Difference between revisions of "Securing JBoss"

Revision as of 07:41, 27 April 2012

When you run JBoss, OpenKM is accessible through the 8080 port. The bad news is that JBoss web console and JMX console is accessible and everybody can read and modify JBoss configuration. This is particularity dangerous if the OpenKM is accessible from Internet.

JMX Console

Edit the configuration file:

 $ vim $JBOSS_HOME/server/default/deploy/jmx-console.war/WEB-INF/web.xml

Uncomment the block <security-constraint> and delete lines <http-method>WHATEVER_METHOD</http-method> inside the block if they are there (see this: CVE-2010-0738). Edit this other configuration file:

 $ vim $JBOSS_HOME/server/default/deploy/jmx-console.war/WEB-INF/jboss-web.xml

Uncomment the block defined by <security-domain>. Edit the users file:

 $ vim $JBOSS_HOME/server/default/conf/props/jmx-console-users.properties

Change the password of the admin user.

Web Console

Edit the configuration file:

 $ vim $JBOSS_HOME/server/default/deploy/management/console-mgr.sar/web-console.war/WEB-INF/web.xml

Uncomment the block <security-constraint> and delete lines <http-method>WHATEVER_METHOD</http-method> inside the block if they are there. Edit this other configuration file:

 $ vim $JBOSS_HOME/server/default/deploy/management/console-mgr.sar/web-console.war/WEB-INF/jboss-web.xml

Uncomment the block defined by <security-domain>. Edit also this file:

 $ vim $JBOSS_HOME/server/default/conf/login-config.xml

Change the path of the files web-console-users.properties and web-console-roles.properties (add props/ at the beginning of the file name)

<module-option name="usersProperties">props/web-console-users.properties
</module-option>
<module-option name="rolesProperties">props/web-console-roles.properties
</module-option>

And copy the files to the new location:

$ cp $JBOSS_HOME/server/default/deploy/management/console-mgr.sar/web-console.war/WEB-INF/classes/web-console-*.properties $JBOSS_HOME/server/default/conf/props

Now all the authentication files are located in the same folder. Edit the users file:

$ vim $JBOSS_HOME/server/default/conf/props/web-console-users.properties

Change the password of the admin user. The last step is restart JBoss:

$ /etc/init.d/jboss restart

For more info, visit:

• http://jboss.org/community/docs/DOC-12190.
• http://www.techienuggets.com/Detail?tx=9