security - 在 JBoss 5.1.0.GA 中保护 JMXConnectorServerService (jmx-remoting.sar)

Question

我一直在尝试了解如何保护 JBoss 5.1.0.GA 默认提供的 JMXConnectorServerService。

目前，如果我将以下 URL 粘贴到 JConsole 中，则无需任何身份验证即可直接访问 JMX:service:jmx:rmi:///jndi/rmi://:1290/jmxconnector

然后我这样做是为了保护我的 JMXInvoker，希望这样可以保护所有 JMX 访问:http://objectopia.com/2009/10/01/securing-jmx-invoker-layer-in-jboss/

但是，显然，这不适用于 JMXConnectorServerService。我仍然可以通过 jconsole 使用上述服务 URL 访问 JMX。

然后我发现了这个功能请求还没有被满足:https://issues.jboss.org/browse/JBAS-8159

现在，目前我并不担心疯狂的安全措施。此 URL 不会暴露给外部网络。所以，我只想看看用“jmx-console”安全域保护 jmx-remoting.sar 的最简单方法是什么？

我可以切换到默认的 MBean 服务器，但显然，在 5.1.0.GA 中，这很痛苦:https://community.jboss.org/thread/153594

我非常感谢在这方面的任何意见。

谢谢!

Answer 1

我不认为该服务已得到保障，但有一个 patch .

对于一个稍微简单一点的版本，我会在这里冒险，因为我没有在 AS 5 上测试过，但是我将它向后移植到 AS 4 并且它工作正常。

我不确定您使用的是哪个版本，但我们假设它是 this one . EAP 版本有一个稍微复杂的版本，但前提是一样的。您需要延长 JMXConnectorServerService和 JMXConnectorServerServiceMBean .

在这个实现中，创建服务器的代码如下所示:

// create new connector server and start it
connectorServer = JMXConnectorServerFactory.newJMXConnectorServer(url, null, mbeanServer);

在您的扩展程序中，添加以下内容:

/** The name of the JAAS domain to use for authentication */
protected String jaasDomain = null; 
...
/**
   * Returns the name of the JAAS domain to use for authentication
   * @return the name of a JAAS Domain
   */
public String getJaasDomain() {
   return jaasDomain;
}

/**
  * Sets the name of the JAAS domain to use for authentication
  * @param jaasDomain the JAAS Domain to use for authentication
  */
public void setJaasDomain(String jaasDomain) {
   this.jaasDomain = jaasDomain;
}

现在您需要重新实现 开始方法，该方法添加包含您要进行身份验证的 JAAS 域名的环境。

   public void start() throws Exception
   {
      // the address to expose in the urls
      String host = System.getProperty("java.rmi.server.hostname");

      // check to see if registry already created
      rmiRegistry = LocateRegistry.getRegistry(host, registryPort);
      if (rmiRegistry != null)
      {
         try
         {
            rmiRegistry.list();
         }
         catch(RemoteException e)
         {
            log.debug("No registry running at host '" + host +
                  "', port '" + registryPort + "'.  Will create one.");
            rmiRegistry = LocateRegistry.createRegistry(registryPort, null, new DefaultSocketFactory(bindAddress));
         }
      }
      else
      {
         rmiRegistry = LocateRegistry.createRegistry(registryPort, null, new DefaultSocketFactory(bindAddress));
      }

      String serviceURL = "service:jmx:rmi://" + host + "/jndi/rmi://" + host + ":" + registryPort + jndiPath;

      JMXServiceURL url = new JMXServiceURL(serviceURL);

      // create new connector server and start it
      // ==== NEW AUTH CODE HERE ====
      final Map<String, Object> environment = new HashMap<String, Object>();
      environment.put("jmx.remote.x.login.config", jaasDomain);
      connectorServer = JMXConnectorServerFactory.newJMXConnectorServer(url, environment, mbeanServer);
      // ==== NEW AUTH CODE ENDS ====
      connectorServer.start();

      log.info("JMX Connector server: " + serviceURL);
   }

您可以选择验证 JAAS 名称，如下所示:

/**
 * Validates the name of the passed JAAS domain. 
 * If the name is not valid, a RuntimeException will the thrown.
 * @param domain The name of the JAAS domain to validate.
 */
private void validateJaasDomain(String domain) {
    try {
        new LoginContext(domain);
    } catch (Exception e) {
        throw new RuntimeException("The JAAS Domain [" + domain + "] could not be loaded", e);
    }
}

将 jaasDomain 属性添加到新的 MBean 接口(interface):

/**
 * Returns the name of the JAAS domain to use for authentication
 * @return the name of a JAAS Domain
 */
public String getJaasDomain();

/**
 * Sets the name of the JAAS domain to use for authentication
 * @param jaasDomain the JAAS Domain to use for authentication
 */
public void setJaasDomain(String jaasDomain);

假设您的新 impl 是 com.vijay.JMXConnectorServerService 新的 MBean 是 com.vijay.JMXConnectorServerServiceMBean ;您的部署描述符将如下所示:(使用 jmx-console jaas 域，因为您可能已经获得了安全......)

<!-- ======================================================== -->
<!-- Example Vijay JMX Remoting Service Configuration file        -->
<!-- ======================================================== -->
<server>

   <mbean code="com.vijay.JMXConnectorServerService"
      name="jboss.remoting:service=JMXConnectorServer,protocol=rmi"
      display-name="JMX Connector Server (RMI)">
           <attribute name="BindAddress">
               <!-- Get the port from the ServiceBindingManager -->
               <value-factory bean="ServiceBindingManager" method="getStringBinding" 
                  parameter="jboss.remoting:service=JMXConnectorServer,protocol=rmi"/>
            </attribute>
            <!-- if comment this out, will use 1099 as default and will conflict -->
            <!-- with default JNP (JNDI) port. -->
            <attribute name="RegistryPort">
               <!-- Get the port from the ServiceBindingManager -->
               <value-factory bean="ServiceBindingManager" method="getIntBinding" 
                  parameter="jboss.remoting:service=JMXConnectorServer,protocol=rmi"/>
            </attribute>
            <!-- the path to which will be bound in rmi registry -->
            <!-- the commented value below is the default. -->
            <!-- <attribute name="JndiPath">/jmxconnector</attribute> -->
            <attribute name="JaasDomain">jmx-console</attribute>
   </mbean>
</server>

那是我的全部了。我希望它对你有用。