[JBoss JIRA] Created: (JBAS-5092) JMX Invoker security should use a role to control security
by Stephen Burdeau (JIRA)
JMX Invoker security should use a role to control security
----------------------------------------------------------
Key: JBAS-5092
URL: http://jira.jboss.com/jira/browse/JBAS-5092
Project: JBoss Application Server
Issue Type: Feature Request
Security Level: Public (Everyone can see)
Components: JMX
Affects Versions: JBossAS-4.2.0.GA
Reporter: Stephen Burdeau
Assigned To: Dimitris Andreadis
The JMX Invoker is secured using the security domain java:/jaas/jmx-console. However, there appears to be no way to specify a particular role (e.g., JBossAdmin).
This means that if a "userA" is added to the jmx-console-users.properties file, but "userA" is not added to any role, "userA" still has the privilege to perform JMX invoker requests, such as shutdown.
Obviously one solution in this case is to not add "userA" to the jmx-console-users.properties file.
However, the problem is more acute when a custom login module is developed. For example, a system administrator could develop a custom login module which validates a user against the operating system userid and password. The custom login module then uses another mechanism (e.g., flat file or database) to define the roles allowed for each user. However, since no role is required, any valid user on the system (e.g., "guest") would be granted access to the JMX Invoker.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
17 years
[JBoss JIRA] Created: (JBCOMMON-40) Make org.jboss.util.collection.Lazy* and WeakTypeCache Serializable
by Dimitris Andreadis (JIRA)
Make org.jboss.util.collection.Lazy* and WeakTypeCache Serializable
-------------------------------------------------------------------
Key: JBCOMMON-40
URL: http://jira.jboss.com/jira/browse/JBCOMMON-40
Project: JBoss Common
Issue Type: Task
Security Level: Public (Everyone can see)
Components: common-core
Reporter: Dimitris Andreadis
Assigned To: Dimitris Andreadis
Fix For: 2.2.3.GA
Author: alesj
Date: 2007-12-17 17:44:09 -0500 (Mon, 17 Dec 2007)
New Revision: 2685
Modified:
common-core/trunk/src/main/java/org/jboss/util/collection/LazyList.java
common-core/trunk/src/main/java/org/jboss/util/collection/LazyMap.java
common-core/trunk/src/main/java/org/jboss/util/collection/LazySet.java
common-core/trunk/src/main/java/org/jboss/util/collection/WeakTypeCache.java
Log:
Serializable lazy collections.
Having type defining methods protected.
Author: scott.stark(a)jboss.org
Date: 2007-12-17 18:04:11 -0500 (Mon, 17 Dec 2007)
New Revision: 2686
Modified:
common-core/trunk/src/main/java/org/jboss/util/collection/WeakTypeCache.java
Log:
Make all private methods protected
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
17 years
[JBoss JIRA] Created: (JBREM-878) Bad Padding Exception with Unified Invoker and SSL
by Andrew Oliver (JIRA)
Bad Padding Exception with Unified Invoker and SSL
--------------------------------------------------
Key: JBREM-878
URL: http://jira.jboss.com/jira/browse/JBREM-878
Project: JBoss Remoting
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: unifiedinvoker
Affects Versions: UnifiedInvoker 1.0.1
Reporter: Andrew Oliver
After following: http://wiki.jboss.org/wiki/Wiki.jsp?page=SSLEJB2.1
05:25:05,241 WARN [ServiceController] Problem starting service jboss.remoting:service=ServerSocketFactory,type=SSL
java.io.IOException: Error initializing server socket factory SSL context: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded
at com.sun.net.ssl.internal.ssl.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:1275)
at java.security.KeyStore.load(KeyStore.java:1150)
at org.jboss.remoting.security.SSLSocketBuilder.loadKeyStore(SSLSocketBuilder.java:1548)
at org.jboss.remoting.security.SSLSocketBuilder.loadKeyManagers(SSLSocketBuilder.java:1442)
at org.jboss.remoting.security.SSLSocketBuilder.initializeServerSocketFactorySSLContext(SSLSocketBuilder.java:1250)
at org.jboss.remoting.security.SSLSocketBuilder.createCustomServerSocketFactory(SSLSocketBuilder.java:366)
at org.jboss.remoting.security.SSLSocketBuilder.createSSLServerSocketFactory(SSLSocketBuilder.java:346)
at org.jboss.remoting.security.SSLSocketBuilder.createSSLServerSocketFactory(SSLSocketBuilder.java:325)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.jboss.mx.interceptor.ReflectedDispatcher.invoke(ReflectedDispatcher.java:155)
at org.jboss.mx.server.Invocation.dispatch(Invocation.java:94)
at org.jboss.mx.server.Invocation.invoke(Invocation.java:86)
at org.jboss.mx.server.AbstractMBeanInvoker.invoke(AbstractMBeanInvoker.java:264)
at org.jboss.mx.server.MBeanServerImpl.invoke(MBeanServerImpl.java:659)
at org.jboss.mx.util.MBeanProxyExt.invoke(MBeanProxyExt.java:210)
at $Proxy9.createSSLServerSocketFactory(Unknown Source)
