[JBoss JIRA] (JBJCA-895) Advanced security inflow
by Jesper Pedersen (JIRA)
Jesper Pedersen created JBJCA-895:
-------------------------------------
Summary: Advanced security inflow
Key: JBJCA-895
URL: https://issues.jboss.org/browse/JBJCA-895
Project: IronJacamar
Issue Type: Task
Components: Common, Core, Deployer
Reporter: Jesper Pedersen
Assignee: Jesper Pedersen
Fix For: 1.1.0.Beta3
Allow security inflow based on 16.4.3 and 16.4.4 to be defined per deployment instead of container wide
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 10 months
[JBoss JIRA] (AS7-3112) Better integration of service based ServerAuthenticationProviders
by Darran Lofthouse (Created) (JIRA)
Better integration of service based ServerAuthenticationProviders
-----------------------------------------------------------------
Key: AS7-3112
URL: https://issues.jboss.org/browse/AS7-3112
Project: Application Server 7
Issue Type: Task
Reporter: Darran Lofthouse
Assignee: Darran Lofthouse
Fix For: 7.1.0.Final
The security configuration of Remoting within AS7 is based on supplying three things: -
- The ServerAuthenticationProvider to obtain mechanism specific CallbackHanlders
- The OptionMap to control the security mechanisms made available / mandated.
- Possibly an initialised SSLContext for XnioSsl if SSL is being enabled.
For domain management the capabilities of the backing realm are used to define the security offered i.e. if we have no SSL configuration we can not enable SSL, if the backing store can not return the plain text passwords we can not enable DIGEST. This has been achieved so far by using an intermediary service to define the configuration based on capabilities alone.
This task it to take it one step further and allow this intermediary to be defined within the Remoting subsystem and maybe an equivalent for pure domain management to act as both a intermediary to define configuration based on the realm and also to allow additional configuration overrides. i.e. we need to support the additional SASL options available and SSL options available - this will somehow need to be merged / validated with the realm capabilities e.g. if a Realm is incompatible with Digest a user can not force the use of Digest.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 10 months
[JBoss JIRA] (JBAS-9514) JConsole does not connect to a locally running AS in Windows Machine
by Mugdha Khandekar (JIRA)
Mugdha Khandekar created JBAS-9514:
--------------------------------------
Summary: JConsole does not connect to a locally running AS in Windows Machine
Key: JBAS-9514
URL: https://issues.jboss.org/browse/JBAS-9514
Project: Application Server 3 4 5 and 6
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Remoting
Affects Versions: 6.0.0.Final
Environment: Windows all
Reporter: Mugdha Khandekar
When connecting to a local AS from jconsole, it throws error in JConsole output window and does not connect.
Aug 24, 2012 5:09:43 PM org.xnio.Xnio <clinit>
INFO: XNIO Version 3.0.4.GA-redhat-1
Aug 24, 2012 5:09:43 PM org.xnio.nio.NioXnio <clinit>
INFO: XNIO NIO Implementation Version 3.0.4.GA-redhat-1
Aug 24, 2012 5:09:43 PM org.jboss.remoting3.EndpointImpl <clinit>
INFO: JBoss Remoting version 3.2.8.GA-redhat-1
Aug 24, 2012 5:09:43 PM org.xnio.ChannelListeners invokeChannelListener
ERROR: A channel event listener threw an exception
java.lang.NoClassDefFoundError: jline/ConsoleReader
at org.jboss.as.cli.impl.Console$Factory.getConsole(Console.java:102)
at org.jboss.as.cli.impl.CommandContextImpl.initBasicConsole(CommandContextImpl.java:262)
at org.jboss.as.cli.impl.CommandContextImpl.readLine(CommandContextImpl.java:559)
at org.jboss.as.cli.impl.CommandContextImpl.access$100(CommandContextImpl.java:140)
at org.jboss.as.cli.impl.CommandContextImpl$AuthenticationCallbackHandler.handle(CommandContextImpl.java:1128)
at org.jboss.as.protocol.ProtocolChannelClient$WrapperCallbackHandler.handle(ProtocolChannelClient.java:264)
at com.sun.security.sasl.ClientFactoryImpl.getUserInfo(ClientFactoryImpl.java:118)
at com.sun.security.sasl.ClientFactoryImpl.createSaslClient(ClientFactoryImpl.java:76)
at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities$1.run(ClientConnectionOpenListener.java:352)
at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities$1.run(ClientConnectionOpenListener.java:350)
at java.security.AccessController.doPrivileged(Native Method)
at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.handleEvent(ClientConnectionOpenListener.java:350)
at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.handleEvent(ClientConnectionOpenListener.java:214)
at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:72)
at org.xnio.channels.TranslatingSuspendableChannel.handleReadable(TranslatingSuspendableChannel.java:189)
at org.xnio.channels.TranslatingSuspendableChannel$1.handleEvent(TranslatingSuspendableChannel.java:103)
at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:72)
at org.xnio.channels.TranslatingSuspendableChannel.handleReadable(TranslatingSuspendableChannel.java:189)
at org.xnio.ssl.JsseConnectedSslStreamChannel.handleReadable(JsseConnectedSslStreamChannel.java:180)
at org.xnio.channels.TranslatingSuspendableChannel$1.handleEvent(TranslatingSuspendableChannel.java:103)
at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:72)
at org.xnio.nio.NioHandle.run(NioHandle.java:90)
at org.xnio.nio.WorkerThread.run(WorkerThread.java:184)
Caused by: java.lang.ClassNotFoundException: jline.ConsoleReader
at java.net.URLClassLoader$1.run(URLClassLoader.java:202)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:190)
at java.lang.ClassLoader.loadClass(ClassLoader.java:306)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:301)
at java.lang.ClassLoader.loadClass(ClassLoader.java:247)
... 23 more
Exception in thread "AWT-EventQueue-0" java.lang.RuntimeException: Error connecting to JBoss AS.
