Re: [TM4J-users] security flaw in install_hibernate.txt?

[<mag...@st...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Kal Ahmed wrote:
> Agreed the security could be made tighter. I think that the goal of this
> document is about how to get something up and running in a development
> environment rather than how to get a live deployment running. To be
> honest, I still think of the Hibernate backend as a development
> environment as it has so many flaws (like not supporting tolog querying
> and being s-l-o-o-o-w).

...so I migth be better off just using the In-memory Backend?


> I would be happy to see someone write a proper installation guide for
> TM4J/Hibernate/MySQL (I guess that MySQL would be the most commonly used
> database), but preferably in Docbook format so that it could go into the
>  rest of the "standard" docs.
> 
> Cheers
> 
> Kal
> 
> Magnus Folgerø wrote:
> I've just read through the
> http://tm4j.org/tm4j/docs/install_hibernate.txt and I think there's
> something fishy about some of the stuff in there:
> 
> ----------------
> mysql> GRANT ALL PRIVILEGES ON *.* TO 'tm4j'@'localhost'
>     ->     IDENTIFIED BY 'some_pass' WITH GRANT OPTION;
> mysql> GRANT ALL PRIVILEGES ON *.* TO 'tm4j'@'%'
>     ->     IDENTIFIED BY 'some_pass' WITH GRANT OPTION;
> ----------------
> 
> I can't see why tm4j should get root privileges? Wouldn't it be better
> to grant tm4j access to the database tm4j  (tm4j.*) and create this db
> before granting privileges to users, and not afterwards like in the
> howto?
> Further, it should be pointed out that granting access to tm4j@'%' is
> _only_ necessary if the db is not running at localhost.
> 
> --
> best regards
> Magnus
>>
>>
- -------------------------------------------------------
All the advantages of Linux Managed Hosting--Without the Cost and Risk!
Fully trained technicians. The highest number of Red Hat
certifications in
the hosting industry. Fanatical Support. Click to learn more
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642
_______________________________________________
Tm4j-users mailing list
Tm4...@li...
https://lists.sourceforge.net/lists/listinfo/tm4j-users
>>
>>

> -------------------------------------------------------
> All the advantages of Linux Managed Hosting--Without the Cost and Risk!
> Fully trained technicians. The highest number of Red Hat certifications in
> the hosting industry. Fanatical Support. Click to learn more
> http://sel.as-us.falkag.net/sel?cmd=k&kid7521&bid$8729&dat1642
> _______________________________________________
> Tm4j-users mailing list
> Tm4...@li...
> https://lists.sourceforge.net/lists/listinfo/tm4j-users
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mandriva - http://enigmail.mozdev.org

iD8DBQFEeuC9B6/gap0IM6sRAjacAJ9JDyBXgkoSNT9GDhUvRz0IPFmWaQCfVUjw
IcAxfLO5qSVjAoKAOr9+Jek=
=fB9i
-----END PGP SIGNATURE-----