Chapter 9. Configuring security
Secure the messaging-activemq subsystem by configuring authentication, transport-layer security, and role-based permissions. Secure remote connections and control access to messaging destinations.
9.1. Securing remote connections
The recommended method for securing the messaging-activemq subsystem in JBoss EAP 8.x is to use the Elytron subsystem. Elytron security domains provide a unified security framework for enforcing authentication and authorization on remote messaging connections.
- Securing the transport
The default
http-connectorthat comes bundled with JBoss EAP messaging is not secured by default. You can secure the message transport and enable web traffic for SSL/TLS by following the instructions to configure one-way and two-way SSL/TLS for applications in How to Configure Server Security for JBoss EAP.NoteThe above approach to secure a message transport also works for securing the
http-acceptor.When you configure the transport as described above, you must perform the following additional steps.
-
By default, all HTTP acceptors are configured to use the default
http-listener, which listens on the HTTP port. You must configure HTTP acceptors to use thehttps-listener, which listens on the HTTPS port. -
The
socket-bindingelement for all HTTP connectors must be updated to usehttpsinstead ofhttp. -
Each
http-connectorthat communicates through SSL/TLS must set thessl-enabledparameter totrue. -
If an HTTP connector is used to connect to another server, you must configure the related parameters such as
trust-storeandkey-store. Securing thehttp-connectorrequires that you configure the same parameters as you do with aremote-connector, which is documented Securing a remote connector.
-
By default, all HTTP acceptors are configured to use the default
- Securing a remote connector
If you are not using the default
http-connectorand have instead created your ownremote-connectorandremote-acceptorfor TCP communications, you can configure each for SSL/TLS by using the properties in the table below. The properties appear in the configuration as part of the child<param>elements of the acceptor or connector.Typically, a server owns its private SSL/TLS key and shares its public key with clients. In this scenario, the server defines the
key-store-pathandkey-store-passwordparameters in aremote-acceptor. Since each client can have its truststore located at a different location, and be encrypted by a different password, specifying thetrust-store-pathandtrust-store-passwordproperties on theremote-connectoris not recommended. Instead, configure these parameters on the client side using the system propertiesjavax.net.ssl.trustStoreandjavax.net.ssl.trustStorePassword. The parameters you need to configure for aremote-connectoraressl-enabled=trueanduseDefaultSslContext=true. However, if the server usesremote-connectorto connect to another server, it makes sense in this case to set thetrust-store-pathandtrust-store-passwordparameters of theremote-connector.In the above use case, the
remote-acceptorwould be created using the following management CLI command:/subsystem=messaging-activemq/server=default/remote-acceptor=mySslAcceptor:add(socket-binding=netty,params={ssl-enabled=true, key-store-path=PATH/TO/server.jks, key-store-password=${VAULT::server-key::key-store-password::sharedKey}})To create the
remote-connectorfrom the above use case, use the following management CLI command:/subsystem=messaging-activemq/server=default/remote-connector=mySslConnector:add(socket-binding=netty,params={ssl-enabled=true, useDefaultSslContext=true})The management CLI also allows you to add a parameter to an already existing
remote-acceptororremote-connectoras well:/subsystem=messaging-activemq/server=default/remote-connector=myOtherSslConnector:map-put(name=params,key=ssl-enabled,value=true)Note that the
remote-acceptorandremote-connectorboth reference asocket-bindingto declare the port to be used for communication. See the Overview of the Messaging Subsystem Configuration for more information on socket bindings and their relationship to acceptors and connectors.Expand Table 9.1. SSL/TLS-related configuration properties for the NettyConnectorFactory Property Description enabled-cipher-suites
Can be used to configure an acceptor or connector. This is a comma separated list of cipher suites used for SSL/TLS communication. The default value is null which means the JVM’s default will be used.
enabled-protocols
Can be used to configure an acceptor or connector. This is a comma separated list of protocols used for SSL/TLS communication. The default value is null which means the JVM’s default will be used.
key-store-password
When used on an acceptor, this is the password for the server-side keystore.
When used on a connector, this is the password for the client-side keystore. This is only relevant for a connector if you are using two-way SSL/TLS. Although this value can be configured on the server, it is downloaded and used by the client.
If the client needs to use a different password from that set on the server, it can override the server-side setting by either using the standard
javax.net.ssl.keyStorePasswordsystem property. Use theorg.apache.activemq.ssl.keyStorePasswordproperty if another component on the client is already making use of the standard system property.key-store-path
When used on an acceptor, this is the path to the SSL/TLS keystore on the server which holds the server’s certificates. Use for certificates either self-signed or signed by an authority.
When used on a connector, this is the path to the client-side SSL/TLS keystore which holds the client certificates. This is only relevant for a connector if you are using two-way SSL/TLS.
Although this value is configured on the server, it is downloaded and used by the client. If the client needs to use a different path from that set on the server, it can override the server-side setting by using the standard
javax.net.ssl.keyStoresystem property. Use theorg.apache.activemq.ssl.keyStoresystem property if another component on the client is already making use of the standard property.key-store-provider
Defines the format of the file in which keys are stored, PKCS11 or PKCS12 for example. The accepted values are JDK specific.
needs-client-auth
This property is only for an acceptor. It tells a client connecting to this acceptor that two-way SSL/TLS is required. Valid values are
trueorfalse. Default isfalse.ssl-enabled
Must be
trueto enable SSL/TLS. Default isfalse.trust-store-password
When used on an acceptor, this is the password for the server-side truststore. This is only relevant for an acceptor if you are using two-way SSL/TLS.
When used on a connector, this is the password for the client-side truststore. Although this value can be configured on the server, it is downloaded and used by the client.
If the client needs to use a different password from that set on the server, it can override the server-side setting by using either the standard
javax.net.ssl.trustStorePasswordsystem property. Use theorg.apache.activemq.ssl.trustStorePasswordsystem property if another component on the client is already making use of the standard property.trust-store-path
When used on an acceptor, this is the path to the server-side SSL/TLS keystore that holds the keys of all the clients that the server trusts. This is only relevant for an acceptor if you are using two-way SSL/TLS.
When used on a connector, this is the path to the client-side SSL/TLS keystore which holds the public keys of all the servers that the client trusts. Although this value can be configured on the server, it is downloaded and used by the client.
If the client needs to use a different path from that set on the server, it can override the server-side setting by using either the standard
javax.net.ssl.trustStoresystem property. Use theorg.apache.activemq.ssl.trustStoresystem property if another component on the client is already making use of the standard system property.trust-store-provider
Defines the format of the file in which keys are stored, PKCS11 or PKCS12 for example. The accepted values are JDK specific.
9.2. Securing destinations
In addition to securing remote connections into the messaging server, you can also configure security around specific destinations. This is done by adding a security constraint using the security-setting configuration element. JBoss EAP messaging comes with a security-setting configured by default, as shown in the output from the following management CLI command:
/subsystem=messaging-activemq/server=default:read-resource(recursive=true)
{
"outcome" => "success",
"result" => {
....
"security-setting" => {"#" => {"role" => {"guest" => {
"consume" => true,
"create-durable-queue" => false,
"create-non-durable-queue" => true,
"delete-durable-queue" => false,
"delete-non-durable-queue" => true,
"manage" => false,
"send" => true
}}}}
}
}
The security-setting option makes use of wildcards in the name field to handle which destinations to apply the security constraint. The value of a single # will match any address. For more information on using wildcards in security constraints, see Role Based Security for Addresses.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}