at org.jboss.as.cli.gui.JConsoleCLIPlugin.getTabs(JConsoleCLIPlugin.java:79)
at sun.tools.jconsole.VMPanel.createPluginTabs(VMPanel.java:641)
at sun.tools.jconsole.VMPanel.propertyChange(VMPanel.java:315)
at java.beans.PropertyChangeSupport.firePropertyChange(PropertyChangeSupport.java:339)
at javax.swing.event.SwingPropertyChangeSupport.firePropertyChange(SwingPropertyChangeSupport.java:75)
at javax.swing.event.SwingPropertyChangeSupport$1.run(SwingPropertyChangeSupport.java:80)
at java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:209)
at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:646)
at java.awt.EventQueue.access$000(EventQueue.java:84)
at java.awt.EventQueue$1.run(EventQueue.java:607)
at java.awt.EventQueue$1.run(EventQueue.java:605)
at java.security.AccessController.doPrivileged(Native Method)
at java.security.AccessControlContext$1.doIntersectionPrivilege(AccessControlContext.java:87)
at java.awt.EventQueue.dispatchEvent(EventQueue.java:616)
at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:269)
at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:184)
at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:174)
at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:169)
at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:161)
at java.awt.EventDispatchThread.run(EventDispatchThread.java:122)
Caused by: java.lang.NullPointerException
at org.jboss.as.cli.gui.JConsoleCLIPlugin.connectCommandContext(JConsoleCLIPlugin.java:108)
at org.jboss.as.cli.gui.JConsoleCLIPlugin.getTabs(JConsoleCLIPlugin.java:76)
... 19 more
There is one more issue related. Now if I do steps mentioned in work around, above errors go away. But then it still does not connect via local option. Below is the error we get:
Aug 24, 2012 5:14:59 PM org.xnio.Xnio <clinit>
INFO: XNIO Version 3.0.4.GA-redhat-1
Aug 24, 2012 5:14:59 PM org.xnio.nio.NioXnio <clinit>
INFO: XNIO NIO Implementation Version 3.0.4.GA-redhat-1
Aug 24, 2012 5:14:59 PM org.jboss.remoting3.EndpointImpl <clinit>
INFO: JBoss Remoting version 3.2.8.GA-redhat-1
Aug 24, 2012 5:14:59 PM org.jboss.remoting3.remote.RemoteConnection handleException
ERROR: JBREM000200: Remote connection failed: javax.security.sasl.SaslException: Cannot get password [Caused by javax.security.sasl.SaslException: No username supplied.]
Exception in thread "AWT-EventQueue-0" java.lang.RuntimeException: Error connecting to JBoss AS.
