[JBoss JIRA] Created: (JBAS-6926) Run JBoss on privileged port (80) without running as root
by Brad Maxwell (JIRA)
Run JBoss on privileged port (80) without running as root
---------------------------------------------------------
Key: JBAS-6926
URL: https://jira.jboss.org/jira/browse/JBAS-6926
Project: JBoss Application Server
Issue Type: Feature Request
Security Level: Public (Everyone can see)
Components: System service, Web (Tomcat) service
Reporter: Brad Maxwell
Assignee: Dimitris Andreadis
Many customers want to run JBoss Web on port 80 without running JBoss as root for security reasons. This is usually achieved by fronting JBoss with Apache & using mod_jk to proxy to JBoss or doing NAT on the machine. It would be nice if JBoss could be started as root but have configuration that would change to a non-root user after it has opened the ports such as port 80 for jboss-web, such as Apache and other app servers do.
Below are some possibilities to achieve this:
Changing UID is something that would have to be done via JNI (in other words, platform-specific compiled libraries - possibly more than one per platform [I'm thinking of hybrid 32/64-bit platforms]). That said I could envision a couple possible solutions for UNIX platforms (all would require development work however):
Solution 1
----------
- JBAS starts up by running Main
- Main notices a special configuration option to bind certain ports upfront, stores those bound sockets for later
- Main notices a special configuration option to switch UID, uses the JNI stub to do so
- Commence normal bootstrap
- JBossWeb (or any other network component) has a provision to re-use pre-bound sockets
- On redeploy or connector undeploy, those sockets had better not be closed or else they won't be able to be re-bound
Solution 2
----------
- A separate "binder" program is written (in C) which creates a AF_UNIX socket with restricted permissions and runs as root
- JBAS starts up, runs through bootstrap normally as a non-priv user
- Rather than creating a ServerSocket, JBAS uses a JNI stub to connect to the AF_UNIX socket, and send a request to bind a privileged socket address
- The "binder" program binds the address and sends the file descriptor back over the AF_UNIX socket, and closes its local copy of the server socket
- JBAS reads that server socket back off the AF_UNIX socket
(note that this is arguably slightly more elegant as a custom ServerSocketFactory could do this transparently for non-NIO usages)
Solution 3 (Linux only)
-----------------------
- Run JBAS with CAP_NET_BIND_SERVICE
Note that these solutions all rely on platform-specific mechanisms, because it's a platform-specific problem. The best we can do is come up with a way to distribute the JNI guts in such a way that it doesn't *look* like a platform-specific solution.
- DML
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
16 years, 9 months
[JBoss JIRA] Created: (EJBTHREE-1930) Timeouts for RMI-Calls to EJBs
by Bernd Köcke (JIRA)
Timeouts for RMI-Calls to EJBs
------------------------------
Key: EJBTHREE-1930
URL: https://jira.jboss.org/jira/browse/EJBTHREE-1930
Project: EJB 3.0
Issue Type: Feature Request
Components: ejb3
Environment: Linux, SUN-Java5-20, JBoss 4.0.2, JBoss 4.2.3.GA
Reporter: Bernd Köcke
Attachments: tif-1.1.zip
I would like to introduce client defined timeouts for RMI-Calls to EJBs. We have EJBs which are called from webfrontends and background processes. The Frontends have strong timing demands, e.g they only want to wait 50ms to get an answer but they accept to goon without it. This can be solved by application desing, but we have running applications which should not change. By looking into the code I found that it should be enough to set the SO-Timeout on the clients socket and the goal was to do this without changes in the clients code and the EJBs. So I build a small framework that the client only needs a jar- and a property-file to set timeouts for the RMI-Calls. I build this for EJB 2.1 on JBossAS 4.0.2 and EJB 2.1 + 3 for 4.2.3.GA. I talked to Carlo and he said that the latter could be interesting. It is installed on the server side by additonal JARs and configuration, no patches to existing JBoss code is needed.
The attachment is a complete Maven Eclipse project with sources, classes and artifacts. The framework is called "Timed Invoker Framework" (TIF). I added JBoss deployment descriptor fragments to the ZIP and a readme PDF. The PDF is a copy of my internal Wiki page which describes usage and installation of TIF and the source contains JavaDoc.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
16 years, 9 months