4

Our application server (Apache Tomcat Plume) that use jta-managed data source through tomee.xml file should access database server just in secure (HTTPS) mode with two way ssl or client authentication.
So we have to put keystore and truststore plain passwords into setenv.sh or other places in row format. (I m not sure that is the first and last method to do that?) and what happens is tomcat logging mechanism log all these secret information in plain format into log files like catalina.out.


That what (locating raw passwords in config files) is we do not want. Actually we must ( although it s not appear a big threaten while user have access to files, could find real password atleast), encrypt password and use it in environment variables.

Central Question

In other word, how can we set jvm properties and environment variables in encrypted mode?

1 Answer 1

8

Re: Hide or disable Tomcat command line arguments logging (the title of this question)

This logging is done by VersionLoggerListener it is possible to configure it, or just remove it from configuration (server.xml).

Re: plaintext passwords handling

This is covered in Tomcat FAQ.

A Vault can be used to store secrets.

5
  • Excellent. Thanks brother.
    – Erfankam
    Commented Oct 2, 2018 at 4:48
  • I added -DlogArgs=false in my command line args and i'm still seeing my command line arguments being logged?
    – Chris F
    Commented Jul 12, 2019 at 16:52
  • 1
    How would I add logArgs=false in my server.xml file?
    – Chris F
    Commented Jul 12, 2019 at 19:36
  • 2
    @ChrisF: Replace <Listener className="org.apache.catalina.startup.VersionLoggerListener"/> with thes line if exist: <Listener className="org.apache.catalina.startup.VersionLoggerListener" logArgs="false"/>
    – Erfankam
    Commented Jul 20, 2019 at 12:21
  • Thanks @Erfankam, that's what I ended up doing.
    – Chris F
    Commented Jul 23, 2019 at 16:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.