at org.jboss.as.cli.gui.JConsoleCLIPlugin.getTabs(JConsoleCLIPlugin.java:79)
at sun.tools.jconsole.VMPanel.createPluginTabs(VMPanel.java:641)
at sun.tools.jconsole.VMPanel.propertyChange(VMPanel.java:315)
at java.beans.PropertyChangeSupport.firePropertyChange(PropertyChangeSupport.java:339)
at javax.swing.event.SwingPropertyChangeSupport.firePropertyChange(SwingPropertyChangeSupport.java:75)
at javax.swing.event.SwingPropertyChangeSupport$1.run(SwingPropertyChangeSupport.java:80)
at java.awt.event.InvocationEvent.dispatch(InvocationEvent.java:209)
at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:646)
at java.awt.EventQueue.access$000(EventQueue.java:84)
at java.awt.EventQueue$1.run(EventQueue.java:607)
at java.awt.EventQueue$1.run(EventQueue.java:605)
at java.security.AccessController.doPrivileged(Native Method)
at java.security.AccessControlContext$1.doIntersectionPrivilege(AccessControlContext.java:87)
at java.awt.EventQueue.dispatchEvent(EventQueue.java:616)
at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:269)
at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:184)
at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:174)
at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:169)
at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:161)
at java.awt.EventDispatchThread.run(EventDispatchThread.java:122)
Caused by: java.lang.NullPointerException
at org.jboss.as.cli.gui.JConsoleCLIPlugin.connectCommandContext(JConsoleCLIPlugin.java:108)
at org.jboss.as.cli.gui.JConsoleCLIPlugin.getTabs(JConsoleCLIPlugin.java:76)
... 19 more
PipeListener(System.out).run: java.io.IOException: Pipe broken
To get rid of above, we have to connect to locally running jboss server with remote option and providing url, username and password.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 10 months
[JBoss JIRA] (AS7-4982) add-user.sh script use weakeness hashing algorithm (MD5) that is broken for a long time
by Yannick LE NY (JIRA)
Yannick LE NY created AS7-4982:
----------------------------------
Summary: add-user.sh script use weakeness hashing algorithm (MD5) that is broken for a long time
Key: AS7-4982
URL: https://issues.jboss.org/browse/AS7-4982
Project: Application Server 7
Issue Type: Bug
Components: Console
Affects Versions: 7.1.2.Final (EAP)
Environment: Jboss EAP 6.0 Beta2
Jboss AS 7.1.1
Linux RHEL 5.4
JDK 1.6.0_24
Reporter: Yannick LE NY
Assignee: Heiko Braun
Fix For: 7.1.3.Final (EAP)
In Jboss EAP 6.0 Beta2 or Jboss AS 7.1.1, we need to use the bin/add-user.sh script to add user access to the Jboss console.
And in the the bin/add-user.sh script, you can find that the org.jboss.as.domain-add-user java class is used to :
1) add the login in the files standalone/configuration/mgmt-users.properties and domain/configuration/mgmt-users.properties
2) first hash the password with MD5 hash algorithm and then copy it hashed in the files standalone/configuration/mgmt-users.properties and domain/configuration/mgmt-users.properties
When you search about the org.jboss.as.domain-add-user java class on the Internet, you find this source file
http://grepcode.com/file/repo1.maven.org/maven2/org.jboss.as/jboss-as-dom...
and this file use an import of the org.jboss.sasl.util.UsernamePasswordHashUtil class that is in the file
http://grepcode.com/file/repository.jboss.org/nexus/content/repositories/...
In the file UsernamePasswordHashUtil.java, we can see that this is the weakness MD5 hash algorithm that is used and that is broken for a long time :
At http://en.wikipedia.org/wiki/MD5, the wikipedia article said :
"In 1996, a flaw was found with the design of MD5, and while it was not a clearly fatal weakness, cryptographers began recommending the use of other algorithms, such as SHA-1—which has since been found also to be vulnerable. In 2004, more serious flaws were discovered in MD5, making further use of the algorithm for security purposes questionable...In December 2008, a group of researchers used this technique to fake SSL certificate validity,[7][8] and
US-CERT now says that MD5 "should be considered cryptographically broken and unsuitable for further use."[9]
and most U.S. government applications now require the SHA-2 family of hash functions."
org.jboss.sasl.util.UsernamePasswordHashUtil class use java.security.MessageDigest class.
As you can see at : http://docs.oracle.com/javase/6/docs/api/java/security/MessageDigest.html,
getAlgorithm function can use several hash or Message Digest Algorithms.
The hash or Message Digest Algorithms available are :
MD2 (weak), MD5 (weak), SHA-1 (weak), SHA-256, SHA-384, and SHA-512
http://docs.oracle.com/javase/1.5.0/docs/guide/security/CryptoSpec.html#AppA
http://docs.oracle.com/javase/6/docs/technotes/guides/security/crypto/Cry...
Then can you replace the weakness MD5 Message Digest Algorithm used by add-user.sh by
SHA-256 or AES-256.
The security team in my big company want now that all the application servers used in the company use strong
cipher algorithm as 3DES used by Oracle Weblogic 10 or as AES-256 used by Oracle Weblogic 11.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 10 months
[JBoss JIRA] Created: (JBAS-8198) DomainController discovery system
by Brian Stansberry (JIRA)
DomainController discovery system
---------------------------------
Key: JBAS-8198
URL: https://jira.jboss.org/browse/JBAS-8198
Project: JBoss Application Server
Issue Type: Task
Security Level: Public (Everyone can see)
Components: Domain Management
Reporter: Brian Stansberry
Fix For: 7.0.0.M1
Mechanism(s) by which a ServerManager finds a DomainController so it can begin the process of integrating into the domain.
Task includes the host.xml schema elements to configure this, the domain object model classes behind those elements, and the actual implementation of discovery from both the ServerManager and DomainController sides.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 10 months