|
jboss默认配置了以下服务：
JMX Console
JBoss Web Console
为了安全起见，需要用户通过授权进行访问。
一、JMX安全配置
STEP 1：
找到%JBOSS_HOME%/server/default/deploy/jmx-console.war/WEB-INF/jboss-web.xml文件，根据说明，去掉注释。
<jboss-web>
<security-domain>java:/jaas/jmx-console</security-domain>
</jboss-web>
STEP 2：
与jboss-web.xml同级目录下还有一个文件web.xml，找到其中的节点，根据说明，取消注释。
<security-constraint>
<web-resource-collection>
<web-resource-name>HtmlAdaptor</web-resource-name>
<description>An example security config that only allows users with the
role JBossAdmin to access the HTML JMX console web application
</description>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>JBossAdmin</role-name>
</auth-constraint>
</security-constraint>
STEP 3：
在第一步中的jmx-console安全域和第二步中的运行角色JBossAdmin都是在login-config.xml中配置，我们在%
<application-policy name = "jmx-console">
<authentication>
<login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
flag = "required">
<module-option name="usersProperties">props/jmx-console-users.properties</module-option>
<module-option name="rolesProperties">props/jmx-console-roles.properties</module-option>
</login-module>
</authentication>
</application-policy>
文件props/jmx-console-users.properties定义了用户名、密码；props/jmx-console-roles.properties定义了用户所属角色
注：
jmx-console-users.properties 格式是：用户名=密码明文
jmx-console-roles.properties 格式是：用户名=角色1,角色2,角色3
二、WEB-CONSOLE的安全配置
STEP 1：
找到%JBOSS_HOME%/server/default/deploy/ management/console-mgr.sar/web-console.war/WEB-INF/jboss-web.xml文件，根据说明，去掉注释。
<jboss-web>
<depends>jboss.admin:service=PluginManager</depends>
</jboss-web>
STEP 2：
与jboss-web.xml同级目录下还有一个文件web.xml，找到其中的节点，根据说明，取消注释。
<security-constraint>
<web-resource-collection>
<web-resource-name>HtmlAdaptor</web-resource-name>
<description>An example security config that only allows users with the
role JBossAdmin to access the HTML JMX console web application
</description>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>JBossAdmin</role-name>
</auth-constraint>
</security-constraint>
STEP 3：
在本目录的classes文件夹下找到web-console-users.properties和web-console-roles.properties两个文件更名为：
<application-policy name = "web-console">
<authentication>
<login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
flag = "required">
<module-option name="usersProperties">users.properties</module-option>
<module-option name="rolesProperties">roles.properties</module-option>
</login-module>
</authentication>
</application-policy>
启动服务输入http://localhost:8080/
然后分别点击JMX Console以及Jboss Web Console测试安全机制
user.properties和role.propertie并修改users.properties其中的用户名和密码修改%JBOSS_HOME%/server/default/conf/login-config.xml中web-console节点修改为以下：
到后自行修改或重新定义用户名、密码。JBOSS_HOME%/server/default/config下找到它。查找名字为：jmx-console的application-policy：
============================================================================
8.10. How to Secure the JBoss Server
JBoss comes with several admin access points that need to be secured or removed to prevent unauthorized access to administrative functions in a deployment. This section describes the various admin services and how to secure them.
The jmx-console.war found in the deploy directory provides an html view into the JMX microkernel. As such, it provides access to arbitrary admin type access like shutting down the server, stopping services, deploying new services, etc. It should either be secured like any other web application, or removed.
The web-console.war found in the deploy/management directory is another web application view into the JMX microkernel. This uses a combination of an applet and a HTML view and provides the same level of access to admin functionality as the jmx-console.war. As such, it should either be secured or removed. The web-console.war contains commented out templates for basic security in its WEB-INF/web.xml as well as commented out setup for a security domain in WEB-INF/jboss-web.xml.
8.10.3. The HTTP Invokers
The http-invoker.sar found in the deploy directory is a service that provides RMI/HTTP access for EJBs and the JNDI Naming service. This includes a servlet that processes posts of marshalled org.jboss.invocation.Invocation objects that represent invocations that should be dispatched onto the MBeanServer. Effectively this allows access to MBeans that support the detached invoker operation via HTTP since one could figure out how to format an appropriate HTTP post. To security this access point you would need to secure the JMXInvokerServlet servlet found in the http-invoker.sar/invoker.war/WEB-INF/web.xml descriptor. There is a secure mapping defined for the /restricted/JMXInvokerServlet path by default, one would simply have to remove the other paths and configure the http-invoker security domain setup in the http-invoker.sar/invoker.war/WEB-INF/jboss-web.xml descriptor.
The jmx-invoker-adaptor-server.sar is a service that exposes the JMX MBeanServer interface via an RMI compatible interface using the RMI/JRMP detached invoker service. The only way for this service to be secured currently would be to switch the protocol to RMI/HTTP and secure the http-invoker.sar as described in the previous section. In the future this service will be deployed as an XMBean with a security interceptor that supports role based access checks.
|
