在 Artemis 上实现 SSL，但具有无效信任存储和用户凭据的客户端能够连接到代理

Question

我在 Spring Boot 客户端上使用 JMS 通过 SSL 连接到 ActiveMQ Artemis 代理。无论信任库中证书的有效性如何，即使使用了无效的凭据，客户端也能够连接。如何确保代理根据配置​​的参数过滤客户端？acceptors在 broker.xml定义如下所示。 SSL 接受器使用端口 61617 .

<acceptors>
<!-- Acceptor for every supported protocol -->
     <acceptor name="artemis">tcp://0.0.0.0:61616?tcpSendBufferSize=1048576;tcpReceiveBufferSize=1048576;amqpMinLargeMessageSize=102400;protocols=CORE,AMQP,STOMP,HORNETQ,MQTT,OPENWIRE;useEpoll=true;amqpCredits=1000;amqpLowCredits=300;amqpDuplicateDetection=true;supportAdvisory=false;suppressInternalManagementObjects=false</acceptor>

     <!-- AMQP Acceptor.  Listens on default AMQP port for AMQP traffic.-->
     <acceptor name="amqp">tcp://0.0.0.0:5672?tcpSendBufferSize=1048576;tcpReceiveBufferSize=1048576;protocols=AMQP;useEpoll=true;amqpCredits=1000;amqpLowCredits=300;amqpMinLargeMessageSize=102400;amqpDuplicateDetection=true</acceptor>

     <!-- STOMP Acceptor. -->
     <acceptor name="stomp">tcp://0.0.0.0:61613?tcpSendBufferSize=1048576;tcpReceiveBufferSize=1048576;protocols=STOMP;useEpoll=true</acceptor>

     <!-- HornetQ Compatibility Acceptor.  Enables HornetQ Core and STOMP for legacy HornetQ clients. -->
     <acceptor name="hornetq">tcp://0.0.0.0:5445?anycastPrefix=jms.queue.;multicastPrefix=jms.topic.;protocols=HORNETQ,STOMP;useEpoll=true</acceptor>

     <!-- MQTT Acceptor -->
     <acceptor name="mqtt">tcp://0.0.0.0:1883?tcpSendBufferSize=1048576;tcpReceiveBufferSize=1048576;protocols=MQTT;useEpoll=false</acceptor>
     
     <!-- SSL Acceptor -->
    <acceptor name="netty-ssl-acceptor">tcp://0.0.0.0:61617?tcpSendBufferSize=1048576;tcpReceiveBufferSize=1048576;sslEnabled=true;keyStorePath=E:/apache-artemis-2.18.0/bin/localBroker/etc/sprink.jks;keyStorePassword=changeit;trustStorePath=E:/apache-artemis-2.18.0/bin/localBroker/etc/sprinktrust.ts;trustStorePassword=changeit;needClientAuth=true;protocols=CORE,AMQP,STOMP,HORNETQ,MQTT,OPENWIRE</acceptor>

 </acceptors>

连接工厂、监听器、JmsTemplate在spring boot客户端配置如下图

import org.apache.activemq.artemis.jms.client.ActiveMQConnectionFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.jms.annotation.EnableJms;
import org.springframework.jms.config.DefaultJmsListenerContainerFactory;
import org.springframework.jms.core.JmsTemplate;


import javax.jms.JMSException;


@Configuration
@EnableJms
public class MQTTConfig {

    @Value("${activemq.broker-url}")
    private String brokerUrl;

    @Value("${activemq.ssl-url}")
    private String sslUrl;

    @Value("${JMS_BROKER_TRUSTSTORE}")
    private String pathToTrustStore;

    @Value("${JMS_BROKER_KEYSTORE}")
    private String pathToKeystore;

    @Value("${JMS_BROKER_TRUSTSTORE_PASSWORD}")
    private String truststorePassword;

    @Value("${JMS_BROKER_KEYSTORE_PASSWORD}")
    private String keystorePassword;

    /**
     * Initialise the connection factory that will be used
     */

    @Bean
    public ActiveMQConnectionFactory artemisSSLConnectionFactory() {
        ActiveMQConnectionFactory artemisConnectionFactory = new ActiveMQConnectionFactory("tcp://localhost:61617?&" + "sslEnabled=true&" +
                "trustStorePath=" + pathToTrustStore + "&trustStorePassword=changeit&needClientAuth=true");
        artemisConnectionFactory.setUser("user");
        artemisConnectionFactory.setPassword("password");
        return artemisConnectionFactory;
    }

    /**
     * Initialise {@link JmsTemplate} as required
     */
    @Bean
    public JmsTemplate jmsTemplate() throws JMSException {
        JmsTemplate jmsTemplate = new JmsTemplate();
        jmsTemplate.setConnectionFactory(artemisSSLConnectionFactory());
        jmsTemplate.setExplicitQosEnabled(true);

