Review the out of the box security settings ------------------------------------------- Key: AS7-1710 URL: https://issues.jboss.org/browse/AS7-1710 Project: Application Server 7 Issue Type: Task Components: Domain Management, Security Reporter: Darran Lofthouse Assignee: Darran Lofthouse Priority: Critical Fix For: 7.1.0.Beta1

Secure the management interfaces by default ------------------------------------------- Key: AS7-1710 URL: https://issues.jboss.org/browse/AS7-1710 Project: Application Server 7 Issue Type: Task Components: Domain Management, Security Reporter: Darran Lofthouse Assignee: Darran Lofthouse Priority: Blocker Fix For: 7.1.0.Beta1 The two management interfaces will be secured by default out of the box, this is prevent accidentally making management operations available publicly. The properties based realm has already been updated to support pre-hashed passwords and a utility script has been provided for generating the hashes, also changes to the properties file are now detected at runtime so the users can be added after the AS instance has been started. The script can be called as: - bin\digest-password.sh username realm password The default realm unless changed is 'ManagementRealm'. The output from the script can be re directly into the corresponding mgmt-users.properties