Securing the JMX Console and Web Console

Both the jmx-console and web-console are standard servlet 2.3 deployments and can

be secured using J2EE role based security. Both also have a skeleton setup to allow

one to easily enable security using username/password/role mappings found in the

jmx-console.war and web-console.war deployments in the corresponding WEB-INF/classes

users.properties and roles.properties files.

The security setup is based on two pieces, the standard WEB-INF/web.xml servlet URI

to role specification, and the WEB-INF/jboss-web.xml specification of the JAAS configuration which defines how authentication and role mapping is performed.

To secure the JMX Console using a username/password file -

• Locate the jmx-console.war directory.  This will normally be in server/default/deploy in your JBOSS_HOME directory.

• edit WEB-INF/web.xml and uncomment the security-constraint block

• edit WEB-INF/classes/jmx-console-users.properties or server/default/conf/props/jmx-console-users.properties (version >=4.0.2) and WEB-INF/classes/jmx-console-roles.properties or server/default/conf/props/jmx-console-roles.properties (version >=4.0.2) and change the users and passwords to what you desire.  They will need the JBossAdmin role specified in the web.xml file to run the JMX Console.

• edit WEB-INF/jboss-web.xml and uncomment the security-domain block. The security-domain value of jmx-console maps is declared in the login-config.xml JAAS configuration file which defines how authentication and authorization is done.

To secure the JMX Console using your own JAAS domain -

• edit WEB-INF/web.xml as above, uncommenting the security-constraint block.  Change the role-name value to be the role in your domain that can access the console

• edit WEB-INF/jboss-web.xml as above, setting the security domain to be the name of your security domain.  For example, if your login-config.xml has an application-policy whose name is MyDomain then your JAAS domain java:/jaas/MyDomain

• after making all the changes, redeploy the application.  The application can be redeployed by touching the web.xml file or by restarting the server

The process to secure the web console is similar.  In the deploy directory, locate management/web-console.war and make the same changes as above to to WEB-INF/web.xml,

WEB-INF/jboss-web.xml and the users/groups properties file.  The default JAAS domain used by the web-console is java:/jaas/web-console and is defined in login-config.xml in the conf directory.  You can use a custom JAAS domain or custimize the existing domain in the same way as with the JMX console. Typically you would just use the same domain (java:/jaas/jmx-console) as the jmx-console so that you have a single user/role mapping to configurue.

If you find as I did with 3.2.5 that I couldn't log in, another users.properties is most likely being picked up. Change the web-console login-config.xml entry so that that properties files are uniquely named to avoid ambiguity with which resource is picked up. You also would need to rename the web-console properties files. (see http://www.jboss.org/index.html?module=bb&op=viewtopic&t=53346 )

As an extra level of security you may also want to LimitAccessToCertainClients in a particular IP address range.

-

Update for 4.0.2

The jmx-console-roles.properties and jmx-console-users.properties files have been moved to server"default"conf"props. This is because of the change to use the servlet 2.3 class loading model and these properties files would not be visible to the other deployments using the jmx-console security domain. You can  move the files from conf"props to WEB-INF"classes, or leave them in place and edit the password for admin.

Similarly for the web console, please note that the web console is unpacked already in the default server configuration as deploy/management/console-mgr.sar/web-console.war. Proceed to edit the WEB-INF/web.xml and jboss-web.xml files as per securing the JMX console, and either edit the WEB-INF/classes/web-console-roles.properties and web-console-users.properties, or move those files to server"default"conf"props and edit them there.

For the impatient

vi $JBOSS_HOME/server/default/deploy/jmx-console.war/WEB-INF/web.xml

uncomment the security-constraint block

and add a <login-config> block after the end of the <security-constraint> block:

   <login-config> <auth-method>BASIC</auth-method> <realm-name>JMXConsole</realm-name> </login-config>

vi $JBOSS_HOME/server/default/deploy/jmx-console.war/WEB-INF/jboss-web.xml

Uncomment the security-domain block. Make sure the JNDI name maps to the realm name (i.e. JMXConsole)

vi $JBOSS_HOME/server/default/conf/props/jmx-console-users.properties

change the password for admin

vi $JBOSS_HOME/server/default/deploy/management/console-mgr.sar/web-console.war/WEB-INF/web.xml

uncomment the security-constraint block

and add a <login-config> block after the end of the <security-constraint> block:

   <login-config> <auth-method>BASIC</auth-method> <realm-name>JMXConsole</realm-name> </login-config>

vi $JBOSS_HOME/server/default/deploy/management/console-mgr.sar/web-console.war/WEB-INF/jboss-web.xml

Uncomment the security-domain block. Make sure the JNDI name maps to the realm name (e.g. JMXConsole)

vi $JBOSS_HOME/server/default/conf/login-config.xml

Change the path to the web-console-users.properties and the web-console-roles.properties as follows (add props/ to the front of the path)

