8 OC4J Policy

This chapter provides the following information for the Oracle Application Server Containers for J2EE (OC4J) policy:

Brief description of the policy
Summary of the policy's main properties
Default values for the policy: parameters with their default values and objects excluded by default
Impact of the policy violation
Action to perform when the violation occurs

8.1 OC4J Password Indirection

This policy verifies that password indirection is used in OC4J XML configuration and deployment files.

Policy Summary

The following table lists the policy's main properties.

Severity	Category	Target Type	Versions Affected	Policy Rule Evaluation^Foot 1	Automatically Enabled?	Alert Message
Critical	Security	OC4J	Oracle Application Server 9.0.4.x and Oracle Application Server 10.1.2.x	The underlying metric has a collection frequency of once every 24 hours.	Yes	Password indirection is not used in configuration file %FILE_NAME%.

^Footnote 1The policy rule is evaluated each time its underlying Password_Indirection metric is collected.

Defaults

Parameters and Their Default Values

None

Objects Excluded by Default

None

Impact of Violation

Embedding these passwords into deployment and configuration files poses a security risk, especially if the permissions on the files allow them to be read by any user.

Action

To avoid this problem, OC4J provides password indirection and password obfuscation.