7:40 p.m.
JMX Console not secured by default
----------------------------------
Key: JBAS-4167
URL: http://jira.jboss.com/jira/browse/JBAS-4167
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public (Everyone can see)
Reporter: Ryan Campbell
Assigned To: Dimitris Andreadis
Fix For: JBossAS-4.2.0.CR1
The jmx and web consoles should be inaccessible to remote hosts by default upon
installation. However, I just installed the alpha build and was able to access the jmx
console remotely. Steps to reproduce
./run.sh -b $MYTESTIP
Everything starts up correctly. However, I can access $MYTESTIP:8080/jmx-console from my
browser without restriction
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
7:42 p.m.
New subject: [JBoss JIRA] Commented: (JBAS-4167) JMX Console not secured by default
[ http://jira.jboss.com/jira/browse/JBAS-4167?page=comments#action_12354777 ]
Ryan Campbell commented on JBAS-4167:
-------------------------------------
However this is fixed, the user (and the test suite :-) should be able to easily disable
it without having to go through 1000's of lines of XML.
JMX Console not secured by default
----------------------------------
Key: JBAS-4167
URL: http://jira.jboss.com/jira/browse/JBAS-4167
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Reporter: Ryan Campbell
Assigned To: Dimitris Andreadis
Fix For: JBossAS-4.2.0.CR1
The jmx and web consoles should be inaccessible to remote hosts by default upon
installation. However, I just installed the alpha build and was able to access the jmx
console remotely. Steps to reproduce
./run.sh -b $MYTESTIP
Everything starts up correctly. However, I can access $MYTESTIP:8080/jmx-console from my
browser without restriction
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:14 a.m.
New subject: [JBoss JIRA] Closed: (JBAS-4167) JMX Console not secured by default
[ http://jira.jboss.com/jira/browse/JBAS-4167?page=all ]
Dimitris Andreadis closed JBAS-4167.
------------------------------------
Fix Version/s: (was: JBossAS-4.2.0.CR1)
Resolution: Rejected
Ryan, I'm not going to fix this. I've changed the default binding to localhost as
a compromise. Locking up the consoles with password and stuff is a responsibility of
whoever installs the server (installer, installation script, whatever).
JMX Console not secured by default
----------------------------------
Key: JBAS-4167
URL: http://jira.jboss.com/jira/browse/JBAS-4167
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Reporter: Ryan Campbell
Assigned To: Dimitris Andreadis
The jmx and web consoles should be inaccessible to remote hosts by default upon
installation. However, I just installed the alpha build and was able to access the jmx
console remotely. Steps to reproduce
./run.sh -b $MYTESTIP
Everything starts up correctly. However, I can access $MYTESTIP:8080/jmx-console from my
browser without restriction
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:08 a.m.
New subject: [JBoss JIRA] Commented: (JBAS-4167) JMX Console not secured by default
[ http://jira.jboss.com/jira/browse/JBAS-4167?page=comments#action_12354792 ]
Dimitris Andreadis commented on JBAS-4167:
------------------------------------------
jboss-dev list discussion:
Dimitris:
I'm very much in favor of setting the default bind address to localhost, instead of
0.0.0.0. I think it's the best compromise between developer easy of use and addressing
security concerns for a default installation.
Scott M Stark wrote:
For whatever reason our long standing use of unsecured consoles is
now
being reported as a security hole. To address this, either we need to
bind to localhost by default or secure the consoles with a user that has
no access. The latter requires a post install change to add a valid role
or remove the security settings. We can't go with a default admin/admin
password.
The localhost approach would allow testsuites to continue to work as
they currently do and is probably the least intrusive change. Any other
opinions or options?
JMX Console not secured by default
----------------------------------
Key: JBAS-4167
URL: http://jira.jboss.com/jira/browse/JBAS-4167
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Reporter: Ryan Campbell
Assigned To: Dimitris Andreadis
The jmx and web consoles should be inaccessible to remote hosts by default upon
installation. However, I just installed the alpha build and was able to access the jmx
console remotely. Steps to reproduce
./run.sh -b $MYTESTIP
Everything starts up correctly. However, I can access $MYTESTIP:8080/jmx-console from my
browser without restriction
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:33 p.m.
New subject: [JBoss JIRA] Commented: (JBAS-4167) JMX Console not secured by default
[ http://jira.jboss.com/jira/browse/JBAS-4167?page=comments#action_12357866 ]
Johnny Walker commented on JBAS-4167:
-------------------------------------
Binding to localhost is great - except that I'm running more than 1 instance on the
same server in a 64 bit windows environment.
Setting up weak basic auth means I have to edit at least 4 files per jmx, web-console on
each instance, so for this project that's 5 instances across 3 servers - 20 or more
files just for BASIC auth ??
Wouldn't a gui to create key based auth be nice?
I suppose I'll go the quick route and setup LDAP... (more work than I was looking
for)
JMX Console not secured by default
----------------------------------
Key: JBAS-4167
URL: http://jira.jboss.com/jira/browse/JBAS-4167
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Reporter: Ryan Campbell
Assigned To: Dimitris Andreadis
The jmx and web consoles should be inaccessible to remote hosts by default upon
installation. However, I just installed the alpha build and was able to access the jmx
console remotely. Steps to reproduce
./run.sh -b $MYTESTIP
Everything starts up correctly. However, I can access $MYTESTIP:8080/jmx-console from my
browser without restriction
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:36 a.m.
New subject: [JBoss JIRA] Commented: (JBAS-4167) JMX Console not secured by default
[ http://jira.jboss.com/jira/browse/JBAS-4167?page=comments#action_12357891 ]
Dimitris Andreadis commented on JBAS-4167:
------------------------------------------
Yes, LDAP would be the correct choice.
JMX Console not secured by default
----------------------------------
Key: JBAS-4167
URL: http://jira.jboss.com/jira/browse/JBAS-4167
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Reporter: Ryan Campbell
Assigned To: Dimitris Andreadis
The jmx and web consoles should be inaccessible to remote hosts by default upon
installation. However, I just installed the alpha build and was able to access the jmx
console remotely. Steps to reproduce
./run.sh -b $MYTESTIP
Everything starts up correctly. However, I can access $MYTESTIP:8080/jmx-console from my
browser without restriction
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6991
days inactive
7019
days old
5 comments
3 participants
participants (3)
-
Dimitris Andreadis (JIRA) -
Johnny Walker (JIRA)
-
Ryan Campbell (JIRA)