~/.netbeans/6.0/tomcat55.properties is world-readable

[Timo Wiren]

Binary package hint: netbeans

I don't know if this is an Ubuntu's NetBeans package bug, NetBeans bug or NetBeans' Tomcat plugin bug, but I thought I might as well report it here. The file ~/.netbeans/6.0/tomcat55.properties is world-readable and contains a plain-text password of a Tomcat user in manager role. I'm using Kubuntu 8.04 and installed NetBeans using aptitude. NetBeans version is 6.0.1-0ubuntu2.

[Marek Slama (mslama-email)]

It looks like plugin bug. How do you create this file or when is it created? I will pass this issue to NetBeans.

[Marek Slama (mslama-email)]

I assume this file should be accessible only by given user right?

[Timo Wiren (timo-wiren)]

I assume the file is created when I install NetBeans' Tomcat plugin or configure it in NetBeans. I also assume that it should be accessible only by the user whose home directory it's in.

[Marek Slama (mslama-email)]

I filed http://www.netbeans.org/issues/show_bug.cgi?id=143033

[Mslama (mslama)]

Original report is at https://bugs.launchpad.net/ubuntu/+source/netbeans/+bug/244321. I checked dev build but there is
tomcat 6. Not sure where to put this report if it is NetBeans or Tomcat issue. So please pass it accordingly.

[Phejl (phejl)]

It is a development instance. Installer should place proper rights on file, however this won't solve issue in general.

[Mslama (mslama)]

I do not think that any installer should create/set access rights to any file in user home directory (or default IDE
user dir). Who/when creates this file?

[Thuydn (thuydn)]

Done a bit of investigation on NB 6.5 and found that

- First scenario: If you select Tomcat that bundled with NB when you install NB 6.5 (and later version), the file that
contains the Tomcat server manager's default username and password is stored in
~/.netbeans/6.5/apache-tomcat-6.0_base/config/tomcat-users.xml. Although the file is world-readable, the password
inside the file is encrypted.
The entire folder ~/.netbeans/6.5/apache-tomcat-6.0_base which is the default ${Catalina_Base} chosen by NB is NOT
created at the time of NB installation, but at the time the Tomcat server is first started by users via NB
Servers->server node's popup menu.

- Second scenario: if you manually at Tomcat server to NB via the Add Server wizard, you are asked to enter username and
password for the manager role among other things. The username and password is stored in plain text in tomcat-users.xml
file under ${Catalina_Base}/config folder, where ${catalina_Base} is the folder you enter to the wizard.

Possible solutions:
- Option 1: encrypt the password in the second scenario before storing the password to tomcat-users.xml, then no need to
change the permission of the file.
- Option 2: Create the file (tomcat-users.xml) without word-readable perm, then no need to encrypt the password in
either scenarios.

[Phejl (phejl)]

Fixed in web-main e0f3545105f5.

[Quality-i (quality-i)]

Integrated into 'main-golden', will be available in build *201204021038* on http://bits.netbeans.org/dev/nightly/ (upload may still be in progress)
Changeset: http://hg.netbeans.org/main-golden/rev/e0f3545105f5
User: Petr Hejl <email address hidden>
Log: #143033 base_dir/tomcat-users.xml is world-readable