Chapter 3. Securing the Fuse Console

Procedure

1. To set HTTPS as the required protocol, set the hawtio.http.strictTransportSecurity property in the $KARAF_HOME/etc/system.properties file as shown in the following example:

   hawtio.http.strictTransportSecurity = max-age=31536000; includeSubDomains; preload

   Copy to Clipboard Toggle word wrap

2. To use public keys to secure responses, set the hawtio.http.publicKeyPins property in the $KARAF_HOME/etc/system.properties file as shown in the following example:

   hawtio.http.publicKeyPins = pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs"; max-age=5184000; includeSubDomains

   Copy to Clipboard Toggle word wrap

3. (For deploying on AWS only) To disable the Fuse Console’s proxy servlet, set the hawtio.disableProxy property to true in the $KARAF_HOME/etc/system.properties file as shown in the following example:

   hawtio.disableProxy = true;

   Copy to Clipboard Toggle word wrap
4. For detailed instructions on how to enable SSL/TLS security, see the "Enabling SSL/TLS for Undertow in an Apache Karaf container" section in the Apache Karaf Security Guide.
5. For information on how to secure the Fuse Console with Red Hat Single Sign-On, see the section on securing the Hawtio administration console in the Red Hat Single Sign-on Securing Applications and Services Guide.

6. To ensure that a user has the necessary user role authorization to perform the Fuse Console operations that the user needs to perform, follow these steps to set a user role:

   1. Open the Red Hat Fuse etc/users.properties file in an editor.

   2. Add an entry for the user name, password, and role.

      For example, the following entry in the etc/users.properties file defines the admin user and grants the admin role.

      admin = secretpass,admin

      Copy to Clipboard Toggle word wrap
   3. Save the file.