[MNG-553] Secure Storage of Server Passwords

• Type: New Feature
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.0-alpha-3
• Fix Version/s: 2.1.0, 3.0-alpha-3
• Component/s: Settings
• Environment: Although it may not be relevant since this is a general improvement issue, Windows XP, JDK 1.4.1.
• Assignee: Olle Jonsson
• Reporter: J. Michael McGarr
• Created: 06/Jul/05 08:35
• Updated: 06/Apr/15 01:53
• Resolved: 17/Feb/09 14:25

Description

This was a question pose to the Maven User's Group and it was suggested I add it here.

It would be benefitial to provide a more secure means of storing password's to the servers listed in the .m2/settings.xml. They are currently being stored as plain text and could definately be considered a security breach. Numerous organizations would undoubtedly considered this an unacceptable security risk, and this could prevent widespread adoption of Maven2.

I would suggest leaving an option to encrypt the password into the settings file (more secure, but not foolproof) or even requiring the password to be manually provided per build (would prevent automation of builds). I am sure that there is a secure solution to this problem and it should be part of the 2.0 release.

Issue Links

• is related to: MDEPLOY-51 Prompt for username and password if not supplied
• is related to: WAGON-52 wagon-webdav does not ask for auth password when <username>...</username> is missing
• relates to: MNG-4082 Encryption is triggered if passwords merely contain curly braces
• relates to: MNG-4459 [regression] Effective settings as visible to plugins contain plain text passwords
• relates to: MNG-4033 Introduce password encryption to the trunk

Sub-Tasks

• Use plexus-sec-dispatcher 1.0 in Maven core when it is released: Closed