             <module-option name="usersProperties">props/web-console-users.properties</module-option>

             <module-option name="rolesProperties">props/web-console-roles.properties</module-option>

cp $JBOSS_HOME/server/default/deploy/management/console-mgr.sar/web-console.war/WEB-INF/classes/web-console-.properties $JBOSS_HOME/server/default/conf/props

edit as needed

cp $JBOSS_HOME/server/default/conf/props/jmx-console-roles.properties $JBOSS_HOME/server/default/conf/props/web-console-roles.properties

edit as needed

edit $JBOSS_HOME/server/default/conf/login-config.xml, find the jmx-console and web-console applicaiton-policy, and set the name to jmx-console and web-console, respectively. That is make sure that the application policy name maps to the realm name (i.e. JMXConsole)

restart jboss

Additional to secure jmx-console and web-console authentication via SSL

• must perform the above steps to enable http authenication ...

   the following steps below will redirect jboss admin pages to https://localhost:8443

• edit both web.xml to include the following just before end of tag security-constraint

   <security-constraint>   ...   <user-data-constraint>     <transport-guarantee>CONFIDENTIAL</transport-guarantee>   </user-data-constraint> </security-constraint>

• generate /data01/jboss/server/xxxx/conf/keystore and select your own new secure password

(@see creating SSL keystore using the java keytool - http://www.informit.com/articles/article.asp?p=407886)

or quick setup and verify via

$ keytool -genkey -keystore /data01/jboss/server/xxx/conf/keystore -alias jbossAdmin $ keytool -list -keystore /data01/jboss/server/xxx/conf/keystore

$vi /data01/jboss/server/xxx/deploy/jbossweb-tomcat50.sar/server.xml

• secure file permission via chmod 600 server.xml

• uncomment section "SSL/TLS Connector" to enable Connector port="8443"

• replace keystoreFile="${jboss.server.home.dir}/conf/chap8.keystore"

  with    keystoreFile="${jboss.server.home.dir}/conf/keystore"

• replace keystorePass="rmi+ssl" sslProtocol = "TLS" />

  with    keystorePass="

安装完成后，在Eclipse的plugins中就会多了5个包，命名为org.tigris.subversion.*的都应该是了。打开 Eclipse,window->show view窗口中多了一个SVN文件夹，到此就证明svn插件成功的安装上了。具体的使用方法，在Eclipse的Help中有详细的帮助 Subclipse - Subversion Eclipse Plugin，教你一步一步的使用SVN的客户端了。如果你对subversion想进行深入的了解，那么看看help中的Version Control with Subversion一定有所收获，通过本人的观察，这份文档和sbuversion安装文件中提供的官方文档一样，这里看起来就更舒服些了。

empty	没有页眉和页脚
plain	没有页眉，页脚中部放置页码。
headings	没有页脚，页眉包含章节的标题和页码。
myheadings	没有页脚，页眉页码和使用者所定义的信息。

article 缺省使用 plain 格式，而 book 则使用headings 格式。 也可用 \pagestyle 命令在你的文档中设定所用的格式，例如在文档中使用 \pagestyle{empty} 则使得此后的页面没有页眉和页脚。 一般情况下，这四种格式基本可满足排版的要求。但在某些情况下，特别是 使用者想定义自己的页眉和页脚格式时，就会遇到很多限制和麻烦。这时， 使用 fancyhdr 宏包可以很容易地达到目的。

利用 fancyhdr 宏包提供的命令，可以方便的作到：

• 自定义页眉和页脚。
• 为页眉和页脚加上装饰性的横线。
• 页眉和页脚的宽度可以超过正文文本的宽度。
• 多行的页眉和页脚。
• 奇偶页使用不同格式的页眉和页脚。
• 每章的首页使用不同格式的页眉和页脚。
• 浮动对象页使用不同格式的页眉和页脚。
• 控制页眉和页脚的字体，包括字形，字族，大小写等。

简单的例子：

\documentclass{article}

\usepackage{fancyhdr}
\pagestyle{fancy}
\lhead{}
\chead{}
\rhead{\bfseries The performance of new graduates}
\lfoot{From: K. Grant}
\cfoot{To: Dean A. Smith}
\rfoot{\thepage}
\renewcommand{\headrulewidth}{0.4pt}
\renewcommand{\footrulewidth}{0.4pt}
%......
\begin{document}
......

test!
\end{document}

上面例子中，\thepage 给出了当前页的页码，而 \bfseries 则使 LaTeX 使用粗体字排版页眉。如果想在文档中改用其它形式，比如在第一页不要页眉和页脚，则可在 \begin{document} 和 \maketitle 后使用命令

\thispagestyle{empty}

缺省情况下，\maketitle 命令会自动设置其所在页的格式为 plain 。因此，如果你想在该页使用 fancy 格式的话，应该在 \maketile 后面使用命令 \thispagestyle{fancy}。