at org.jboss.remoting.security.SSLServerSocketFactoryService.start(SSLServerSocketFactoryService.java:61)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.jboss.mx.interceptor.ReflectedDispatcher.invoke(ReflectedDispatcher.java:155)
at org.jboss.mx.server.Invocation.dispatch(Invocation.java:94)
at org.jboss.mx.server.Invocation.invoke(Invocation.java:86)
at org.jboss.mx.server.AbstractMBeanInvoker.invoke(AbstractMBeanInvoker.java:264)
at org.jboss.mx.server.MBeanServerImpl.invoke(MBeanServerImpl.java:659)
at org.jboss.system.ServiceController$ServiceProxy.invoke(ServiceController.java:995)
at $Proxy0.start(Unknown Source)
at org.jboss.system.ServiceController.start(ServiceController.java:417)
at org.jboss.system.ServiceController.start(ServiceController.java:435)
at sun.reflect.GeneratedMethodAccessor5.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.jboss.mx.interceptor.ReflectedDispatcher.invoke(ReflectedDispatcher.java:155)
at org.jboss.mx.server.Invocation.dispatch(Invocation.java:94)
at org.jboss.mx.server.Invocation.invoke(Invocation.java:86)
at org.jboss.mx.server.AbstractMBeanInvoker.invoke(AbstractMBeanInvoker.java:264)
at org.jboss.mx.server.MBeanServerImpl.invoke(MBeanServerImpl.java:659)
at org.jboss.mx.util.MBeanProxyExt.invoke(MBeanProxyExt.java:210)
at $Proxy4.start(Unknown Source)
at org.jboss.deployment.SARDeployer.start(SARDeployer.java:302)
at org.jboss.deployment.MainDeployer.start(MainDeployer.java:1025)
at org.jboss.deployment.MainDeployer.deploy(MainDeployer.java:819)
at org.jboss.deployment.MainDeployer.deploy(MainDeployer.java:782)
at org.jboss.deployment.MainDeployer.deploy(MainDeployer.java:766)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.jboss.mx.interceptor.ReflectedDispatcher.invoke(ReflectedDispatcher.java:155)
at org.jboss.mx.server.Invocation.dispatch(Invocation.java:94)
at org.jboss.mx.interceptor.AbstractInterceptor.invoke(AbstractInterceptor.java:133)
at org.jboss.mx.server.Invocation.invoke(Invocation.java:88)
at org.jboss.mx.interceptor.ModelMBeanOperationInterceptor.invoke(ModelMBeanOperationInterceptor.java:142)
at org.jboss.mx.server.Invocation.invoke(Invocation.java:88)
at org.jboss.mx.server.AbstractMBeanInvoker.invoke(AbstractMBeanInvoker.java:264)
at org.jboss.mx.server.MBeanServerImpl.invoke(MBeanServerImpl.java:659)
at org.jboss.mx.util.MBeanProxyExt.invoke(MBeanProxyExt.java:210)
at $Proxy5.deploy(Unknown Source)
at org.jboss.system.server.ServerImpl.doStart(ServerImpl.java:482)
at org.jboss.system.server.ServerImpl.start(ServerImpl.java:362)
at org.jboss.Main.boot(Main.java:200)
at org.jboss.Main$1.run(Main.java:508)
at java.lang.Thread.run(Thread.java:595)
<!-- This section is for custom (SSL) server socket factory -->
<mbean code="org.jboss.remoting.security.SSLSocketBuilder"
name="jboss.remoting:service=SocketBuilder,type=SSL"
display-name="SSL Server Socket Factory Builder">
<attribute name="UseSSLServerSocketFactory">false</attribute>
<attribute name="KeyStoreURL">ourcorp.keystore</attribute>
<attribute name="KeyStorePassword">sslsocket</attribute>
<attribute name="KeyPassword">ourcorp999</attribute>
<attribute name="SecureSocketProtocol">TLS</attribute>
<!-- attribute name="KeyManagementAlgorithm">SunX509</attribute -->
<attribute name="KeyStoreType">PKCS12</attribute>
</mbean>
<mbean code="org.jboss.remoting.security.SSLServerSocketFactoryService"
name="jboss.remoting:service=ServerSocketFactory,type=SSL"
display-name="SSL Server Socket Factory">
<depends optional-attribute-name="SSLSocketBuilder"
proxy-type="attribute">jboss.remoting:service=SocketBuilder,type=SSL</depends>
</mbean>
<mbean code="org.jboss.remoting.transport.Connector"
name="jboss.remoting:service=Connector,transport=sslsocket">
display-name="SSL Socket transport Connector">
<attribute name="Configuration">
<config>
<invoker transport="sslsocket">
<attribute name="serverSocketFactory">jboss.remoting:service=ServerSocketFactory,type=SSL</attribute>
<attribute name="serverBindAddress">${jboss.bind.address}</attribute>
<attribute name="serverBindPort">3843</attribute>
</invoker>
<handlers>
<handler subsystem="invoker">jboss:service=invoker,type=unified</handler>
</handlers>
</config>
</attribute>
<!--If you specify the keystore and password in the command line and you're not using the custom ServerSocketFactory, you should take out the following line-->
<depends>jboss.remoting:service=ServerSocketFactory,type=SSL</depends>
<depends>jboss.remoting:service=NetworkRegistry</depends>
</mbean>
(ourcorp was a find and replace)
Note that the KeyManagementAlgoyrythm attribute doesn't exist and was commented out. This very same keystore works with the JRPM/SSL/SecurityDomain setup with JBoss 4.0.2 etc without error. Multiple different ways were used to reference the keystore file, a bad filename results in a different error.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
17 years