JBOSS使用（二）安全设置

默认情况下访问http://localhost:8011/jmx-console/就能不需用户名，密码就能查看JBOSS部署管理的一些信息，存在安全隐患。接下来我们通过对jboss进行配置，试得访问jmx-console需要用户名，密码。

1.打开D:\jboss-4.2.2.GA\server\default\deploy\jmx-console.war\WEB-INF目录下的jboss-web.xml文件

把

<jboss-web>
   <!-- Uncomment the security-domain to enable security. You will
      need to edit the htmladaptor login configuration to setup the
      login modules used to authentication users.
      <security-domain>java:/jaas/jmx-console</security-domain>-->
 
</jboss-web>

改成：

<jboss-web>
   <!-- Uncomment the security-domain to enable security. You will
      need to edit the htmladaptor login configuration to setup the
      login modules used to authentication users. -->
      <security-domain>java:/jaas/jmx-console</security-domain>
 
</jboss-web>

2.打开D:\jboss-4.2.2.GA\server\default\deploy\jmx-console.war\WEB-INF目录下的web.xml文件；查找到 <security-constraint>节点，把

  <!-- A security constraint that restricts access to the HTML JMX console
   to users with the role JBossAdmin. Edit the roles to what you want and
   uncomment the WEB-INF/jboss-web.xml/security-domain element to enable
   secured access to the HTML JMX console.
   <security-constraint>
     <web-resource-collection>
       <web-resource-name>HtmlAdaptor</web-resource-name>
       <description>An example security config that only allows users with the
         role JBossAdmin to access the HTML JMX console web application
       </description>
       <url-pattern>/*</url-pattern>
       <http-method>GET</http-method>
       <http-method>POST</http-method>
     </web-resource-collection>
     <auth-constraint>
       <role-name>JBossAdmin</role-name>
     </auth-constraint>
   </security-constraint>
   -->

改成：

   <!-- A security constraint that restricts access to the HTML JMX console
   to users with the role JBossAdmin. Edit the roles to what you want and
   uncomment the WEB-INF/jboss-web.xml/security-domain element to enable
   secured access to the HTML JMX console.-->
   <security-constraint>
     <web-resource-collection>
       <web-resource-name>HtmlAdaptor</web-resource-name>
       <description>An example security config that only allows users with the
         role JBossAdmin to access the HTML JMX console web application
       </description>
       <url-pattern>/*</url-pattern>
       <http-method>GET</http-method>
       <http-method>POST</http-method>
     </web-resource-collection>
     <auth-constraint>
       <role-name>JBossAdmin</role-name>
     </auth-constraint>
   </security-constraint>

这里可以看见登陆的角色是JBossAdmin；

3.第1步中的jmx-console安全域和第2步中的运行角色都是在D:\jboss-4.2.2.GA\server\default\conf目录下的login-config.xml文件里配置的，打开login-config.xml文件，查找到 <application-policy name = "jmx-console">节点：

<application-policy name = "jmx-console">
       <authentication>
          <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
             flag = "required">
           <module-option name="usersProperties">props/jmx-console-users.properties</module-option>
           <module-option name="rolesProperties">props/jmx-console-roles.properties</module-option>
          </login-module>
       </authentication>
    </application-policy>

其中下面这2个子节点分别指定了配置用户名密码和角色的资源文件：

<module-option name="usersProperties">props/jmx-console-users.properties</module-option>
           <module-option name="rolesProperties">props/jmx-console-roles.properties</module-option>

打开D:\jboss-4.2.2.GA\server\default\conf\props\jmx-console-users.properties文件，你能配置你想要访问jmx-console的用户名和密码，格式是：用户名=密码

# A sample users.properties file for use with the UsersRolesLoginModule
admin=admin  (默认的)

打开D:\jboss-4.2.2.GA\server\default\conf\props\jmx-console-roles.properties文件，你能配置访问jmx-console的用户admin的权限，格式是：用户名=权限A，权限B

# A sample roles.properties file for use with the UsersRolesLoginModule
admin=JBossAdmin,HttpInvoker  (默认的)
多权限用“,”隔开。

4.到此所有配置就完成。你访问访问http://localhost:8011/jmx-console时会让你输入用户名密码，你吧你刚才配置的admin分别输入进去就能访问。