下面是一个双面页版式下的例子：

\documentclass{book}
\usepackage{fancyhdr}
\fancyhead{} % clear all fields
\fancyhead[RO,LE]{\bfseries The performance of new graduates} \fancyfoot[LE,RO]{\thepage}
\fancyfoot[LO,CE]{From: K. Grant}
\fancyfoot[CO,RE]{To: Dean A. Smith}
\renewcommand{\headrulewidth}{0.4pt} \renewcommand{\footrulewidth}{0.4pt}
\begin{document}
......

test!
\end{document}

这里方括号中字母代表的意义为：

在配合 CJK 排版中文文档时，要把带有中文的页眉和页脚的定义用 \begin{CJK}{...}{...} 和 \end{CJK} 括起来。最简单的办法是将其放到 \begin{document} 和 \begin{CJK}{...}{...} 之后。如：

\documentclass{book}
\usepackage{CJK}
\usepackage{fancyhdr}
%......
\begin{document}
\begin{CJK}{GBK}{song}
\pagestyle{fancy}
\fancyhead{} % clear all fields
\fancyhead[RO,LE]{\CJKfamily{hei} \bfseries \LaTeX{} 排版系统}
\fancyhead[LO,RE]{\CJKfamily{hei>} \bfseries \leftmark}
\fancyfoot[LE,RO]{\thepage}
\fancyfoot[LO,RE]{\CJKfamily{kai} 公元二零零零年七月}
\renewcommand{\headrulewidth}{0.4pt}
\renewcommand{\footrulewidth}{0.4pt}
%......

test!
\end{CJK}
\end{document}

1. 初始设置

运行 winecfg，把模拟的 Windows 系统设置为 Windows XP 或者 Windows 2000。

2. 准备字体

为了让 Windows 应用程序看上去更美观，所以需要 Windows 下面的字体。

由于我已经将 simsun.ttc 复制到 /usr/share/fonts/windows/ 目录中了。所以我只需要在 ~/.wine/drive_c/windows/fonts/ 目录中为 simsun.ttc 创建一个符号连接：

cd ~/.wine/drive_c/windows/fonts
ln -s /usr/share/fonts/windows/simsun.ttc simsun.ttc
ln -s /usr/share/fonts/windows/simsun.ttc simfang.ttc

创建一个 simfang.ttc 是许多 Windows 应用默认使用 simfang.ttc 字体。
3. 修改 ~/.wine/system.reg

装好字体后，还要修改一下 Wine 的注册表设置，指定与字体相关的设置：

gedit ~/.wine/system.reg

（一定要使用 gedit 或其他支持 gb2312/utf8 编码的编辑器修改这些文件，否则文件中的中文可能变乱码）

搜索： LogPixels
找到的行应该是：[System\\CurrentControlSet\\Hardware Profiles\\Current\\Software\\Fonts]
将其中的：
"LogPixels"=dword:00000060

改为：
"LogPixels"=dword:00000070

搜索： FontSubstitutes
找到的行应该是：[Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes]
将其中的：
"MS Shell Dlg"="Tahoma"
"MS Shell Dlg 2″="Tahoma"

改为：
"MS Shell Dlg"="SimSun"
"MS Shell Dlg 2″="SimSun"

4. 修改 ~/.wine/drive_c/windows/win.ini

gedit ~/.wine/drive_c/windows/win.ini
在文件末尾加入：

[Desktop]
menufontsize=13
messagefontsize=13
statusfontsize=13
IconTitleSize=13

   5. 最关键的一步，网上很多文章中没有提到的一步──把下面的代码保存为zh.reg，然后终端执行regedit zh.reg。从Windows目录下的Fonts里的simsun.ttc复制到/home/user/.wine/drive_c/windows/fonts里面。
      代码:
      REGEDIT4

      [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes]
      "Arial"="simsun"
      "Arial CE,238"="simsun"
      "Arial CYR,204"="simsun"
      "Arial Greek,161"="simsun"
      "Arial TUR,162"="simsun"
      "Courier New"="simsun"
      "Courier New CE,238"="simsun"
      "Courier New CYR,204"="simsun"
      "Courier New Greek,161"="simsun"
      "Courier New TUR,162"="simsun"
      "FixedSys"="simsun"
      "Helv"="simsun"
      "Helvetica"="simsun"
      "MS Sans Serif"="simsun"
      "MS Shell Dlg"="simsun"
      "MS Shell Dlg 2"="simsun"
      "System"="simsun"
      "Tahoma"="simsun"
      "Times"="simsun"
      "Times New Roman CE,238"="simsun"
      "Times New Roman CYR,204"="simsun"
      "Times New Roman Greek,161"="simsun"
      "Times New Roman TUR,162"="simsun"
      "Tms Rmn"="simsun"

之后，中文正常显示哈哈！