March 2007 - jboss-dev-forums - Jboss List Archives

[Design of Security on JBoss] - Re: AS 4.2.0 binding to localhost

by anil.saldhana＠jboss.com

My solutions: a) Allow the user to only install via the installer. Here we can force the user to choose an admin /passwd. b) Do not include the jmx-console/web-console anymore with the default distribution. Let it be an on-demand download with an installation notes mandating security of the consoles. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4024973#4024973 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4024973

19 years, 1 month

1
0
0 / 0

[Design of Security on JBoss] - Re: AS 4.2.0 binding to localhost

by scott.stark＠jboss.org

The point of the change was to not be the source of the unsecure, globally available access. We were getting security exploit postings over this issue. Logging a message is not effective either. Inconvience is the point. If your trying to access the server remotely, then you have to change something and the release notes document why localhost is the default. It was argued that it would be more inconvient to completely disallow access to the jmx console by configuring it to only configure users without valid permissions to access the consoles. The argument for localhost was that testsuites would not be broken, as well as allowing the typical localhost deployments used by developers. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4024969#4024969 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4024969

19 years, 1 month

1
0
0 / 0

[Design of Security on JBoss] - Re: AS 4.2.0 binding to localhost

by mazz＠jboss.com

Its the user's job to decide if allowing unsecured access to JMX Console is allowed under any circumstance - its not our job to deny such access without it being a configurable setting. That said, we should at least spit out very loud warnings in the logs if we detect unsecured access outside of "localhost". I think the solution to this is to: log.warn("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"); | log.warn("!!!!! WARNING !!!!!!"); | log.warn("! YOU ARE ALLOWING UNSECURED ACCESS TO JMX CONSOLE !"); | log.warn("! PLEASE SEE http://jboss.com/SecureJBoss FOR MORE INFO !"); | log.warn("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"); At least you can't miss that when you start the server every time (assuming someone looks at the logs every now and then - which you would assume someone would before putting a JBossAS instance in production that is accessible to the world) View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4024968#4024968 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4024968

19 years, 1 month

1
0
0 / 0

[Design of Security on JBoss] - Re: AS 4.2.0 binding to localhost

by ryan.campbell＠jboss.com

We could address this by only allowing connections to jmx-console from localhost, or any other methods which require configuration on the user's end. At least we could have a chance to have something like this: ****** Before uncommenting this, see http://wiki.jboss.org/SecureJBoss ****** A smarter option would cause JBoss to refuse to listen on anything but localhost with an unsecured JMX console unless you pass the "--unsecure" option. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4024964#4024964 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4024964

19 years, 1 month

1
0
0 / 0

[Design of Security on JBoss] - AS 4.2.0 binding to localhost

by ryan.campbell＠jboss.com

In an effort to make JBoss more secure by default, the following issue was addressed in 4.2.0.CR1: http://jira.jboss.com/jira/browse/JBAS-4119 Now if you just type "run.sh", JBoss will default to binding to localhost. This decision was the result of a discussion on the jboss-dev list here: http://lists.jboss.org/pipermail/jboss-development/2007-February/006100.html Unfortunately, this will not do anything to improve out-of-the-box security. The user will just add the -b option and be on their way without any thought. There is nothing in adding the "-b" option that prompts the user to secure their JMX console or anything else. Scenario: 1. User types run.sh, tries to hit "myhost.com" 2. User scratches head, realizes JBoss now binds to localhost by default 3. User curses JBoss, uses ./run.sh -b myhost.com 4. User once again has unsecured JMX Console The problem is, the user is not forced to consider security. All we did was create an inconvenience. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4024962#4024962 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4024962

19 years, 1 month

1
0
0 / 0

[Design of JBoss Build System] - Re: JBoss/JCA Maven Build

by weston.price＠jboss.com

Cool. Sounds like we are heading in the right direction. Note, the JCA stuff is at a point that includes enough to where it can be checked into SVN as a top level project. Might help in proving out some of the new build stuff. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4024911#4024911 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4024911

19 years, 1 month

1
0
0 / 0

[Design of JBoss Build System] - Re: JBoss/JCA Maven Build

by scott.stark＠jboss.org

This is the same type of structure that the mc project needs as well: http://www.jboss.com/index.html?module=bb&op=viewtopic&t=96393 There we will have to split up the projects along the lines of spi/impl/test to work with the maven constructs. I'll ask Paul to comment further on what can be done short of that. Either a custom jar plugin that supports spi/impl notions, or the use of ant to build the jars would be needed otherwise. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4024898#4024898 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4024898

19 years, 1 month

1
0
0 / 0

[Design of JBoss Build System] - JBoss/JCA Maven Build

by weston.price＠jboss.com

The next rev of JBoss/JCA should use Maven for it's build system. I have created a new project structure based on Maven using the parent/child POM relationship as: | jboss-jca | -->pom.xml | -->core | -->pom.xml | -->src | -->adapter | -->pom.xml | -->src | This is fine and I am able to fetch my dependencies from our repository, compile, etc. However, I am starting to run into problems when wanting to construct multiple JAR(s) from a single project (pom.xml). I simply want to split the artifacts of core into multiple artificacts ie | jboss-jca-spi.jar | jboss-jca-plugin.jar | Since I have a dependency on the MC and I want the new JCA stuff to be a top level project in JBossSVN, could we use the new JCA stuff as testbed for the new build/plugin process? It would seem to make some sense as this is a fundamental piece of JBoss5 that is going to be ripped out and made a standalone module much in the same manner of messaging, aop etc. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4024892#4024892 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4024892

19 years, 1 month

1
0
0 / 0

[Design of JBoss ESB] - Re: Message Store - new implementation changes

by daniel.brum＠jboss.com

Trunk it is. Will update the docs of course. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4024883#4024883 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4024883

19 years, 1 month

1
0
0 / 0

[Design of JBoss ESB] - Re: Message Store - new implementation changes

by mark.little＠jboss.com

Sounds good. Can you update the docs in the trunk (I assume that's where the code changes have gone too)? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4024882#4024882 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4024882

19 years, 1 month

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-dev-forums March 2007