[jboss-jira] [JBoss JIRA] Commented: (JBAS-8159) Secure jmx-remoting.sar

[ https://jira.jboss.org/browse/JBAS-8159?page=com.atlassian.jira.plugin.sy... ] Xavier MOGHRABI commented on JBAS-8159: --------------------------------------- The patch is complete for securing the JMX JSR160 connector for JBoss 5.x as the provided version is not secured. In fact, the security relies on JRE , see : http://blogs.sun.com/lmalventosa/entry/jmx_authentication_authorization To secure the connector, I've added those properties : <attribute name="AuthNMethod">jmx.remote.x.login.config</attribute> <attribute name="AuthNParameter">jmx-console</attribute> <attribute name="AuthZMethod">jmx.remote.x.access.rolebased</attribute> <attribute name="AuthZParameter">JBossAdmin</attribute> AuthNMethod represents one of the authentication method available in the JRE : jmx.remote.x.login.config (JAAS), jmx.remote.x.password.file (File base) AuthNParameter represents the JAAS domain or the file containing the password. AuthZMethod represents one of the authorization method available in the JRE : jmx.remote.x.access.file (File base) or custom one based one role : jmx.remote.x.access.rolebased AuthZParameter represents the file containing the access rights or the role that grants the access. The only thing I really wrote is the role based authz. It can be approve since I didn't do a distinction between readonly and readwrite. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira