[
https://issues.apache.org/jira/browse/JS2-1258?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Ate Douma resolved JS2-1258.
----------------------------
Resolution: Fixed
> Harden default/demo Jetspeed security configuration by disabling usage of the
> Tomcat Manager and force change password on demo admin user
> -----------------------------------------------------------------------------------------------------------------------------------------
>
> Key: JS2-1258
> URL: https://issues.apache.org/jira/browse/JS2-1258
> Project: Jetspeed 2
> Issue Type: Improvement
> Components: Assembly/Configuration, Deployment, Installer, Security
> Affects Versions: 2.2.1
> Reporter: Ate Douma
> Fix For: 2.2.2
>
>
> The Jetspeed demo installer uses a convenient default username/password
> configuration which makes it easy for end-users to get started.
> However this also poses a potential security risk if some "type" of users
> would blindly install this in a public accessible way, without adjusting the
> default configuration.
> To protect such users from hurting themselves, we must force them to make
> this an explicit choice, and by default only provide a restricted (limited)
> configuration.
> To this end, the default/demo configuration will be changed to:
> a) Require demo admin user to change the password on first use (for all demo
> variants, some already have this but not yet all)
> b) By default disable usage of the Tomcat Manager through the
> PortletApplicationManagement portlet
> - no default Tomcat manager user will be pre-configured anymore in
> tomcat-user.xml (JetspeedInstaller)
> - in jetspeed.properties the example Tomcat Manager username/password will
> now by default empty (undefined)
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: jetspeed-dev-unsubscr...@portals.apache.org
For additional commands, e-mail: jetspeed-dev-h...@portals.apache.org
