You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@james.apache.org by bt...@apache.org on 2023/12/21 17:26:37 UTC
(james-project) branch master updated (00334457dc -> 8e7c7ac7ae)
This is an automated email from the ASF dual-hosted git repository.
btellier pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/james-project.git
from 00334457dc JAMES-3967 RelayLimit: add error log
new 75a776dbf8 [FIX] Set up JMX auth filter for Guice
new 877e361c3e [FIX] Set up JMX auth for Spring
new a14ddfa1f9 [FIX] Document JMX auth for Spring
new 8e7c7ac7ae [FIX] Add more JMX disclaimers
The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../src/main/java/org/apache/james/cli/ServerCmd.java | 12 +++++++++++-
.../docs/modules/ROOT/pages/configure/jmx.adoc | 11 ++++++++++-
.../spring-app/src/main/resources/jmxremote.access | 1 +
.../spring-app/src/main/resources/jmxremote.password | 1 +
.../james/app/spring/JamesAppSpringMainTest.java | 17 +++++++++++++++++
.../james/app/spring/JamesSpringContextTest.java | 18 +++++++++++++++++-
.../org/apache/james/modules/server/JMXServer.java | 5 +++--
.../META-INF/org/apache/james/spring-server.xml | 7 +++++++
src/site/xdoc/server/config-system.xml | 13 ++++++++-----
src/site/xdoc/server/feature-security.xml | 7 +++++++
upgrade-instructions.md | 8 ++++++++
11 files changed, 90 insertions(+), 10 deletions(-)
create mode 100644 server/apps/spring-app/src/main/resources/jmxremote.access
create mode 100644 server/apps/spring-app/src/main/resources/jmxremote.password
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org
(james-project) 03/04: [FIX] Document JMX auth for Spring
Posted by bt...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
btellier pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/james-project.git
commit a14ddfa1f91aafa9d9cb95fc2b74c9a28047a3cb
Author: Benoit TELLIER <bt...@linagora.com>
AuthorDate: Wed Dec 20 17:07:29 2023 +0100
[FIX] Document JMX auth for Spring
---
src/site/xdoc/server/config-system.xml | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/src/site/xdoc/server/config-system.xml b/src/site/xdoc/server/config-system.xml
index 68db2898b7..67afc64bc9 100644
--- a/src/site/xdoc/server/config-system.xml
+++ b/src/site/xdoc/server/config-system.xml
@@ -149,8 +149,6 @@
<b>JMX Security</b>
- <p>Guice only</p>
-
<p>In order to set up JMX authentication, we need to put <code>jmxremote.password</code> and <code>jmxremote.access</code> file
to <code>/conf</code> directory.</p>
@@ -168,11 +166,11 @@
james-admin readwrite
</code></pre>
- <p>When James runs with option <code>-Djames.jmx.credential.generation=true</code>, James will automatically
+ <p>(Guice only) When James runs with option <code>-Djames.jmx.credential.generation=true</code>, James will automatically
generate <code>jmxremote.password</code> if the file does not exist.
Then the default username is <code>james-admin</code> and a random password. This option defaults to true.</p>
-
+ <p>(Spring only) Presence of JMX credentials is compulsory to start the server.</p>
</subsection>
<subsection name="sqlResources.xml">
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org
(james-project) 02/04: [FIX] Set up JMX auth for Spring
Posted by bt...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
btellier pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/james-project.git
commit 877e361c3e4348445c2cb54ba9a2b63d22390389
Author: Benoit TELLIER <bt...@linagora.com>
AuthorDate: Tue Dec 19 18:13:25 2023 +0100
[FIX] Set up JMX auth for Spring
This prevents un-authenticated user from triggering
deserialization exploits which could be exploited
for privilege escalation.
