330 Java Tips.pdf - FTP Server

File Systems II
If you can rely on your users to install the Java plug in, you can sign applets using
the JDK 1.1.X javakey command. You will also have to have them import your
certificate into their 'identitydb.obj' file in their home directory, and mark it as trusted.
If importing the certificate is too much to ask, and it usually is, you could create an
'identitydb.obj' containing the certificate, already marked as trusted, and have them
download this to their home directory. Be careful not to distribute the 'identitydb.obj'
that you used to sign the jar, since that would allow anyone to sign code as you!
JDK1.2.X works in a similar way, but the 'javakey' command has been replaced by
'jarsigner' and 'keytool'. In addition, 1.2 adds granularity to the security model, so that
you can assign privileges outside of the sandbox via a policy file. For example you
could allow an applet to read files, but not write them. JDK 1.1.X security is kind of an
all or nothing proposition.
If you can't count on the Plugin being there, but you know your users will be using
Netscape, you can sign use the Netscape signtool. Netscape's signtool is a little
different than Sun's. With Netscape's, you put all of your class files into a directory,
like signdir, and then run something like this:
./signtool -k MyCert -Z MyApplet.jar signdir
The 'MyApplet.jar' file will be created, and, of course, you would already have to have
MyCert in your security database. You can generate a test certificate through
signtool, but it's only good for a couple of months.
--
Joe Morrogh - Excite@Home - The Leader in Broadband http://home.com/faster
Q: I need to read C:\test.doc for example and store it somewhere for my future
use. I don't know anything about security. Part 2, Part 1 was published yesterday
Answer 2: I think they want you to go out and buy a cert from Verisign or Thawte, etc.
You can also generate your own signing certificate through openSSL, or some other
package, but, if you do, you'll need to have them import it into their database as a
trusted signer. This can be done with a simple Perl script which sends the certificate
with a header of:
"Content-Type: application/x-x509-ca-cert"
You must also add some code to your applet to use the Netscape way of signing.
You can download the file 'capsapi_classes.zip' from Netscape. This file contains the
Netscape Capabilities API. Basically, all you need to do is import the package and
enable privileges as you need them. It is important to enable privileges in the same
method (ie. same frame stack)
in which you are going to use them. You cannot just enable all the privileges you
need in the init method of your applet. The code looks something like this:
import netscape.security.*;
public void MyMethod() {
try {
PrivilegeManager.enablePrivilege("UniversalFileRead");
FileInputStream fis = new FileInputStream("myfile");
} catch (Exception e) {
System.out.println(e);
}
} // end MyMethod
You'll need to add 'capsapi_classes.zip' to the archive attribute of your applet tag. I
file:///F|/350_t/350_tips/filesystems-II.htm (2 of 4) [2002-02-27 21:17:59]