[Hawkular-dev] New Hawkular Blog Post: Connecting Hawkular Agent to Hawkular Services over SSL

New Hawkular blog post from noreply(a)hawkular.org (Josejulio Martínez): http://ift.tt/2fiy8ZH SSL provides identification of the communicating parties, confidentiality and integrity of the information being shared. In production environments, network eavesdropping could be a concern. You can use SSL to provide a secure communication channel between servers. Hawkular Services expects Hawkular Agents to connect, push information and listen for commands. These commands also include server credentials that could be vulnerable to a man-in-the-middle attack. A previous article shows how to configure your Hawkular Services with SSL and have Hawkular Agents connect to it trough SSL. This guide will show how is done for Dockerized Hawkular Services Agents. Preparing your certificates Before starting we need to prepare the certificates that we are going to use. Your public and private key for Hawkular Services need to be on PEM or PKC12 format. For this guide we will use PEM. We can create self-signed certificates (in PEM format) using: keytool -genkey -keystore hawkular.keystore -alias hawkular -dname "CN=hawkular-services" -keyalg RSA -storepass hawkular -keypass hawkular -validity 36500 -ext san=ip:127.0.0.1,dns:hawkular-services keytool -importkeystore -srckeystore hawkular.keystore -destkeystore hawkular.p12 -deststoretype PKCS12 -srcalias hawkular -deststorepass hawkular -destkeypass hawkular -srcstorepass hawkular openssl pkcs12 -in hawkular.p12 -password pass:hawkular -nokeys -out hawkular-services-public.pem openssl pkcs12 -in hawkular.p12 -password pass:hawkular -nodes -nocerts -out hawkular-services-private.key Important When creating the certificates, remember to include the host that Hawkular will use (as Common Name(CN) and Subject Alternative Name(SAN)), else the certificate validation will fail. Through this guide, host will be set to hawkular-services. Warning Always include san=ip:127.0.0.1 in your certificate, as this will be used internally by Hawkular Services. Starting Cassandra Hawkular Services requires a cassandra instance, you can start one by doing: docker run --name hawkular-cassandra -e CASSANDRA_START_RPC=true -d cassandra:3.0.12 Starting Hawkular Services on SSL Now that there is a cassandra ready, Hawkular Services can be started, it will be linked to the cassandra instance (hawkular-cassandra) docker pull hawkular/hawkular-services docker run --name hawkular-services --link=hawkular-cassandra -e CASSANDRA_NODES=hawkular-cassandra -e HAWKULAR_HOSTNAME=hawkular-services -e HAWKULAR_USE_SSL=true -p 8443:8443 -v `pwd`/hawkular-services-private.key:/client-secrets/hawkular-services-private.key:z -v `pwd`/hawkular-services-public.pem:/client-secrets/hawkular-services-public.pem:z hawkular/hawkular-services Note To avoid guessing the host, we explicitly set it to hawkular-services using HAWKULAR_HOSTNAME environmental variable. Warning If you don’t specify any certificate, Hawkular services will create one, but we won’t be able to connect agents unless we export the certificate. Starting a Hawkular Agent By now there should be a Hawkular Services listening on default secure port 8443, if any agent wants to connect, it will need to know and trust its certificate. If you are self-signing your certificate, you will need to pass Hawkular Service’s certificate when starting the agent. docker pull hawkular/wildfly-hawkular-javaagent docker run --name hawkular-agent-01 --link=hawkular-services -e HAWKULAR_SERVER_PROTOCOL=https -e HAWKULAR_SERVER_ADDR=hawkular-services -e HAWKULAR_SERVER_PORT=8443 -v `pwd`/hawkular-services-public.pem:/client-secrets/hawkular-services-public.pem:z hawkular/wildfly-hawkular-javaagent Note Host must match with the one specified in the certificate, thus setting HAWKULAR_SERVER_ADDR to hawkular-services is required. Update as needed if using other value. Testing the setup Any Hawkular client that supports connecting using SSL can be used. Curl, ManageIQ and HawkFX will be show below. Note If using self-signed certificates, the client machine needs to trust Hawkular Services certificate or the client should support to specify which certificate to trust. See here for more info. Curl Simplest way to test, we only need to tell curl how to resolve hawkular-services and pass the public certificate. curl -H "Hawkular-Tenant: hawkular" --resolve "hawkular-services:8443:127.0.0.1" --cacert hawkular-services-prd -X GET https://hawkular-services:8443/hawkular/metrics/metrics It will output metrics stored on Hawkular Services. ManageIQ It can be quickly tested using the dockerized ManageIQ as follow: docker run --link=hawkular-services --privileged -d -p 8444:443 manageiq/manageiq:fine-3 Once ManageIQ has started, add a Middleware Provider, there is three secured ways to do that: SSL  — Requires that the client box trusts Hawkular Services certificate. SSL trusting custom CA — Requires to provide the certificate to trust. SSL without validation — No validation is performed. We will focus on (2) and (3) as (1) will require to trust the certificates on the machine itself. Before going onto details, navigate to https://localhost:8444/, login with default username admin and password smartvm. Click on Middleware → Configuration → Add a New Middleware Provider. SSL trusting custom CA We need to select SSL trusting custom CA in Security Protocol and copy the certificate from the contents of hawkular-services-public.pem. Fill the Hostname with the one used in the certificate and complete the required information. Figure 1: Middleware Provider SSL trusting custom ca SSL without validation We need to select SSL without validation in Security Protocol. No validation regarding the certificate is made with this option, only fill the required information. Figure 2: Middleware Provider SSL without validation HawkFX One can connect using HawkFx by either installing the certificate on the machine or disabling the verification as show in the image. You will also need to update your /etc/hosts to resolve hawkular-services. sudo su -c "echo '127.0.0.1 hawkular-services' >> /etc/hosts" Alternatively, if no verification is used, one could use localhost instead of hawkular-services. Figure 3: HawkFX without validation Conclusion Securing communications between a dockerized Hawkular Agent and Hawkular Services is possible with self-signed certificates. Connecting clients is also possible with the additional step of providing the certificate. from Hawkular Blog