Securing JMX remote access in webapps with jGuard

securing JMX remote access in webapps with jGuard

requirements

JMX is a great technology shipped with Java Standard Edition since java 5.

you will not have the ability to use it, if the JVM which runs your application server is lesser than java 5.

JMX is also shipped with j2ee 1.4 application servers, to expose some of their components.

what jGuard propose to enhance JMX security

• unified security

• unified authentication

• unified authorization

this restriction is put by java implementation and not jGuard.

if you don't set the Security Manager, authenticated users will have access to ALL MBeans. if you set the Security Manager, you will have a fine-grained control on MBeans exposed.

these MBeans are protected with MBeanPermission. you will have read operation on them, restrict changes and so on...

these MBeanPermissions need to be registered in roles like any other permissions declared in jGuard. only users with roles containing MBeanPermissions will have access to them.

this powerful feature is unique, and only provided by jGuard.

activate JMX in you JVM

• enable the JMX agent for local access

-Dcom.sun.management.jmxremote

• enable monitoring and management from remote systems

-Dcom.sun.management.jmxremote.port=portNum

• password protection for JMX access

-Dcom.sun.management.jmxremote.authenticate=true

• activate JMX on a Windows operating system

activate JMX in your webapp

in your web.xml file, you have to insert this code:

<context-param>
	<param-name>enableJMX</param-name>
	<param-value>true</param-value>
</context-param>

optional jGuard JMX-related parameters

• MBeanServer for connector

• • if no one is defined or if the value is new, it will create a MBeanServer.

<context-param>
	<param-name>mbeanServerForConnector</param-name>
	<param-value>new</param-value>
</context-param>

• • if the value is position#N ,it will use the MBeanServer in the Nth position in the MBeanServer list returned by the MBeanServerFactory.

<context-param>
	<param-name>mbeanServerForConnector</param-name>
	<param-value>position#4</param-value>
</context-param>

• • if the value is MBeanServerName#N,it will use the MbeanServer in the Nth position among the MBeanServer list which has got this name returned by the MBeanServerFactory.

<context-param>
	<param-name>mbeanServerForConnector</param-name>
	<param-value>myMBeanServerName#0</param-value>
</context-param>

• RMI Registry Host

<context-param>
	<param-name>rmiRegistryHost</param-name>
	<param-value>192.168.0.5</param-value>
</context-param>

• RMI registry Port

<context-param>
	<param-name>rmiRegistryPort</param-name>
	<param-value>9016</param-value>
</context-param>

debug JMX remote access

JVM vendors provide a debug trace with the system parameter. it can have multiple values separated by a , .

accepted values

thi section is excerpted from chapter 1 of java Security published by O'Reilly editions:

• all

• access

This option has the following sub-options separated by a semi-colon (:). If no sub-option is specified, then all are in force:

• stack

• failure

• domain

• jar

• policy

• scl

example

parameter with access option activated with the failure sub-option.

-Djava.security.debug=access:failure

-Djava.security.debug=scl,access

this facility should only used for debug purpose , because it will generate so many traces and will slow your application server.

how to reach the JMX connector Server

you can reach this connector securized by jguard at this url:

service:jmx:rmi://localhost/jndi/rmi://~~rmiRegistryHost~~:~~rmiRegistryPort~~/~~applicationName~~