Java Debugger security question

[Ahmed Basheer]

I have question. I am using java Debugger JDB. I am attaching to the currently running Java process which is preconfigured to listen to the port. so I am using jdb -attach <portnumber>. There seems a security hole when configuring java process to listen to the portnumber. remote debugger can do anything and everything to the process. Is there any way that Java process can be protected with password if we use jdb -attach <portnumber> remotely. Earlier versions of jdb seems to offer an option like "jdb -host -password" but this mechanism doesn't work with jdb packaged with jdk1.5.

Suggestions appreciated.

Thanks,
Ahmed

[Peter Chase]

But surely you only run your Java process with the debugger enabled when you are testing in a development environment, not in production ... do you?

[Ahmed Basheer]

I am running Java process with debugger enabled in production. Sun doc says there is no performance impact if we run it with debugger enabled. But there is security hole that I am looking to plug into.

Ahmed.

[Ulf Dittmer]

Can you configure the router that separates the network segment with the production machines from the rest of the network to not allow traffic on that port? (Or the firewall, if you're concerned about traffic from the outside?)

Less convenient than a password, but also more secure.