<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<br>
<div class="moz-cite-prefix">On 10/8/17 10:34 PM, Harsha Wardhana B
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:83690f04-4cdb-ce11-a744-7d4372ec7500@oracle.com">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<p>Hi Daniel,<br>
</p>
Below is the webrev addressing the review comments. <br>
<br>
<a class="moz-txt-link-freetext"
href="http://cr.openjdk.java.net/%7Ehb/5016517/webrev.04/"
moz-do-not-send="true">http://cr.openjdk.java.net/~hb/5016517/webrev.04/</a><br>
<br>
</blockquote>
<br>
This approach seems reasonable.  I only review
management.properties and jmxremote.password.template file. <br>
<pre><span class="new"> 304 # ################# Hash passwords in password file ##############</span>
<span class="new"> 305 # com.sun.management.jmxremote.password.hashpasswords = true|false</span>
<span class="new"> 306 # Default for this property is true.</span>
<span class="new"> 307 # Specifies if passswords in the above file should be hashed or not.
typo: passswords
s/above file/password file/
- it has been referred to as "password file" in many places.
I'm thinking any better alternative to the new property name??
com.sun.management.jmxremote.password.hashes
com.sun.management.jmxremote.password.asHashes
</span> com.sun.management.jmxremote.passowrd.toHashes
<span class="changed">
49 # <a class="moz-txt-link-freetext" href="https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#MessageDigest">https://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#MessageDigest</a></span>
<span class="changed"> 50 # MD5, SHA-1 and SHA-256 are supported algorithms.</span>
<span class="changed"> 51 # This is an optional field. If not specified SHA-256 will be assumed.
</span>
I would avoid the link to the documentation of a specific JDK release.
Maybe say:
Refer to "Java Security Standard Algorithm Names Specification"
for supported algorithm.
<span class="changed"><span class="changed"> 53 # If passwords are in clear, they will be over-written by their hash if all of
s/over-written/overwritten
</span></span><span class="changed"> 67 # If multiple entries are found for the same role name, then the last one
68 # is used.
</span></pre>
<pre><span class="changed">If there are multiple entries of the same role, will all entries
be overridden with hash value? It may be better to detect as an
error when there are more than one entries of the same role?
</span><span class="changed"></span></pre>
<span class="changed">HashedPasswordFileTest.java<br>
@bug is missing<br>
<br>
Mandy<br>
</span>
</body>
</html>