You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
File Systems II<br />
If you can rely on your users to install the <strong>Java</strong> plug in, you can sign applets using<br />
the JDK 1.1.X javakey command. You will also have to have them import your<br />
certificate into their 'identitydb.obj' file in their home directory, and mark it as trusted.<br />
If importing the certificate is too much to ask, and it usually is, you could create an<br />
'identitydb.obj' containing the certificate, already marked as trusted, and have them<br />
download this to their home directory. Be careful not to distribute the 'identitydb.obj'<br />
that you used to sign the jar, since that would allow anyone to sign code as you!<br />
JDK1.2.X works in a similar way, but the 'javakey' command has been replaced by<br />
'jarsigner' and 'keytool'. In addition, 1.2 adds granularity to the security model, so that<br />
you can assign privileges outside of the sandbox via a policy file. For example you<br />
could allow an applet to read files, but not write them. JDK 1.1.X security is kind of an<br />
all or nothing proposition.<br />
If you can't count on the Plugin being there, but you know your users will be using<br />
Netscape, you can sign use the Netscape signtool. Netscape's signtool is a little<br />
different than Sun's. With Netscape's, you put all of your class files into a directory,<br />
like signdir, and then run something like this:<br />
./signtool -k MyCert -Z MyApplet.jar signdir<br />
The 'MyApplet.jar' file will be created, and, of course, you would already have to have<br />
MyCert in your security database. You can generate a test certificate through<br />
signtool, but it's only good for a couple of months.<br />
--<br />
Joe Morrogh - Excite@Home - The Leader in Broadband http://home.com/faster<br />
Q: I need to read C:\test.doc for example and store it somewhere for my future<br />
use. I don't know anything about security. Part 2, Part 1 was published yesterday<br />
Answer 2: I think they want you to go out and buy a cert from Verisign or Thawte, etc.<br />
You can also generate your own signing certificate through openSSL, or some other<br />
package, but, if you do, you'll need to have them import it into their database as a<br />
trusted signer. This can be done with a simple Perl script which sends the certificate<br />
with a header of:<br />
"Content-Type: application/x-x509-ca-cert"<br />
You must also add some code to your applet to use the Netscape way of signing.<br />
You can download the file 'capsapi_classes.zip' from Netscape. This file contains the<br />
Netscape Capabilities API. Basically, all you need to do is import the package and<br />
enable privileges as you need them. It is important to enable privileges in the same<br />
method (ie. same frame stack)<br />
in which you are going to use them. You cannot just enable all the privileges you<br />
need in the init method of your applet. The code looks something like this:<br />
import netscape.security.*;<br />
public void MyMethod() {<br />
try {<br />
PrivilegeManager.enablePrivilege("UniversalFileRead");<br />
FileInputStream fis = new FileInputStream("myfile");<br />
} catch (Exception e) {<br />
System.out.println(e);<br />
}<br />
} // end MyMethod<br />
You'll need to add 'capsapi_classes.zip' to the archive attribute of your applet tag. I<br />
file:///F|/350_t/350_tips/filesystems-II.htm (2 of 4) [2002-02-27 21:17:59]