JBAS-2243 - SecurityExceptions

[adrian.brock]

http://jira.jboss.com/jira/browse/JBAS-2243

Comment by Scott M Stark [12/Sep/05 09:14 PM]
What is an example client context that is exposing this info?

A dictionary attack.

If the client has to guess both the user and password it is harder.
log.warn("Access Denied", realError);
throw new SecurityException("Access Denied"); // to the client

[adrian.brock]

log.warn("Access Denied", realError);

And this logging could be a DOS if it fills up the disk. :-)

[starksm64]

Yes, I know, but exposing this info via a log is not a security risk. If you have access to the log its not our problem.

[elkner]

Yepp. If the server aka logs/configs are not secured, than the setup/admin has some problems ...

At least my ideal world would have something like this in the server [auth.]log:

log.warn("auth failed. principal=" + princ + " host=" + clientIP);