Re: [INTERFACES] Using JDBC and SSL (or any method of security)

On Tue, 14 Jul 1998, Nick Urbanik wrote:

> Hello,
>
> We want to use JDBC together with a patched PostgreSQL using Brett
> McCormick's PostgreSQl-SSL patch. Is it possible to use encrypted
> communication with JDBC using this? Or kerberos? Or do you have any
> suggestions as to how we can make it secure?

Currently there is no way of encrypting the data stream using SSL or
Kerberos - yet. The java.security api may help us in the near future.

> The database will contain sensitive information and will be available
> over the Internet, to those who are authorised.
>
> If no encryption is possible, is it possible to ensure that no one can
> read the passwords (by encrypting them)? I would be grateful for any
> help; please reply to my email addresses also.

The only encoding possible so far is using the crypt authentication
system, where the password is sent over the wire encrypted. We can handle
this, as we have our own copy of crypt in the driver.

--
Peter T Mount peter(at)retep(dot)org(dot)uk or petermount(at)earthling(dot)net
Main Homepage: http://www.retep.org.uk
************ Someday I may rebuild this signature completely ;-) ************
Work Homepage: http://www.maidstone.gov.uk Work EMail: peter(at)maidstone(dot)gov(dot)uk