3.2. Basic Security Configuration
Overview
The default security settings block access to a broker's remote ports. If you want to access the Red Hat JBoss A-MQ runtime remotely, you must first customize the security configuration. The first thing you will want to do is create at least one JAAS user. This will enable remote access to the broker.
Other common configuration changes you may want to make are:
- configure access to the Fuse Management Console
- assign roles to each of the remote ports to limit access
- strengthen the credentials needed to access the remote console
Warning
If you are planning to enable SSL/TLS security, you must ensure that you explicitly disable SSLv3 protocol, in order to safeguard against the Poodle vulnerability (CVE-2014-3566). For more details, see Disabling SSLv3 in JBoss Fuse 6.x and JBoss A-MQ 6.x.
Create a secure JAAS user
By default, no JAAS users are defined for the container, which effectively disables remote access (it is impossible to log on).
To create a secure JAAS user, edit the
InstallDir/etc/users.properties file and add a new user field, as follows:
Username=Password,admin
Where
Username and Password are the new user credentials. The admin role gives this user the privileges to access all administration and management functions of the container. For more details about JAAS, see the Security Guide.
Warning
It is strongly recommended that you define custom user credentials with a strong password.
Assigning roles for remote access
You can independently configure roles for the following different administrative protocols:
- SSH (remote console login)To override the default role for the remote console add a
sshRoleproperty to theorg.apache.karaf.shellPID. The following sets the role toadmin:sshRole=admin
- JMX managementTo override the default role for JMX add a
jmxRoleproperty to theorg.apache.karaf.managementPID. The following sets the role tojmx:jmxRole=jmx
Strengthening security on the remote console port
You can employ the following measures to strengthen security on the remote console port:
- Make sure that the JAAS user credentials have strong passwords.
- Customize the X.509 certificate (replace the Java keystore file,
InstallDir/etc/host.key, with a custom key pair).
For more details, see the Security Guide.
