加密 Ibatis 的属性文件

发布于 2024-12-21 11:10:04 字数 216 浏览 2 评论 0 原文

我有一个包含数据库用户名/密码的属性文件，我用它来管理 ibatis 与数据库的连接。

加密此属性文件以保证安全的最佳方法是什么？实际上我使用的是netbeans 6.8。有没有办法在为项目打包时加密这个属性文件，或者有其他方法来防止其他人看到数据库凭据？

我正在使用 ibatis 连接到 java 桌面应用程序中的数据库

任何帮助将不胜感激。

谢谢

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

雾里花 2024-12-28 11:10:04

您是否想消除诱惑或让用户无法找到用户名/密码来手动连接数据库？

如果您只是想消除诱惑，当然可以对文件进行加密。 MyBatis（我看到您标记了您的问题 mybatis 和 ibatis，所以我假设我的代码中有 MyBatis）不提供开箱即用的功能使用加密凭据的方式，但您可以干预使用凭据的代码并在那里进行解密。您只需创建一个自定义数据源工厂。

假设您有一个像这样的数据源：

<dataSource type="UNPOOLED">
    <property name="driver" value="com.mysql.jdbc.Driver" />
    <property name="url" value="jdbc:mysql://someServer/someDB" />
    <property name="username" value="${user}" />
    <property name="password" value="${password}" />
</dataSource>

带有密钥的属性文件：

user=JohnDoe
password=p@$word

您可以加密该文件，然后创建一个自定义数据源工厂，如下所示（确保扩展正确的数据源工厂：池化、非池化等)：

package com.test;
import java.util.Properties;
import org.apache.ibatis.datasource.unpooled.UnpooledDataSourceFactory;

public class CustomDataSourceFactory extends UnpooledDataSourceFactory {
    @Override
    public void setProperties(Properties properties) {
        String user = null;
        String pass = null;

        // decrypt the file, use some fancy obfuscation, connect somewhere to get
        // the username and password dynamically at startup, whatever...
        //
        // user = "JohnDoe";
        // pass = "p@$word";

        properties.put("username", user);
        properties.put("password", pass);
        super.setProperties(properties);
    }
}

您的数据源将更改为：

<dataSource type="com.test.CustomDataSourceFactory">
    <property name="driver" value="com.mysql.jdbc.Driver" />
    <property name="url" value="jdbc:mysql://someServer/someDB" />
</dataSource>

现在用户将无法再看到凭据。

但请注意，上述内容不会保护用户名/密码。无论您选择什么来消除诱惑（加密、混淆、一些复杂的算法等），问题是您的用户拥有在他的机器上逆转该过程所需的一切（解密密钥、提取存档）、反编译代码、逆向工程等）。

要使其无法检索用户名/密码，请将 iBatis/myBatis 移至应用程序服务器；即，将您的胖客户端转换为更精简之一。您获得了 Windows 应用程序和数据库之间的解耦。您的应用程序服务器将根据 Windows 应用程序收到的命令运行所有数据库查询。

在这种情况下，Windows 应用程序将不再运行查询本身，因此它根本不需要数据库凭据；数据库凭据将存储在应用程序服务器上。

Do you want to remove the temptation or make it impossible for the users to find the username/password to manually connect to the database?

If you just want to remove the temptation, you can off course encrypt the file. MyBatis (I see you tagged your question mybatis and ibatis so I'll assume MyBatis in my code) does not offer an out of the box way of using encrypted credentials, but you can intervene in code where the credentials are used and do your decryption there. You just have to create a custom data source factory.

Assuming you have a data source like this:

<dataSource type="UNPOOLED">
    <property name="driver" value="com.mysql.jdbc.Driver" />
    <property name="url" value="jdbc:mysql://someServer/someDB" />
    <property name="username" value="${user}" />
    <property name="password" value="${password}" />
</dataSource>

with a properties file for the keys:

user=JohnDoe
password=p@$word

you can encrypt the file and then create a custom data source factory like so (make sure you extend the right one: pooled, unpooled etc):

package com.test;
import java.util.Properties;
import org.apache.ibatis.datasource.unpooled.UnpooledDataSourceFactory;

public class CustomDataSourceFactory extends UnpooledDataSourceFactory {
    @Override
    public void setProperties(Properties properties) {
        String user = null;
        String pass = null;

        // decrypt the file, use some fancy obfuscation, connect somewhere to get
        // the username and password dynamically at startup, whatever...
        //
        // user = "JohnDoe";
        // pass = "p@$word";

        properties.put("username", user);
        properties.put("password", pass);
        super.setProperties(properties);
    }
}

Your data source will then change to:

<dataSource type="com.test.CustomDataSourceFactory">
    <property name="driver" value="com.mysql.jdbc.Driver" />
    <property name="url" value="jdbc:mysql://someServer/someDB" />
</dataSource>

And now the users can't see the credentials anymore.

But note that the above won't protect the username/password. Whatever you choose to eliminate the temptation (encryption, obfuscation, some sophisticated algorithm etc) the thing is that your user has everything he needs to reverse the process right there on his machine (decrypt key, extract the archive, decompile code, reverse engineering etc).

To make it impossible to retrieve the username/password, move iBatis/myBatis to an application server; i.e. transform your thick client into a thinner one. You obtain a decoupling between the windows application and the database. Your application server will run all the database queries based on commands received by the windows application.

In this case, the windows application will no longer be running the queries itself so it won't need the database credentials at all; the database credentials will be stored on the application server.

回复收藏 0 原文