salt with a property, but it seems that the password is hardcoded in the source code.In order to try to improve security in MCF, I would like to be able to store the password (that is currently hardcoded) used for obfuscation in a specific configuration file. The aim of this approach is to be able to change it but also to be able to add specific linux access right on it.