Network Server Security

By default, the Derby Network Server will only listen on the localhost. Clients must use the localhost host name to connect. By default, clients cannot access the Network Server from another host. To enable connections from other hosts, you can set the derby.drda.host property, or you can start the Network Server with the -h option in the java org.apache.derby.drda.NetworkServerControl start command.

In the following example the server will only listen on localhost and clients cannot access the server from another host.

java org.apache.derby.drda.NetworkServerControl start

In the following example, the server runs on host machine myserver.mydomain.com and also listens for clients from other hosts. Clients should specify the server in the URL or DataSource as myserver.mydomain.com:

java org.apache.derby.drda.NetworkServerControl start -h myserver.mydomain.com

To start the Network Server so that it will listen on all interfaces, start with an IP address of 0.0.0.0, as follows:

java org.apache.derby.drda.NetworkServerControl start -h 0.0.0.0

A server started with the 0.0.0.0 option will listen to client requests that originate from both localhost and other machines on the network.

In addition, administrative commands (for example: org.apache.derby.drda.NetworkServerControl shutdown) can only execute on the host where the server was started even if the server was started with the -h option.