[JBoss] 관리 콘솔 접근권한 부여
WEB/JBossAS / 2011. 11. 16. 11:04
JBoss 가 제공해주는 여러 관리 콘솔 (admin-console, jmx-console, web-console) 들은 기능이 막강하지만 접근권한을 재대로 관리하지 않으면 많은 위험성을 노출하게 됩니다.
각 관리 콘솔에 대한 접근권한 부여 방법에 대해 설명합니다.
admin-console
JBoss 에서 제공해주는 admin-console 입니다. 이름에서 알 수 있듯이 관리자 콘솔입니다. 모니터링 및 배포와 같은 기능을 제공합니다.
접근 권한 설정
admin-console 은 기본적으로 접근 권한의 제한이 있습니다.
$JBOSS_HOME/server/<CONFIGURATION>/deploy/admin-console.war/WEB-INF/jboss-web.xml
<jboss-web>
...
<security-domain>java:/jaas/jmx-console</security-domain>
...
</jboss-web>
...
<security-domain>java:/jaas/jmx-console</security-domain>
...
</jboss-web>
security-domain 이 "java:jaas/jmx-console" 로 설정이 되어 jmx-console 과 같은 권한으로 제어합니다.
$JBOSS_HOME/server/<CONFIGURATION>/conf/login-config.xml
<!-- A template configuration for the jmx-console web application. This
defaults to the UsersRolesLoginModule the same as other and should be
changed to a stronger authentication mechanism as required.
-->
<application-policy name="jmx-console">
<authentication>
<login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
flag="required">
<module-option name="usersProperties">props/jmx-console-users.properties</module-option>
<module-option name="rolesProperties">props/jmx-console-roles.properties</module-option>
</login-module>
</authentication>
</application-policy>
defaults to the UsersRolesLoginModule the same as other and should be
changed to a stronger authentication mechanism as required.
-->
<application-policy name="jmx-console">
<authentication>
<login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
flag="required">
<module-option name="usersProperties">props/jmx-console-users.properties</module-option>
<module-option name="rolesProperties">props/jmx-console-roles.properties</module-option>
</login-module>
</authentication>
</application-policy>
위와 같이 jmx-console 에 대한 기본설정은 props/jmx-console-users.properties 와 props/jmx-console-roles.properties 에 권한과 사용자 정보를 설정할 수 있습니다.
$JBOSS_HOME/server/<CONFIGURATION>/conf/props/jmx-console-users.properties
# A sample users.properties file for use with the UsersRolesLoginModule
admin=[변경할 패스워드]
admin=[변경할 패스워드]
위의 설정이 완료되면 admin-console 재시작 후에 패스워드 변경된 것을 확인할 수 있습니다.
jmx-console
JMX 를 제어할 수 있는 페이지입니다. jboss 의 경우 JMX 에서 deploy, undeploy, start, stop, destroy 가 가능하므로 jboss 전문가가 악의를 가지고 있다면 시스템 전체에 영향을 끼칠 수 있는 콘솔입니다.
접근 권한 설정
$JBOSS_HOME/server/<CONFIGURATION>/deploy/jmx-console.war/WEB-INF/web.xml
<!-- A security constraint that restricts access to the HTML JMX console
to users with the role JBossAdmin. Edit the roles to what you want and
uncomment the WEB-INF/jboss-web.xml/security-domain element to enable
secured access to the HTML JMX console.
-->
<security-constraint>
<web-resource-collection>
<web-resource-name>HtmlAdaptor</web-resource-name>
<description>An example security config that only allows users with the
role JBossAdmin to access the HTML JMX console web application
</description>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>JBossAdmin</role-name>
</auth-constraint>
</security-constraint>
to users with the role JBossAdmin. Edit the roles to what you want and
uncomment the WEB-INF/jboss-web.xml/security-domain element to enable
secured access to the HTML JMX console.
-->
<security-constraint>
<web-resource-collection>
<web-resource-name>HtmlAdaptor</web-resource-name>
<description>An example security config that only allows users with the
role JBossAdmin to access the HTML JMX console web application
</description>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>JBossAdmin</role-name>
</auth-constraint>
</security-constraint>
주석처리가 되어 있는 security-constraint 부분을 활성화 시킵니다.
