此内容没有您所选择的语言版本。

2.4. Enabling Remote JMX SSL

Overview

Red Hat JBoss Fuse provides a JMX port that allows remote monitoring and management of Fuse containers using MBeans. By default, however, the credentials that you send over the JMX connection are unencrypted and vulnerable to snooping. To encrypt the JMX connection and protect against password snooping, you need to secure JMX communications by configuring JMX over SSL.

To configure JMX over SSL, perform the following steps:

Create the jbossweb.keystore file
Create and deploy the keystore.xml file
Add the required properties to org.apache.karaf.management.cfg
Restart the container

After you have configured JMX over SSL access, you should test the connection.

Warning

If you are planning to enable SSL/TLS security, you must ensure that you explicitly disable the SSLv3 protocol, in order to safeguard against the Poodle vulnerability (CVE-2014-3566). For more details, see Disabling SSLv3 in JBoss Fuse 6.x and JBoss A-MQ 6.x.

Note

If you configure JMX over SSL while Red Hat JBoss Fuse is running, you will need to restart it.

Prerequisites

If you haven't already done so, you need to:

Set your JAVA_HOME environment variable
Configure a JBoss Fuse user with the Administrator role
Edit the <installDir>/jboss-fuse-6.3.0.redhat-xxx/etc/users.properties file and add the following entry, on a single line:
```
admin=YourPassword,Administrator
```
This creates a new user with username, admin, password, YourPassword, and the Administrator role.

Create the `jbossweb.keystore` file

Open a command prompt and make sure you are in the etc/ directory of your JBoss Fuse installation:

cd <installDir>/jboss-fuse-6.3.0.redhat-xxx/etc

At the command line, using a -dname value (Distinguished Name) appropriate for your application, type this command:

$JAVA_HOME/bin/keytool -genkey -v -alias jbossalias -keyalg RSA -keysize 1024 -keystore jbossweb.keystore -validity 3650 -keypass JbossPassword -storepass JbossPassword -dname "CN=127.0.0.1, OU=RedHat Software Unit, O=RedHat, L=Boston, S=Mass, C=USA"

Important

Type the entire command on a single command line.

The command returns output that looks like this:

Generating 1,024 bit RSA key pair and self-signed certificate (SHA256withRSA) with a validity of 3,650 days
	for: CN=127.0.0.1, OU=RedHat Software Unit, O=RedHat, L=Boston, ST=Mass, C=USA
New certificate (self-signed):
[
[
  Version: V3
  Subject: CN=127.0.0.1, OU=RedHat Software Unit, O=RedHat, L=Boston, ST=Mass, C=USA
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

  Key:  Sun RSA public key, 1024 bits
  modulus: 1123086025790567043604962990501918169461098372864273201795342440080393808
     1594100776075008647459910991413806372800722947670166407814901754459100720279046
     3944621813738177324031064260382659483193826177448762030437669318391072619867218
     036972335210839062722456085328301058362052369248473659880488338711351959835357
  public exponent: 65537
  Validity: [From: Thu Jun 05 12:19:52 EDT 2014,
               To: Sun Jun 02 12:19:52 EDT 2024]
  Issuer: CN=127.0.0.1, OU=RedHat Software Unit, O=RedHat, L=Boston, ST=Mass, C=USA
  SerialNumber: [    4666e4e6]

Certificate Extensions: 1
[1]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: AC 44 A5 F2 E6 2F B2 5A   5F 88 FE 69 60 B4 27 7D  .D.../.Z_..i`.'.
0010: B9 81 23 9C                                        ..#.
]
]

]
  Algorithm: [SHA256withRSA]
  Signature:
0000: 01 1D 95 C0 F2 03 B0 FD   CF 3A 1A 14 F5 2E 04 E5  .........:......
0010: DD 18 DD 0E 24 60 00 54   35 AE FE 36 7B 38 69 4C  ....$`.T5..6.8iL
0020: 1E 85 0A AF AE 24 1B 40   62 C9 F4 E5 A9 02 CD D3  .....$.@b.......
0030: 91 57 60 F6 EF D6 A4 84   56 BA 5D 21 11 F7 EA 09  .W`.....V.]!....
0040: 73 D5 6B 48 4A A9 09 93   8C 05 58 91 6C D0 53 81  s.kHJ.....X.l.S.
0050: 39 D8 29 59 73 C4 61 BE   99 13 12 89 00 1C F8 38  9.)Ys.a........8
0060: E2 BF D5 3C 87 F6 3F FA   E1 75 69 DF 37 8E 37 B5  ...<..?..ui.7.7.
0070: B7 8D 10 CC 9E 70 E8 6D   C2 1A 90 FF 3C 91 84 50  .....p.m....<..P

]
[Storing jbossweb.keystore]

Check whether <installDir>/jboss-fuse-6.3.0.redhat-xxx/etc now contains the file jbossweb.keystore.

