You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@activemq.apache.org by Martin Lichtin <li...@yahoo.com.INVALID> on 2020/08/30 19:19:20 UTC
ActiveMQ - low-level access control and rejecting connections
Hi
Looking at how to best implement IP-address based access control via a Plugin.
I've an implementation based on "addConnection", but this method is called way too late in the connection setup.
Ideally there should be a hook available in TcpConnection.connect() method to reject rogue connections as early as possible.
Note the current behaviour is quite bad, ActiveMQ accepts connections and doesn't drop them (client doesn't send any data), thus eventually exceeding the maximum number of allowed client connections and resulting in DoS.
- Martin
Re: Re: ActiveMQ - low-level access control and rejecting connections
Posted by Justin Bertram <jb...@apache.org>.
It seems a bit naive of a customer to expect the broker to not rely upon or
leverage features of the operating system, but I digress.
Are you tied to ActiveMQ 5.x or could you also use ActiveMQ Artemis?
Artemis already has a timeout which will disconnect clients that don't send
any data for a protocol handshake. It also supports plugins and in
particular interceptors which have direct access to the remote client's
connection and can decide whether or not to terminate that connection based
on the client's IP address.
Justin
On Tue, Sep 8, 2020 at 5:48 AM Martin Lichtin <li...@yahoo.com.invalid>
wrote:
> In theory, yes, an iptables or firewalld approach would work.
> But certain customers doing pen-testing require the solution to be
> self-sufficient, so I'll need
> this kind of access control as part of the listen-accept logic of the
> ActiveMQ broker.
>
> - Martin
>
> On 02.09.2020 18:14, Justin Bertram wrote:
> > Would a firewall rule be an option here? It seems like that would be the
> > best tool to control access to the broker based on IP address. Or is your
> > use-case more complex than that?
> >
> >
> > Justin
> >
> > On Sun, Aug 30, 2020 at 2:19 PM Martin Lichtin <lichtin@yahoo.com.invalid
> >
> > wrote:
> >
> >> Hi
> >>
> >> Looking at how to best implement IP-address based access control via a
> >> Plugin.
> >>
> >> I've an implementation based on "addConnection", but this method is
> called
> >> way too late in the connection setup.
> >>
> >> Ideally there should be a hook available in TcpConnection.connect()
> method
> >> to reject rogue connections as early as possible.
> >>
> >> Note the current behaviour is quite bad, ActiveMQ accepts connections
> and
> >> doesn't drop them (client doesn't send any data), thus eventually
> exceeding
> >> the maximum number of allowed client connections and resulting in DoS.
> >>
> >> - Martin
> >>
> >>
>
>
Re: Re: ActiveMQ - low-level access control and rejecting connections
Posted by Martin Lichtin <li...@yahoo.com.INVALID>.
In theory, yes, an iptables or firewalld approach would work.
But certain customers doing pen-testing require the solution to be self-sufficient, so I'll need
this kind of access control as part of the listen-accept logic of the ActiveMQ broker.
- Martin
On 02.09.2020 18:14, Justin Bertram wrote:
> Would a firewall rule be an option here? It seems like that would be the
> best tool to control access to the broker based on IP address. Or is your
> use-case more complex than that?
>
>
> Justin
>
> On Sun, Aug 30, 2020 at 2:19 PM Martin Lichtin <li...@yahoo.com.invalid>
> wrote:
>
>> Hi
>>
>> Looking at how to best implement IP-address based access control via a
>> Plugin.
>>
>> I've an implementation based on "addConnection", but this method is called
>> way too late in the connection setup.
>>
>> Ideally there should be a hook available in TcpConnection.connect() method
>> to reject rogue connections as early as possible.
>>
>> Note the current behaviour is quite bad, ActiveMQ accepts connections and
>> doesn't drop them (client doesn't send any data), thus eventually exceeding
>> the maximum number of allowed client connections and resulting in DoS.
>>
>> - Martin
>>
>>
Re: ActiveMQ - low-level access control and rejecting connections
Posted by Justin Bertram <jb...@apache.org>.
Would a firewall rule be an option here? It seems like that would be the
best tool to control access to the broker based on IP address. Or is your
use-case more complex than that?
Justin
On Sun, Aug 30, 2020 at 2:19 PM Martin Lichtin <li...@yahoo.com.invalid>
wrote:
> Hi
>
> Looking at how to best implement IP-address based access control via a
> Plugin.
>
> I've an implementation based on "addConnection", but this method is called
> way too late in the connection setup.
>
> Ideally there should be a hook available in TcpConnection.connect() method
> to reject rogue connections as early as possible.
>
> Note the current behaviour is quite bad, ActiveMQ accepts connections and
> doesn't drop them (client doesn't send any data), thus eventually exceeding
> the maximum number of allowed client connections and resulting in DoS.
>
> - Martin
>
>
Re: Re: ActiveMQ - low-level access control and rejecting connections
Posted by Martin Lichtin <li...@yahoo.com.INVALID>.
Yes. 5.15.13. It may be an issue with the SSL connector only.
https://issues.apache.org/jira/browse/AMQ-8030
https://issues.apache.org/jira/browse/AMQ-8031
- Martin
On 31.08.2020 06:08, Jean-Baptiste Onofre wrote:
> Hi,
>
> I guess you are talking about TCP/OpenWire transport connector.
>
> Which ActiveMQ version are you talking ?
>
> I remember to have fixed closing of connection in 5.15.13 AFAIR.
>
> Can you please create two Jira (one for the connect hook, one for connection leaking) ? I will take a look.
>
> Regards
> JB
>
>> Le 30 août 2020 à 21:19, Martin Lichtin <li...@yahoo.com.INVALID> a écrit :
>>
>> Hi
>>
>> Looking at how to best implement IP-address based access control via a Plugin.
>>
>> I've an implementation based on "addConnection", but this method is called way too late in the connection setup.
>>
>> Ideally there should be a hook available in TcpConnection.connect() method to reject rogue connections as early as possible.
>>
>> Note the current behaviour is quite bad, ActiveMQ accepts connections and doesn't drop them (client doesn't send any data), thus eventually exceeding the maximum number of allowed client connections and resulting in DoS.
>>
>> - Martin
Re: ActiveMQ - low-level access control and rejecting connections
Posted by Jean-Baptiste Onofre <jb...@nanthrax.net>.
Hi,
I guess you are talking about TCP/OpenWire transport connector.
Which ActiveMQ version are you talking ?
I remember to have fixed closing of connection in 5.15.13 AFAIR.
Can you please create two Jira (one for the connect hook, one for connection leaking) ? I will take a look.
Regards
JB
> Le 30 août 2020 à 21:19, Martin Lichtin <li...@yahoo.com.INVALID> a écrit :
>
> Hi
>
> Looking at how to best implement IP-address based access control via a Plugin.
>
> I've an implementation based on "addConnection", but this method is called way too late in the connection setup.
>
> Ideally there should be a hook available in TcpConnection.connect() method to reject rogue connections as early as possible.
>
> Note the current behaviour is quite bad, ActiveMQ accepts connections and doesn't drop them (client doesn't send any data), thus eventually exceeding the maximum number of allowed client connections and resulting in DoS.
>
> - Martin
>