---
.../src/main/java/org/apache/james/cli/ServerCmd.java | 12 +++++++++++-
.../spring-app/src/main/resources/jmxremote.access | 1 +
.../spring-app/src/main/resources/jmxremote.password | 1 +
.../james/app/spring/JamesAppSpringMainTest.java | 17 +++++++++++++++++
.../james/app/spring/JamesSpringContextTest.java | 18 +++++++++++++++++-
.../META-INF/org/apache/james/spring-server.xml | 7 +++++++
upgrade-instructions.md | 8 ++++++++
7 files changed, 62 insertions(+), 2 deletions(-)
diff --git a/server/apps/cli/src/main/java/org/apache/james/cli/ServerCmd.java b/server/apps/cli/src/main/java/org/apache/james/cli/ServerCmd.java
index aa25f95de3..b1f4058791 100644
--- a/server/apps/cli/src/main/java/org/apache/james/cli/ServerCmd.java
+++ b/server/apps/cli/src/main/java/org/apache/james/cli/ServerCmd.java
@@ -121,7 +121,7 @@ public class ServerCmd {
public static void executeAndOutputToStream(String[] args, PrintStream printStream) throws Exception {
Stopwatch stopWatch = Stopwatch.createStarted();
CommandLine cmd = parseCommandLine(args);
- JmxConnection jmxConnection = new JmxConnection(getHost(cmd), getPort(cmd), getAuthCredential(cmd, JMX_PASSWORD_FILE_PATH_DEFAULT));
+ JmxConnection jmxConnection = new JmxConnection(getHost(cmd), getPort(cmd), getAuthCredential(cmd, locateJmxConfiguration()));
CmdType cmdType = new ServerCmd(
new JmxDataProbe().connect(jmxConnection),
@@ -135,6 +135,16 @@ public class ServerCmd {
stopWatch.stop();
}
+ private static String locateJmxConfiguration() {
+ if (!new File(JMX_PASSWORD_FILE_PATH_DEFAULT).exists()) {
+ return JMX_PASSWORD_FILE_PATH_DEFAULT;
+ }
+ if (!new File("conf/jmxremote.password").exists()) {
+ return "conf/jmxremote.password";
+ }
+ return "../conf/jmxremote.password";
+ }
+
private final JmxDataProbe probe;
private final JmxMailboxProbe mailboxProbe;
private final JmxQuotaProbe quotaProbe;
diff --git a/server/apps/spring-app/src/main/resources/jmxremote.access b/server/apps/spring-app/src/main/resources/jmxremote.access
new file mode 100644
index 0000000000..09a7b6612a
--- /dev/null
+++ b/server/apps/spring-app/src/main/resources/jmxremote.access
@@ -0,0 +1 @@
+james-admin readwrite
\ No newline at end of file
diff --git a/server/apps/spring-app/src/main/resources/jmxremote.password b/server/apps/spring-app/src/main/resources/jmxremote.password
new file mode 100644
index 0000000000..f2ad9e9aee
--- /dev/null
+++ b/server/apps/spring-app/src/main/resources/jmxremote.password
@@ -0,0 +1 @@
+james-admin changeme
\ No newline at end of file
diff --git a/server/apps/spring-app/src/test/java/org/apache/james/app/spring/JamesAppSpringMainTest.java b/server/apps/spring-app/src/test/java/org/apache/james/app/spring/JamesAppSpringMainTest.java
index 3acc3a596d..52726603ee 100644
--- a/server/apps/spring-app/src/test/java/org/apache/james/app/spring/JamesAppSpringMainTest.java
+++ b/server/apps/spring-app/src/test/java/org/apache/james/app/spring/JamesAppSpringMainTest.java
@@ -18,11 +18,28 @@
****************************************************************/
package org.apache.james.app.spring;
+import java.io.File;
+import java.io.FileOutputStream;
+
import org.junit.jupiter.api.Test;
class JamesAppSpringMainTest {
@Test
void testServer() throws Exception {
+ File accessFile = new File("../conf/jmxremote.access");
+ accessFile.getParentFile().mkdirs();
+ accessFile.createNewFile();
+ try (FileOutputStream out = new FileOutputStream(accessFile)) {
+ out.write("james-admin readwrite\r\n".getBytes());
+ out.flush();
+ }
+ File passwordFile = new File("../conf/jmxremote.password");
+ passwordFile.createNewFile();
+ try (FileOutputStream out = new FileOutputStream(passwordFile)) {
+ out.write("james-admin changeme\r\n".getBytes());
+ out.flush();
+ }
+
JamesAppSpringMain.main(null);
}
}
diff --git a/server/apps/spring-app/src/test/java/org/apache/james/app/spring/JamesSpringContextTest.java b/server/apps/spring-app/src/test/java/org/apache/james/app/spring/JamesSpringContextTest.java
index 8d2560a1fa..b65462d8cf 100644
--- a/server/apps/spring-app/src/test/java/org/apache/james/app/spring/JamesSpringContextTest.java
+++ b/server/apps/spring-app/src/test/java/org/apache/james/app/spring/JamesSpringContextTest.java
@@ -21,6 +21,9 @@ package org.apache.james.app.spring;
import static org.assertj.core.api.Assertions.assertThat;
+import java.io.File;
+import java.io.FileOutputStream;
+
import org.apache.james.container.spring.context.JamesServerApplicationContext;
import org.apache.james.events.InVMEventBus;