$JBOSS_HOME/server/<CONFIGURATION>/deploy/jmx-console.war/WEB-INF/jboss-web.xml
<jboss-web>
<!-- Uncomment the security-domain to enable security. You will
need to edit the htmladaptor login configuration to setup the
login modules used to authentication users.
-->
<security-domain>java:/jaas/jmx-console</security-domain>
</jboss-web>
<!-- Uncomment the security-domain to enable security. You will
need to edit the htmladaptor login configuration to setup the
login modules used to authentication users.
-->
<security-domain>java:/jaas/jmx-console</security-domain>
</jboss-web>
admin-console 과 같이 security-domain 이 "java:/jaas/jmx-console" 이므로 admin-console 에서 설정한 사용자 정보를 통해 접근 권한 제한이 가능합니다.
admin-console 과 마찬가지로 설정 후 jmx-console 을 재시작 하면 접근 제한 설정이 가능합니다.
web-console
즐겨 사용하는 것이 아니라 정확한 기능은 파악하지 못하였으나 서버 정보가 외부로 노출되는 것을 막기 위해 접근 제한이 필요합니다.
web-console 의 경우 모든 configuration 에 있는 것이 아니라 "default" 와 "all" 에만 있으니 본인의 configuration 에 맞게 설정하시기 바랍니다.
접근 권한 설정
$JBOSS_HOME/server/<CONFIGURATION>/deploy/management/console-mgr.sar/web-console.war/WEB-INF/web.xml
<!-- A security constraint that restricts access to the HTML JMX console
to users with the role JBossAdmin. Edit the roles to what you want and
uncomment the WEB-INF/jboss-web.xml/security-domain element to enable
secured access to the HTML JMX console.
-->
<security-constraint>
<web-resource-collection>
<web-resource-name>HtmlAdaptor</web-resource-name>
<description>An example security config that only allows users with the
role JBossAdmin to access the HTML JMX console web application
</description>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>JBossAdmin</role-name>
</auth-constraint>
</security-constraint>
to users with the role JBossAdmin. Edit the roles to what you want and
uncomment the WEB-INF/jboss-web.xml/security-domain element to enable
secured access to the HTML JMX console.
-->
<security-constraint>
<web-resource-collection>
<web-resource-name>HtmlAdaptor</web-resource-name>
<description>An example security config that only allows users with the
role JBossAdmin to access the HTML JMX console web application
</description>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>JBossAdmin</role-name>
</auth-constraint>
</security-constraint>
security-constraint 주석을 제거합니다.
$JBOSS_HOME/server/<CONFIGURATION>/deploy/management/console-mgr.sar/web-console.war/WEB-INF/jboss-web.xml
<jboss-web>
<!-- Uncomment the security-domain to enable security. You will
need to edit the htmladaptor login configuration to setup the
login modules used to authentication users.
-->
<security-domain>java:/jaas/web-console</security-domain>
...
</jboss-web>
<!-- Uncomment the security-domain to enable security. You will
need to edit the htmladaptor login configuration to setup the
login modules used to authentication users.
-->
<security-domain>java:/jaas/web-console</security-domain>
...
</jboss-web>
security-domain 주석도 삭제합니다.
$JBOSS_HOME/server/<CONFIGURATION>/deploy/management/console-mgr.sar/web-console.war/WEB-INF/classes/web-console-users.properties
# A sample users.properties file for use with the UsersRolesLoginModule
admin=[변경할 패스워드]
admin=[변경할 패스워드]
jmx-console 의 패스워드를 설정하듯이 설정합니다.
재시작 후 재대로 적용이 되었는지를 확인합니다.
지금까지 설명한 접근제한은 가장 기본적인 접근제한 방법 (BASIC) 입니다. 패스워드가 암호화되지 않았기 때문에 서버가 뚫리면 패스워드도 노출되게 됩니다. BASIC 말고도 DIGEST, FORM, and CLIENT-CERT 방식으로 설정이 가능하니 필요에 따라 연구하여 설정하시면 될 것 같습니다.
참고자료