Securing JMXConnectorServerService (jmx-remoting.sar) in JBoss 5.1.0.GA - security

Question

I've been trying to understand how to secure the JMXConnectorServerService offered by JBoss 5.1.0.GA by default.
Currently, if I paste the following URL into JConsole, I can get to JMX directly without any authentication: service:jmx:rmi:///jndi/rmi://:1290/jmxconnector
Then I did this to secure my JMXInvoker in hopes that that would secure all JMX access: http://objectopia.com/2009/10/01/securing-jmx-invoker-layer-in-jboss/
But, apparently, that doesn't apply to the JMXConnectorServerService. I can still get to JMX using the the above service URL through jconsole.
Then I found out about this feature request that hasn't been accommodated yet: https://issues.jboss.org/browse/JBAS-8159
Now, presently I'm not worried about crazy security measures. This URL is not gonna be exposed to the outside network. So, I just want to see what's the simplest way for me to secure the jmx-remoting.sar with the "jmx-console" security domain?
I could switch to the default MBean server, but apparently, in 5.1.0.GA, that's a pain: https://community.jboss.org/thread/153594
I'd really appreciate any input in this regard.
Thanks!

Answer 1

I don't think that service has been secured, but there is a patch.
For a slightly simpler version, I am going out on a limb here, since I have not tested this on AS 5, but I backported it to AS 4 and it worked ok.
I'm not sure which version you have, exactly, but let's assume it is this one. The EAP version has a slightly more involved version, but the premise is the same. You will need to extend JMXConnectorServerService and JMXConnectorServerServiceMBean.
In this implementation, the code to create the server looks like this:
// create new connector server and start it
connectorServer = JMXConnectorServerFactory.newJMXConnectorServer(url, null, mbeanServer);
In your extension, add the following:
/** The name of the JAAS domain to use for authentication */
protected String jaasDomain = null;
...
/**
* Returns the name of the JAAS domain to use for authentication
* #return the name of a JAAS Domain
*/
public String getJaasDomain() {
return jaasDomain;
}
/**
* Sets the name of the JAAS domain to use for authentication
* #param jaasDomain the JAAS Domain to use for authentication
*/
public void setJaasDomain(String jaasDomain) {
this.jaasDomain = jaasDomain;
}
Now you need to reimplement the start method which adds an environment containing the JAAS domain name you want to authenticate with.
public void start() throws Exception
{
// the address to expose in the urls
String host = System.getProperty("java.rmi.server.hostname");
// check to see if registry already created
rmiRegistry = LocateRegistry.getRegistry(host, registryPort);
if (rmiRegistry != null)
{
try
{
rmiRegistry.list();
}
catch(RemoteException e)
{
log.debug("No registry running at host '" + host +
"', port '" + registryPort + "'. Will create one.");
rmiRegistry = LocateRegistry.createRegistry(registryPort, null, new DefaultSocketFactory(bindAddress));
}
}
else
{
rmiRegistry = LocateRegistry.createRegistry(registryPort, null, new DefaultSocketFactory(bindAddress));
}
String serviceURL = "service:jmx:rmi://" + host + "/jndi/rmi://" + host + ":" + registryPort + jndiPath;
JMXServiceURL url = new JMXServiceURL(serviceURL);
// create new connector server and start it
// ==== NEW AUTH CODE HERE ====
final Map<String, Object> environment = new HashMap<String, Object>();
environment.put("jmx.remote.x.login.config", jaasDomain);
connectorServer = JMXConnectorServerFactory.newJMXConnectorServer(url, environment, mbeanServer);
// ==== NEW AUTH CODE ENDS ====
connectorServer.start();
log.info("JMX Connector server: " + serviceURL);
}
You can optionally validate the JAAS name like this:
/**
* Validates the name of the passed JAAS domain.
* If the name is not valid, a RuntimeException will the thrown.
* #param domain The name of the JAAS domain to validate.
*/
private void validateJaasDomain(String domain) {
try {
new LoginContext(domain);
} catch (Exception e) {
throw new RuntimeException("The JAAS Domain [" + domain + "] could not be loaded", e);
}
}
Add the jaasDomain attribute to the new MBean interface:
/**
* Returns the name of the JAAS domain to use for authentication
* #return the name of a JAAS Domain
*/
public String getJaasDomain();
/**
* Sets the name of the JAAS domain to use for authentication
* #param jaasDomain the JAAS Domain to use for authentication
*/
public void setJaasDomain(String jaasDomain);
Let's assume your new impl is com.vijay.JMXConnectorServerService and the new MBean is com.vijay.JMXConnectorServerServiceMBean; You deployment descriptor would look like this: (using the jmx-console jaas domain, since you probably have that secured....)
<!-- ======================================================== -->
<!-- Example Vijay JMX Remoting Service Configuration file -->
<!-- ======================================================== -->
<server>
<mbean code="com.vijay.JMXConnectorServerService"
name="jboss.remoting:service=JMXConnectorServer,protocol=rmi"
display-name="JMX Connector Server (RMI)">
<attribute name="BindAddress">
<!-- Get the port from the ServiceBindingManager -->
<value-factory bean="ServiceBindingManager" method="getStringBinding"
parameter="jboss.remoting:service=JMXConnectorServer,protocol=rmi"/>
</attribute>
<!-- if comment this out, will use 1099 as default and will conflict -->
<!-- with default JNP (JNDI) port. -->
<attribute name="RegistryPort">
<!-- Get the port from the ServiceBindingManager -->
<value-factory bean="ServiceBindingManager" method="getIntBinding"
parameter="jboss.remoting:service=JMXConnectorServer,protocol=rmi"/>
</attribute>
<!-- the path to which will be bound in rmi registry -->
<!-- the commented value below is the default. -->
<!-- <attribute name="JndiPath">/jmxconnector</attribute> -->
<attribute name="JaasDomain">jmx-console</attribute>
</mbean>
</server>
That's all I have. I hope it is useful to you.