3.2. Basic Security Configuration

The default security settings block access to a broker's remote ports. If you want to access the Red Hat JBoss A-MQ runtime remotely, you must first customize the security configuration. The first thing you will want to do is create at least one JAAS user. This will enable remote access to the broker.

Other common configuration changes you may want to make are:

By default, no JAAS users are defined for the container, which effectively disables remote access (it is impossible to log on).

To create a secure JAAS user, edit the InstallDir/etc/users.properties file and add a new user field, as follows:

Username=Password,admin

Where Username and Password are the new user credentials. The admin role gives this user the privileges to access all administration and management functions of the container. For more details about JAAS, see the Security Guide.

If you want to access the Web console (for remote administration of JMS messaging), you must provide the Web console servlet with the credentials it needs to login to the JMS broker.

Edit the InstallDir/etc/system.properties file. Search for the activemq.jmx.user and activemq.jmx.password settings (which are commented out by default), and modify them as follows:

#
# Authentication - must match an entry in user.properties with the admin privilege
#
activemq.jmx.user=Username
activemq.jmx.password=Password

Where the Username and Password are the credentials of a JAAS user with admin privileges.

For more details on securing the Web console see the Security Guide.

You can independently configure roles for the following different administrative protocols:

You can employ the following measures to strengthen security on the remote console port:

For more details, see the Security Guide.