Jboss Jmx-Console和 Jboss web-console安全设置

1、介绍

如果你暴露你的JBoss服务器通过网络(如通过启动服务器使用选项B 0.0.0.0或者通过改变jboss.bind.address首次出现0.0.0.0在.../jboss/server/default/deploy/web-deployer/server.xml)你自动也暴露了Jboss web控制台(http://localhost:8080/jmx-console)因为管理员工具没有任何用户和密码。

注意：在下面的设置例子中，为默认的jboss服务器配置被使用。

2、jmx-console安全设置

2.1、在../jboss/server/default/deploy/jmx-console.war/WEB-INF/jboss-web.xml 取消如下注释：

[html] view plain copy print ?

<security-domain>java:/jaas/jmx-console</security-domain>

<security-domain>java:/jaas/jmx-console</security-domain>

2.2、在../jboss/server/default/deploy/jmx-console.war/WEB-INF/web.xml 取消如下注释：

[html] view plain copy print ?

<security-constraint>
<web-resource-collection>
<web-resource-name>HtmlAdaptor</web-resource-name>
<description>An example security config that only allows users with the
role JBossAdmin to access the HTML JMX console web application
</description>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>JBossAdmin</role-name>
</auth-constraint>
</security-constraint>

  <security-constraint>
     <web-resource-collection>
       <web-resource-name>HtmlAdaptor</web-resource-name>
       <description>An example security config that only allows users with the
         role JBossAdmin to access the HTML JMX console web application
       </description>
       <url-pattern>/*</url-pattern>
       <http-method>GET</http-method>
       <http-method>POST</http-method>
     </web-resource-collection>
     <auth-constraint>
       <role-name>JBossAdmin</role-name>
     </auth-constraint>
   </security-constraint>

2.3、在..../jboss/server/default/conf/props/jmx-console-users.properties 添加或者编辑 admin=a_password_you_like

指定一个不同的用户对jbossadmin组添加“用户名= jbossadmin”到jmx-console-roles.properties.properties文件（同一目录）。

现有的jmx-console-users.properties文件与密码admin管理用户。为了安全，删除用户或更改密码更强的人。

3、web-console安全设置

3.1、在.../jboss/server/default/deploy/management/console-mgr.sar/web-console.war/WEB-INF/jboss-web.xml 取消如下注释:

[html] view plain copy print ?

<security-domain>java:/jaas/web-console</security-domain>

<security-domain>java:/jaas/web-console</security-domain>

3.2、在../jboss/server/defualt/deploy/management/console-mgr.sar/web-console.war/WEB-INF/web.xml取消如下注释：

[html] view plain copy print ?

<security-constraint>
<web-resource-collection>
<web-resource-name>HtmlAdaptor</web-resource-name>
<description>An example security config that only allows users with the
role JBossAdmin to access the HTML JMX console web application
</description>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>JBossAdmin</role-name>
</auth-constraint>
</security-constraint>

<security-constraint>
   <web-resource-collection>
   <web-resource-name>HtmlAdaptor</web-resource-name>
   <description>An example security config that only allows users with the
   role JBossAdmin to access the HTML JMX console web application
   </description>
   <url-pattern>/*</url-pattern>
   <http-method>GET</http-method>
   <http-method>POST</http-method>
   </web-resource-collection>
   <auth-constraint>
   <role-name>JBossAdmin</role-name>
   </auth-constraint>
   </security-constraint>

3.3、在.../jboss/server/default/deploy/management/console-mgr.sar/web-console.war/WEB-INF/classes/web-console-users.properties 添加或者编辑行admin=a_password_you_like

指定一个不同的用户对jbossadmin组添加“用户名= jbossadmin”到web-console-roles.properties.properties文件（同一目录）。

现有的web-console-users.properties文件与密码admin管理用户。为了安全，删除用户或更改密码更强的人。

4、实例

4.1、jmx-console安全配置

第一步：打开jboss/server/default/deploy/jmx-console.war/WEB-INF目录下jboss-web.xml文件，添加security-domain,如下图-1所示：