[
https://issues.apache.org/jira/browse/MNG-5583?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16403301#comment-16403301
]
Christopher Tubbs commented on MNG-5583:
----------------------------------------
I would encourage the Maven community to consider addressing this issue...
because the current implementation can expose JSSE system properties to other
users, which could expose private credentials. Being able to connect to a
secure Maven repository server may not be a high priority for users primarily
using Maven Central, but for any enterprise environment, where an
authenticating Maven repository server is used to distribute critical software
artifacts, it would be nice to not expose credentials for PKCS12 and JKS
keystores via JSSE system properties on the process command-line.
> Better PKCS12 and/or PKCS11 support
> -----------------------------------
>
> Key: MNG-5583
> URL: https://issues.apache.org/jira/browse/MNG-5583
> Project: Maven
> Issue Type: Improvement
> Components: General
> Affects Versions: 3.1.1
> Environment: Any multi-user environment, especially Unix/Linux
> environments.
> Reporter: Christopher Tubbs
> Priority: Major
> Labels: security-issue
>
> Maven supports dependency resolution through HTTPS with client-authentication
> (documented MNG-1560), via JSSE system properties on the java command-line.
> These can be configured in the environment of the process that launches Maven
> as
> [MAVEN_OPTS|http://maven.apache.org/guides/mini/guide-repository-ssl.html],
> which can be made relatively secure.
> However, eventually, when the mvn bootstrap script starts Maven's java
> process, these options are placed on the command line for java. This is
> extremely problematic, because it means that any JSSE properties with
> sensitive information (javax.net.ssl.keyStorePassword, for example) are
> visible in the process list to any user of the system. This is explicitly
> [advised against by
> Java|http://download.java.net/jdk8/docs/technotes/guides/security/jsse/JSSERefGuide.html#InstallationAndCustomization],
> but appears to be the only way to pass this information to Maven.
> Maven can do a better job of prompting for, or configuring, passphrases for
> keyStores and trustStores. It already has the ability to configure server
> credentials in the settings.xml file, protected with a master passphrase read
> from a different file
> ([~/.m2/settings-security.xml|http://maven.apache.org/guides/mini/guide-encryption.html]).
> This would work for JKS and PKCS12 keystores today, if there were a way to
> configure the passphrases there instead of in MAVEN_OPTS.
> Another option would be to support PKCS11 keystores, configured via the
> current JSSE system properties. However, to do this, Maven needs to
> instantiate the SSL configuration in the http client with an AuthProvider and
> a callback handler which prompts for the PKCS11 pin/passphrase.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
