https://ask.datomic.com/index.php/tag/dev Powered by Question2Answer https://ask.datomic.com/index.php/1003/possibly-security-issue-with-the-dev-h2-storage <p>While trying to understand more about the behaviour of Datomic dev (mainly from a security/encryption point of view), I attempted to connect to datomic.mv.db from an instance of the H2 console. I accidentally tried to log in as "admin" with a blank password and was surprised when I connected successfully. Connecting as "admin" with any password fails, so it seems explicitly to be blank. As far as I can tell I only have public schema access and can't see any transacted data, but I am able to run SQL queries in the console.</p> <p>Clearly a dev transactor isn't intended to be high security, but admin with a blank password seems risky even for a dev environment. In most SQL environments I work with, the sa/admin account is just disabled if not used. Am I missing something?</p> <p>As an aside, does the dev transactor use H2's AES encryption or is the resulting data file unencrypted?</p> On-Prem https://ask.datomic.com/index.php/1003/possibly-security-issue-with-the-dev-h2-storage Wed, 13 Mar 2024 21:58:26 +0000