import org.apache.james.mailbox.lucene.search.LuceneMessageSearchIndex;
@@ -34,7 +37,20 @@ class JamesSpringContextTest {
private JamesServerApplicationContext context;
@BeforeEach
- void setup() {
+ void setup() throws Exception {
+ File accessFile = new File("../conf/jmxremote.access");
+ accessFile.getParentFile().mkdirs();
+ accessFile.createNewFile();
+ try (FileOutputStream out = new FileOutputStream(accessFile)) {
+ out.write("james-admin readwrite\r\n".getBytes());
+ out.flush();
+ }
+ File passwordFile = new File("../conf/jmxremote.password");
+ passwordFile.createNewFile();
+ try (FileOutputStream out = new FileOutputStream(passwordFile)) {
+ out.write("james-admin changeme\r\n".getBytes());
+ out.flush();
+ }
context = new JamesServerApplicationContext(new String[] { "META-INF/org/apache/james/spring-server.xml" });
context.registerShutdownHook();
context.start();
diff --git a/server/container/spring/src/main/resources/META-INF/org/apache/james/spring-server.xml b/server/container/spring/src/main/resources/META-INF/org/apache/james/spring-server.xml
index 7e68e89591..27ab76901e 100644
--- a/server/container/spring/src/main/resources/META-INF/org/apache/james/spring-server.xml
+++ b/server/container/spring/src/main/resources/META-INF/org/apache/james/spring-server.xml
@@ -219,6 +219,13 @@
<property name="objectName" value="connector:name=rmi"/>
<property name="serviceUrl"
value="service:jmx:rmi://${jmx.address}/jndi/rmi://${jmx.address}:${jmx.port}/jmxrmi"/>
+ <property name="environment">
+ <map>
+ <entry key="jmx.remote.x.password.file" value="../conf/jmxremote.password" />
+ <entry key="jmx.remote.x.access.file" value="../conf/jmxremote.access" />
+ <entry key="jmx.remote.rmi.server.credentials.filter.pattern" value="java.lang.String;!*"/>
+ </map>
+ </property>
</bean>
<bean id="registry" class="org.springframework.remoting.rmi.RmiRegistryFactoryBean">
diff --git a/upgrade-instructions.md b/upgrade-instructions.md
index f9d0669b7f..a713e73113 100644
--- a/upgrade-instructions.md
+++ b/upgrade-instructions.md
@@ -25,6 +25,14 @@ Change list:
- [Set up TTL on the mailbox_change and email_change tables](#set-up-ttl-on-the-mailboxchange-and-emailchange-tables)
- [Change compaction strategy of blob_cache table](#change-compaction-strategy-of-blobcache-table)
- [RRT forwards now rewrite senders](#rrt-forwards-now-rewrite-senders)
+ - [Increase RabbitMQ consumer timeout on the task queue](#increase-rabbitmq-consumer-timeout-on-the-task-queue)
+ - [JMX authentication for Spring](#jmx-authentication-for-spring)
+
+### JMX authentication for Spring
+
+Date: 19/12/2023
+
+Spring distribution now requires `jmxremote.access` and `jmxremote.password` files within the `/conf` folder in order to start.
### Increase RabbitMQ consumer timeout on the task queue
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org
(james-project) 04/04: [FIX] Add more JMX disclaimers
Posted by bt...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
btellier pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/james-project.git
commit 8e7c7ac7aedfd6c1a3731fd281e1ab585425a3ab
Author: Benoit TELLIER <bt...@linagora.com>
AuthorDate: Wed Dec 20 17:10:16 2023 +0100
[FIX] Add more JMX disclaimers
---
.../docs/modules/ROOT/pages/configure/jmx.adoc | 11 ++++++++++-
src/site/xdoc/server/config-system.xml | 7 ++++++-
src/site/xdoc/server/feature-security.xml | 7 +++++++
3 files changed, 23 insertions(+), 2 deletions(-)
diff --git a/server/apps/distributed-app/docs/modules/ROOT/pages/configure/jmx.adoc b/server/apps/distributed-app/docs/modules/ROOT/pages/configure/jmx.adoc
index 00215bf53d..04e88db20c 100644
--- a/server/apps/distributed-app/docs/modules/ROOT/pages/configure/jmx.adoc
+++ b/server/apps/distributed-app/docs/modules/ROOT/pages/configure/jmx.adoc
@@ -1,6 +1,16 @@
= Distributed James Server — jmx.properties
:navtitle: jmx.properties
+== Disclaimer
+
+JMX poses several security concerns and had been leveraged to conduct arbitrary code execution.
+This threat is mitigated by not allowing remote connections to JMX, setting up authentication and pre-authentication filters.
+However, we recommend to either run James in isolation (docker / own virtual machine) or disable JMX altogether.<br/>
+
+James JMX endpoint provides command line utilities and exposes a few metrics, also available on the metric endpoint.</p>
+
+== Configuration
+
This is used to configure the JMX MBean server via which all management is achieved.
