Securing Jconsole To Application Server Connection - Sun Microsystems GlassFish Enterprise Server 2.1 Administration Manual

Using JConsole
To view all the MBeans, Enterprise Server provides a configuration of the Standard JMX
Connector Server called System JMX Connector Server. As part of Enterprise Server startup, an
instance of this JMX Connector Server is started. Any compliant JMX connector client can
connect to the server using this Connector Server.
Java SE also provides tools to connect to an MBean Server and view MBeans registered with it.
JConsole is one such popular JMX Connector Client and is available as part of the standard Java
SE distribution. For more information on JConsole, see
http://java.sun.com/javase/6/docs/technotes/guides/management/jconsole.html
When you configure JConsole with Enterprise Server, Enterprise Server becomes the JMX
Connector's server end and JConsole becomes the JMX Connector's preferred client end.
"Connecting JConsole to Application Server" on page
connection .

Securing JConsole to Application Server Connection

There are subtle differences in how to connect to Enterprise Server, or any JMX Connector
Server end, based on the transport layer security of the connection. If the server end is secure
(guarantees transport layer security), there is a little more configuration to be performed on the
client end.
■
■
■
When you install a developer profile domain on a machine such as appserver.sun.com, you
will see the following in the Domain Administration Server (DAS) domain.xml file:
<!- – The JSR 160 "system-jmx-connector" – –>
<jmx-connector accept-all="false" address="0.0.0.0"
auth-realm-name="admin-realm" enabled="true" name="system" port="8686"
protocol="rmi_jrmp" security-enabled="false"/>
<!- – The JSR 160 "system-jmx-connector" – –>
210 Sun GlassFish Enterprise Server 2.1 Administration Guide • December 2008
By default, the developer profile of Enterprise Server is configured with a non-secure System
JMX Connector Server.
By default, cluster and enterprise profiles of Enterprise Server are configured with a secure
System JMX Connector Server.
The protocol used for communication is RMI/JRMP. If security is enabled for the JMX
Connector, the protocol used is RMI/JRMP over SSL.
RMI over SSL does not provide additional checks to ensure that the client is talking to
Note –
the intended server. Thus, there is always a possibility, while using JConsole, that you are
sending the user name and password to a malicious host. It is completely up to the
administrator to make sure that security is not compromised.
211shows how to make a successful