java.rmi.server.randomIDs sun.rmi.server.exceptionTrace

16.4.2 Basic RMI Parameters

There are only two basic RMI parameters that we cover in this chapter: java.rmi.server.randomIDs and sun.rmi.server.exceptionTrace . The first makes a system a little more secure, and the second makes a system a little easier to debug. Neither, however, is very useful.

16.4.2.1 java.rmi.server.randomIDs

This is a boolean-valued parameter, set to either true or false . If it is set to true , it forces the RMI runtime to generate cryptographically secure object identifiers for newly exported servers. The default is false . Because RMI shares sockets, stubs have to know the object identifier for servers to which they send messages. This means that the object identifier is encoded and sent over the wire. If a hostile entity can easily guess object identifiers, then they can more easily spoof RMI messages, and thus infiltrate a running application. On the other hand, its still pretty hard to spoof JRMP . In addition, its not clear what benefit the hostile agent gets from doing so. If you are worried about hostile agents to the extent that you are considering setting this parameter to true , you should probably know more about security than this book could possibly cover.

16.4.2.2 sun.rmi.server.exceptionTrace

This is a boolean-valued parameter. It controls the behavior of the servers RMI runtime. The issue is this: suppose we have a remote method that is allowed to throw a set of exceptions. For example, our Account interface had: public void makeDepositMoney amount throws RemoteException, NegativeAmountException; Suppose an account server throws an instance of NegativeAmountException . The exception is caught by the RMI runtime, serialized, sent over the wire, and rethrown so that the client exception-handling mechanism can catch it and deal with it appropriately. RMI does all of this automatically. Sometimes, however, you also want a record of the exceptions that were thrown on the server side. sun.rmi.server.exceptionTrace is designed to help in those situations. When it is set to true it defaults to false , all thrown exceptions will be printed to System.err along with the stack traces. When, on the other hand, un.rmi.server.exceptionTrace is set to false , nothing will be printed, and the server records will not contain any information about the exception that was thrown. In fact, they wont even indicate that an exception was thrown.

16.4.3 Transport Layer Parameters