Consult this link:https://github.com/apache/james-project/blob/master/server/apps/distributed-app/sample-configuration/jmx.properties[example]
@@ -23,7 +33,6 @@ in GIT to get some examples and hints.
To access from a remote location, it has been reported that `-Dcom.sun.management.jmxremote.ssl=false` is needed as
a JVM argument.
-
== JMX Security
In order to set up JMX authentication, we need to put `jmxremote.password` and `jmxremote.access` file
diff --git a/src/site/xdoc/server/config-system.xml b/src/site/xdoc/server/config-system.xml
index 67afc64bc9..ff4cbc0c07 100644
--- a/src/site/xdoc/server/config-system.xml
+++ b/src/site/xdoc/server/config-system.xml
@@ -131,6 +131,11 @@
<subsection name="jmx.properties">
+ <p><b>Disclaimer: </b> JMX poses several security concerns and had been leveraged to conduct arbitrary code execution.
+ This threat is mitigated by not allowing remote connections to JMX, setting up authentication and pre-authentication filters.
+ However, we recommend to either run James in isolation (docker / own virtual machine) or disable JMX altogether.<br/>
+ James JMX endpoint provides command line utilities and exposes a few metrics, also available on the metric endpoint.</p>
+
<p>Consult <a href="https://github.com/apache/james-project/tree/master/server/apps/spring-app/src/main/resources/jmx.properties">jmx.properties</a> in GIT to get some examples and hints.</p>
<p>This is used to configure the JMX MBean server via which all management is achieved (also used by via the james-cli).</p>
@@ -145,7 +150,7 @@
</dl>
<p>To access from a remote location, it has been reported that <code>-Dcom.sun.management.jmxremote.ssl=false</code> is
- needed in the startup script.</p>
+ needed in the startup script. Exposing JMX remotely poses numerous security issues and as such is strongly discouraged.</p>
<b>JMX Security</b>
diff --git a/src/site/xdoc/server/feature-security.xml b/src/site/xdoc/server/feature-security.xml
index 00986b1bb6..ce135df3d8 100644
--- a/src/site/xdoc/server/feature-security.xml
+++ b/src/site/xdoc/server/feature-security.xml
@@ -48,6 +48,13 @@
</section>
+ <section name="JMX">
+ <p><b>Disclaimer: </b> JMX poses several security concerns and had been leveraged to conduct arbitrary code execution.
+ This threat is mitigated by not allowing remote connections to JMX, setting up authentication and pre-authentication filters.
+ However, we recommend to either run James in isolation (docker / own virtual machine) or disable JMX altogether.<br/>
+ James JMX endpoint provides command line utilities and exposes a few metrics, also available on the metric endpoint.</p>
+ </section>
+
<section name="Reported vulnerabilities">
<subsection name="Reporting vulnerabilities">
We follow the standard procedures within the ASF regarding
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org
(james-project) 01/04: [FIX] Set up JMX auth filter for Guice
Posted by bt...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
btellier pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/james-project.git
commit 75a776dbf8bfe7b19d2a0542e11691070b4fd5b2
Author: Benoit TELLIER <bt...@linagora.com>
AuthorDate: Tue Dec 19 16:55:52 2023 +0100
[FIX] Set up JMX auth filter for Guice
This prevents un-authenticated user from triggering
deserialization exploits which could be exploited
for privilege escalation.
---
.../jmx/src/main/java/org/apache/james/modules/server/JMXServer.java | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/server/container/guice/jmx/src/main/java/org/apache/james/modules/server/JMXServer.java b/server/container/guice/jmx/src/main/java/org/apache/james/modules/server/JMXServer.java
index b8d3547ed5..68da3a885a 100644
--- a/server/container/guice/jmx/src/main/java/org/apache/james/modules/server/JMXServer.java
+++ b/server/container/guice/jmx/src/main/java/org/apache/james/modules/server/JMXServer.java
@@ -131,8 +131,9 @@ public class JMXServer implements Startable {
Map<String, String> environment = Optional.of(existJmxPasswordFile())
.filter(FunctionalUtils.identityPredicate())
.map(hasJmxPasswordFile -> ImmutableMap.of("jmx.remote.x.password.file", jmxPasswordFilePath,
- "jmx.remote.x.access.file", jmxAccessFilePath))
- .orElse(ImmutableMap.of());
+ "jmx.remote.x.access.file", jmxAccessFilePath,
+ "jmx.remote.rmi.server.credentials.filter.pattern", "java.lang.String;!*"))
+ .orElse(ImmutableMap.of("jmx.remote.rmi.server.credentials.filter.pattern", "java.lang.String;!*"));
jmxConnectorServer = JMXConnectorServerFactory.newJMXConnectorServer(new JMXServiceURL(serviceURL),
environment,
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org