Create and deploy the `keystore.xml` file

Using your favorite xml editor, create and save the keystore.xml file in the <installDir>/jboss-fuse-6.3.0.redhat-xxx/etc directory.

Include this text in the file:

<blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0"
           xmlns:jaas="http://karaf.apache.org/xmlns/jaas/v1.0.0">
     <jaas:keystore name="sample_keystore"
                    rank="1"
                    path="file:etc/jbossweb.keystore"
                    keystorePassword="JbossPassword" 
                    keyPasswords="jbossalias=JbossPassword" />
</blueprint>

Deploy the keystore.xml file to the container, by copying it into the <installDir>/jboss-fuse-6.3.0.redhat-xxx/deploy directory (the hot deploy directory).
Note
Subsequently, if you need to undeploy the keystore.xml file, you can do so by deleting the keystore.xml file from the deploy/ directory while the Karaf container is running.

Add the required properties to `org.apache.karaf.management.cfg`

Edit the <installDir>/jboss-fuse-6.3.0.redhat-xxx/etc/org.apache.karaf.management.cfg file to include these properties at the end of the file:

secured = true
secureProtocol = TLSv1
keyAlias = jbossalias
keyStore = sample_keystore
trustStore = sample_keystore

Important

You must set secureProtocol to TLSv1, in order to protect against the Poodle vulnerability (CVE-2014-3566)

Restart the JBoss Fuse container

You must restart the JBoss Fuse container for the new JMX SSL/TLS settings to take effect.

Testing the Secure JMX connection

Open a command prompt and make sure you are in the etc/ directory of your JBoss Fuse installation:
```
cd <installDir>/jboss-fuse-6.3.0.redhat-xxx/etc
```
Open a terminal, and start up JConsole by entering this command:
```
jconsole -J-Djavax.net.debug=ssl -J-Djavax.net.ssl.trustStore=jbossweb.keystore -J-Djavax.net.ssl.trustStoreType=JKS -J-Djavax.net.ssl.trustStorePassword=JbossPassword
```
Where the -J-Djavax.net.ssl.trustStore option specifies the location of the jbossweb.keystore file (make sure this location is specified correctly, or the SSL/TLS handshake will fail). The -J-Djavax.net.debug=ssl setting enables logging of SSL/TLS handshake messages, so you can verify that SSL/TLS has been successfully enabled.
Important
Type the entire command on the same command line.
When JConsole opens, select the option Remote Process in the New Connection wizard.
Under the Remote Process option, enter the following value for the service:jmx:<protocol>:<sap> connection URL:
```
service:jmx:rmi://localhost:44444/jndi/rmi://localhost:1099/karaf-root
```
And fill in the Username, and Password fields with valid JAAS credentials (as set in the etc/users.properties file):
```
Username: admin
Password: YourPassword
```

此内容没有您所选择的语言版本。

2.4. Enabling Remote JMX SSL

Overview

Prerequisites

Create the `jbossweb.keystore` file

Create and deploy the `keystore.xml` file

Add the required properties to `org.apache.karaf.management.cfg`

Restart the JBoss Fuse container

Testing the Secure JMX connection

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Red Hat legal and privacy links

Red Hat legal and privacy links

此内容没有您所选择的语言版本。

2.4. Enabling Remote JMX SSL

Overview

Prerequisites

Create the jbossweb.keystore file

Create and deploy the keystore.xml file

Add the required properties to org.apache.karaf.management.cfg

Restart the JBoss Fuse container

Testing the Secure JMX connection

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Red Hat legal and privacy links

Red Hat legal and privacy links

Create the `jbossweb.keystore` file

Create and deploy the `keystore.xml` file

Add the required properties to `org.apache.karaf.management.cfg`