        //setting PuSubDomain to true configures JmsTemplate to work with topics instead of queues
        jmsTemplate.setPubSubDomain(true);
        jmsTemplate.setDeliveryMode(DeliveryMode.NON_PERSISTENT);
        jmsTemplate.setDeliveryPersistent(true);
        return jmsTemplate;
    }

    /**
     * Initialise {@link DefaultJmsListenerContainerFactory} as required
     */
    @Bean
    public DefaultJmsListenerContainerFactory jmsListenerContainerFactory() throws JMSException {
        DefaultJmsListenerContainerFactory factory = new DefaultJmsListenerContainerFactory();
        factory.setConnectionFactory(artemisSSLConnectionFactory());
        //setting PuSubDomain to true configures the DefaultJmsListenerContainerFactory to work with topics instead of queues
        factory.setPubSubDomain(true);
        return factory;
    }

}

artemis-users.properties文件如下图

admin = ENC(1024...)
system=manager
user=password
guest=password

artemis-roles.properties定义了以下角色

admins = admin
users=user

管理员和用户已被授予 broker.xml 中的权限如下所示

<security-settings>
   <security-setting match="#">
      <permission type="createNonDurableQueue" roles="admins, users"/>
      <permission type="deleteNonDurableQueue" roles="admins, users"/>
      <permission type="createDurableQueue" roles="admins, users"/>
      <permission type="deleteDurableQueue" roles="admins, users"/>
      <permission type="createAddress" roles="admins, users"/>
      <permission type="deleteAddress" roles="admins, users"/>
      <permission type="consume" roles="admins, users"/>
      <permission type="browse" roles="admins, users"/>
      <permission type="send" roles="admins, users"/>
      <!-- we need this otherwise ./artemis data imp wouldn't work -->
      <permission type="manage" roles="admins"/>
   </security-setting>
</security-settings>

通过上述设置，任何具有任何信任库或用户名和密码的客户端都可以连接到端口 61617 上的代理。并产生和消费消息。我错过了什么让这种情况发生？

Answer 1

这就是让事情奏效的原因。
首先，login.config Artemis 上的文件有 GuestLoginModule那this link说被链接到 PropertiesLoginModule guest 模块允许没有凭据的客户端，甚至是无效的凭据连接到代理 .现在，默认情况下，GuestLoginModule看起来像这样

org.apache.activemq.artemis.spi.core.security.jaas.GuestLoginModule sufficient
    debug=false
    org.apache.activemq.jaas.guest.user="admin"
    org.apache.activemq.jaas.guest.role="admins";

请注意， guest 被视为管理员。我的 artemis-users.properties文件已有 guest用户定义(如我上面的原始帖子所示)，所以我创建了一个 guests artemis-roles.properties 中的组文件并将该 guest 用户分配给该组。然后我更改了 GuestLoginModule 中的管理映射以便模块引用客人。 GuestLoginModule现在看起来像这样:

org.apache.activemq.artemis.spi.core.security.jaas.GuestLoginModule sufficient
    debug=false
    org.apache.activemq.jaas.guest.user="guest"
    org.apache.activemq.jaas.guest.role="guests";

broker.xml 中的安全设置可以根据相关用例修改文件以适应 guest 功能，我的没有任何 guest 的用例用户，所以客人没有权限。
完成此操作后，我尝试连接到代理并获得空证书链异常。通过在连接工厂配置中包含 keystore 来解决此问题。
因为 needClientAuth设置为 true(启用双重身份验证)，Artemis 需要客户端通过捆绑从根 CA 派生的 key 对来构建相关的 keystore ，因此我的连接工厂配置从

@Bean
public ActiveMQConnectionFactory artemisSSLConnectionFactory() {
    ActiveMQConnectionFactory artemisConnectionFactory = new ActiveMQConnectionFactory("tcp://localhost:61617?&" + "sslEnabled=true&" +
            "trustStorePath=" + pathToTrustStore + "&trustStorePassword=changeit&needClientAuth=true");
    artemisConnectionFactory.setUser("user");
    artemisConnectionFactory.setPassword("password");
    return artemisConnectionFactory;
}

至

@Bean
public ActiveMQConnectionFactory artemisSSLConnectionFactory() {
    ActiveMQConnectionFactory artemisConnectionFactory = new ActiveMQConnectionFactory("tcp://localhost:61617?&" + "sslEnabled=true&" +
            "trustStorePath=" + pathToTrustStore + "&trustStorePassword=changeit&keyStorePath="+ pathToKeystore +"&keyStorePassword=changeit&needClientAuth=true");
    artemisConnectionFactory.setUser("user");
    artemisConnectionFactory.setPassword("password");
    return artemisConnectionFactory;
}

这里唯一的区别是添加了 keystore 路径和密码。当它只是配置中的信任库时，代理没有连接。
如果需要一种方式的身份验证，只需省略 needClientAuth接受器中的字段，因为它设置为 false默认。
这就是最终奏效的方法。