保護JBoss 5.1.0中的JMXConnectorServerService（jmx-remoting.sar）.GA

Question

我一直在試圖瞭解如何保護默認情況下由JBoss 5.1.0.GA提供的JMXConnectorServerService。

目前，如果我粘貼以下URL JConsole的，我能到JMX直接，沒有任何身份驗證：服務：JMX：RMI：/// JNDI/RMI：//：1290/JMXConnector的

然後我這樣做是爲了保護我的JMXInvoker，希望能夠保證所有的JMX訪問：http://objectopia.com/2009/10/01/securing-jmx-invoker-layer-in-jboss/

但是，顯然這並不適用於JMXConnectorServerService。我仍然可以通過jconsole使用上述服務URL來訪問JMX。

然後我發現了尚未尚未適應這一功能要求：https://issues.jboss.org/browse/JBAS-8159

現在，目前我並不擔心瘋狂的安全措施。這個URL不會暴露在外部網絡中。所以，我只想看看通過「jmx-console」安全域保護jmx-remoting.sar的最簡單方法是什麼？

我可以切換到默認的MBean服務器，但顯然，在5.1.0.GA，這是一個痛苦：https://community.jboss.org/thread/153594

我會很感激在這方面的投入。

謝謝！

Answer 1

我不認爲該服務已獲得擔保，但有patch。因爲我沒有在AS 5上測試過，但是我將它支持到AS 4並且它工作正常。

我不確定你有哪個版本，但我們假設它是this one。 EAP版本有一個稍微涉及的版本，但前提是相同的。您需要延長JMXConnectorServerService和JMXConnectorServerServiceMBean。

在此實現，創建服務器的代碼如下所示：

// create new connector server and start it 
connectorServer = JMXConnectorServerFactory.newJMXConnectorServer(url, null, mbeanServer); 

在您的擴展，添加以下內容：

/** The name of the JAAS domain to use for authentication */ 
protected String jaasDomain = null; 
... 
/** 
    * Returns the name of the JAAS domain to use for authentication 
    * @return the name of a JAAS Domain 
    */ 
public String getJaasDomain() { 
    return jaasDomain; 
} 

/** 
    * Sets the name of the JAAS domain to use for authentication 
    * @param jaasDomain the JAAS Domain to use for authentication 
    */ 
public void setJaasDomain(String jaasDomain) { 
    this.jaasDomain = jaasDomain; 
} 

現在，您需要重新實現開始方法其中添加了一個包含您要驗證的JAAS域名的環境。

public void start() throws Exception 
    { 
     // the address to expose in the urls 
     String host = System.getProperty("java.rmi.server.hostname"); 

     // check to see if registry already created 
     rmiRegistry = LocateRegistry.getRegistry(host, registryPort); 
     if (rmiRegistry != null) 
     { 
     try 
     { 
      rmiRegistry.list(); 
     } 
     catch(RemoteException e) 
     { 
      log.debug("No registry running at host '" + host + 
        "', port '" + registryPort + "'. Will create one."); 
      rmiRegistry = LocateRegistry.createRegistry(registryPort, null, new DefaultSocketFactory(bindAddress)); 
     } 
     } 
     else 
     { 
     rmiRegistry = LocateRegistry.createRegistry(registryPort, null, new DefaultSocketFactory(bindAddress)); 
     } 

     String serviceURL = "service:jmx:rmi://" + host + "/jndi/rmi://" + host + ":" + registryPort + jndiPath; 

     JMXServiceURL url = new JMXServiceURL(serviceURL); 

     // create new connector server and start it 
     // ==== NEW AUTH CODE HERE ==== 
     final Map<String, Object> environment = new HashMap<String, Object>(); 
     environment.put("jmx.remote.x.login.config", jaasDomain); 
     connectorServer = JMXConnectorServerFactory.newJMXConnectorServer(url, environment, mbeanServer); 
     // ==== NEW AUTH CODE ENDS ==== 
     connectorServer.start(); 

     log.info("JMX Connector server: " + serviceURL); 
    } 

您可以選擇驗證JAAS名字是這樣的：

/** 
* Validates the name of the passed JAAS domain. 
* If the name is not valid, a RuntimeException will the thrown. 
* @param domain The name of the JAAS domain to validate. 
*/ 
private void validateJaasDomain(String domain) { 
    try { 
     new LoginContext(domain); 
    } catch (Exception e) { 
     throw new RuntimeException("The JAAS Domain [" + domain + "] could not be loaded", e); 
    } 
} 

的jaasDomain屬性添加到新的MBean接口：

/** 
* Returns the name of the JAAS domain to use for authentication 
* @return the name of a JAAS Domain 
*/ 
public String getJaasDomain(); 

/** 
* Sets the name of the JAAS domain to use for authentication 
* @param jaasDomain the JAAS Domain to use for authentication 
*/ 
public void setJaasDomain(String jaasDomain); 

讓我們假設你的新IMPL是融爲一體。 vijay.JMXConnectorServerService和新的MBean是com.vijay。JMXConnectorServerServiceMBean;您部署描述是這樣的：（使用JMX 的控制檯 JAAS域，因爲你可能有固定....）

<!-- ======================================================== --> 
<!-- Example Vijay JMX Remoting Service Configuration file  --> 
<!-- ======================================================== --> 
<server> 

    <mbean code="com.vijay.JMXConnectorServerService" 
     name="jboss.remoting:service=JMXConnectorServer,protocol=rmi" 
     display-name="JMX Connector Server (RMI)"> 
      <attribute name="BindAddress"> 
       <!-- Get the port from the ServiceBindingManager --> 
       <value-factory bean="ServiceBindingManager" method="getStringBinding" 
        parameter="jboss.remoting:service=JMXConnectorServer,protocol=rmi"/> 
      </attribute> 
      <!-- if comment this out, will use 1099 as default and will conflict --> 
      <!-- with default JNP (JNDI) port. --> 
      <attribute name="RegistryPort"> 
       <!-- Get the port from the ServiceBindingManager --> 
       <value-factory bean="ServiceBindingManager" method="getIntBinding" 
        parameter="jboss.remoting:service=JMXConnectorServer,protocol=rmi"/> 
      </attribute> 
      <!-- the path to which will be bound in rmi registry --> 
      <!-- the commented value below is the default. --> 
      <!-- <attribute name="JndiPath">/jmxconnector</attribute> --> 
      <attribute name="JaasDomain">jmx-console</attribute> 
    </mbean> 
</server> 

這就是我的一切。我希望它對你有用。