Security is one of the most important features while running a JBoss server in a production environment. Implementing SSL and securing communications is a must do, to avoid malicious use.
This blogs details the steps you could take to secure JBoss EAP 6 running in Domain mode. These are probably documented by RedHat but the documentation seems a bit scattered. The idea behind this blog is to put together everything in one place.
In Order to enhance security in JBoss EAP 6, SSL/encryption can be implemented for the following
- Admin console access – enable https access for admin console
- Domain Controller – Host controller communication – Communication between the main domain controller and all the other host controllers should be secured.
- Jboss CLI – enable ssl for the command line interface
The below example uses a single keystore being both the key and truststore and also uses CA signed certificates.
You could use self-signed certificates and/or separated keystores and truststores if required.
- Create the keystores (certificates for each of the servers)
- keytool -genkeypair -alias testServer.prd -keyalg RSA -keysize 2048 -validity 730 -keystore testServer.prd.jks
- keytool -certreq -alias testServer.prd -keystore testServer.prd.jks -file testServer.prd.csr
- keytool -import -trustcacerts -alias root -file rootCA.crt -keystore testServer.prd.jks
- Keytool -importcert -keystore testServer.prd.jks -trustcacerts -alias testServer.prd -file testServer.prd.crt
In order to establish trust between the master and slave hosts,
- Import the signed certificates of all the (slave) servers that the Domain Controller must trust onto the Domain Controllers Keystore
- keytool -importcert -keystore testServer.prd.jks -trustcacerts -alias slaveServer.prd -file slaveServers.prd.crt
- repeat step for all slave hosts.
- keytool -importcert -keystore slaveServer.prd.jks -trustcacerts -alias testServer.prd -file testServer.prd.crt
- repeat steps for all slave hosts
This has be to done because (as per RedHat’s Documentation)
There is a problem with this methodology when trying to configure one way SSL between the servers, because there the HC's and the DC (depending on what action is being performed) switch roles (client, server). Because of this one way SSL configuration will not work and it is recommended that if you need SSL between these two endpoints that you configure two way SSL
Once this is done, we now have signed certificates loaded onto the java keystore.
In Jboss EAP 6 , the http-interface which provides access to the admin console, by default uses the ManagementRealm to provide file based authentication. (mgmt.-users.properties).The next step is to modify the configurations in the host.xml, to make the ManagementRealm use the certificates we created above.
The host.xml should be modified to look like
<management>
<security-realms>
<security-realm name="ManagementRealm">
<server-identities>
<ssl protocol="TLSv1">
<keystore path="testServer.prd.jks" relative-to="jboss.domain.config.dir" keystore-password="xxxx" alias="testServer.prd"/>
</ssl>
</server-identities>
<authentication>
<truststore path="testServer.prd.jks" relative-to="jboss.domain.config.dir" keystore-password="xxxx"/>
<local default-user="$local"/>
<properties path="mgmt-users.properties" relative-to="jboss.domain.config.dir"/>
</authentication>
</security-realm>
<management-interfaces>
<native-interface security-realm="ManagementRealm">
<socket interface="management" port="${jboss.management.native.port:9999}"/>
</native-interface>
<http-interface security-realm="ManagementRealm">
<socket interface="management" secure-port="9443"/>
</http-interface>
</management-interfaces>
On the Slave hosts, In addition to the above configuration, the following needs to be changed
<domain-controller>
<remote host="testServer" port="${jboss.domain.master.port:9999}" security-realm="ManagementRealm"/>"
</domain-controller>
Once you make the above changes and restart the servers, you should be able to access the admin console via https.
https://testServer.prd:9443/console
Finally, in order to secure cli authentication
Modify /opt/jboss/jboss-eap-6.1/bin/jboss-cli.xml for each server and add
<ssl>
<alias>testServer.prd</alias>
<key-store>/opt/jboss/jboss-eap-6.1/domain/configuration/testServer.prd.jks</key-store>
<key-store-password>xxxx </key-store-password>
<trust-store>/opt/jboss/jboss-eap-6.1/domain/configuration/testServer.prd.jks</trust-store>
<trust-store-password>xxxx </trust-store-password>
<modify-trust-store>true</modify-trust-store>
</ssl>
