You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by "Bärtschi, Markus-MGB" <ma...@mgb.ch> on 2022/11/04 08:06:14 UTC
TLS configuration TLS for JMX port
I configured TLS for my JMX post, this is working alright.
But the keystore information, especially the passwords end up on the java/tomcat command line.
I did attempt to move the configuration items into catalina.properties, but this did not work.
How can I configure TSL for my JMX port without the keystore information showing up on the command line ?
Markus Baertschi, Migros, Switzerland
Re: AW: TLS configuration TLS for JMX port
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Markus,
On 11/4/22 06:04, Bärtschi, Markus-MGB wrote:
> On 04/11/2022 08:06, Bärtschi, Markus-MGB wrote:
>>> How can I configure TSL for my JMX port without the keystore information showing up on the command line ?
>
>> Don't use passwords. Rely on operating system file permissions to limit access to the file to the Tomcat process (and root).
>
> So you recommend to use a passwordless keystore and chmod 600 it to protect it ?
>
>> Keep in mind that JMX has various security issues you can do very little about including:
>> - extremely coarse grained security (read-only or read/write)
>> - no protection against brute force attacks
>> - no logging to identify brute force attacks
>> Note that Tomcat is implemented from the point of view that *any* JMX access is equivalent to full administrative access.
>
> I'm aware the JMX is not great from a security perspective. But we need a way to monitor what is going on.
I highly recommend using the JMXProxyServlet which is provided by
Tomcat, though you do have to deploy the "Manager" application in order
to use it.
You can lock that down much more tightly than a (relatively) wide-open
JMX port.
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
AW: TLS configuration TLS for JMX port
Posted by "Bärtschi, Markus-MGB" <ma...@mgb.ch>.
On 04/11/2022 08:06, Bärtschi, Markus-MGB wrote:
>> How can I configure TSL for my JMX port without the keystore information showing up on the command line ?
> Don't use passwords. Rely on operating system file permissions to limit access to the file to the Tomcat process (and root).
So you recommend to use a passwordless keystore and chmod 600 it to protect it ?
> Keep in mind that JMX has various security issues you can do very little about including:
> - extremely coarse grained security (read-only or read/write)
> - no protection against brute force attacks
> - no logging to identify brute force attacks
> Note that Tomcat is implemented from the point of view that *any* JMX access is equivalent to full administrative access.
I'm aware the JMX is not great from a security perspective. But we need a way to monitor what is going on.
> Mark
Thanks ! Markus
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: TLS configuration TLS for JMX port
Posted by Mark Thomas <ma...@apache.org>.
On 04/11/2022 08:06, Bärtschi, Markus-MGB wrote:
>
> I configured TLS for my JMX post, this is working alright.
>
> But the keystore information, especially the passwords end up on the java/tomcat command line.
> I did attempt to move the configuration items into catalina.properties, but this did not work.
>
> How can I configure TSL for my JMX port without the keystore information showing up on the command line ?
Don't use passwords. Rely on operating system file permissions to limit
access to the file to the Tomcat process (and root).
Keep in mind that JMX has various security issues you can do very little
about including:
- extremely coarse grained security (read-only or read/write)
- no protection against brute force attacks
- no logging to identify brute force attacks
Note that Tomcat is implemented from the point of view that *any* JMX
access is equivalent to full administrative access.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org