[jboss-as7-dev] How hard would it be to support key based auth by default to make life simpler and more secure ?

[Darran Lofthouse]

It would need to be SSL not SSH as we need to support the mechanism for 
both the Native interface and the HTTP interface but I am starting to 
like this as an out of the box scenario.

The advantage we have for the browser is we can always display a nice 
HTML page when they connect with full instructions, it is the other 
mechanisms where we have less opportunity to dynamically provide guidance.

On 11/14/2011 01:42 PM, Bill Burke wrote:
> You could just have the app-server automatically generate the keys for
> you the first time it ever boots (or even every boot cycle).  Just have
> the CLI look at a pre-defined directory for the generated key-pair.  THe
> idea here is that CLI works perfectly out-of-the-box with no config on
> the same machine as the CLI runs on.  What is still protected is a
> remote machine accessing the app-server.  This is fine, IMO.
>
> Usability problems still exist though as you would need to import the
> client-auth key into your browser.  But, maybe this is a good thing as
> it will require the user to think about how they want to secure the
> app-server.
>
> On 11/14/11 6:40 AM, Max Rydahl Andersen wrote:
>>>>>
>>>>> These will make all examples that uses maven deploy plugin, cli scripts, arquillian, jboss tools etc. to somehow
>>>>> either tell users to type in their username and full password in clear text in pom.xml and other files.
>>>>>
>>>>> Which sounds worse to me than a default locked down to only localhost…but I'm not a security expert :)
>>>>>
>>>>> I was wondering how hard it would be to make the authentication support key based auth by default and we make
>>>>> the tools use ${user.name} and ${user.home}/.jboss/default.pub and .priv (or some other name) for the public/private keys ?
>>>>
>>>> You would need a key-based SASL authentication mechanism.  There are no
>>>> standard ones as of right now.  If you know of a key-based SASL
>>>> mechanism that you think we should support, let me know and we'll
>>>> evaluate it.
>>>
>>> We would have to do noauth + SSL + trust. I think it's an option worth considering. The big problem though is that we have to have a setup process to generate the certs, which is greater complexity than the user/pass option. We would have to generate a host key pair and a client key pair.
>>
>>
>> I'm not an expert on these things at all but eclipse uses http://www.jcraft.com/jsch/ to manage and create ssh keys and uses the standard .ssh location's etc.
>>
>> Is something additional needed ?
>>
>> /max
>> http://about.me/maxandersen
>>
>>
>>
>>
>> _______________________________________________
>> jboss-as7-dev mailing list
>> jboss-as7-dev at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/jboss-as7-dev
>