The Fuse ESB Enterprise runtime is secured against network attack by default, because all of its exposed ports require user authentication and no users are defined initially. In other words, the Fuse ESB Enterprise runtime is remotely inaccessible by default.

If you want to access the runtime remotely, you must first customize the security configuration, as described here.

If you want to enable remote access to the Fuse ESB Enterprise container, perform the following configuration steps before starting the container:

By default, no JAAS users are defined for the container, which effectively disables remote access (it is impossible to log on).

To create a secure JAAS user, edit the InstallDir/etc/users.properties file and add a new user field, as follows:

Username=Password,admin

Where Username and Password are the new user credentials. The admin role gives this user the privileges to access all administration and management functions of the container. For more details about JAAS, see Configuring JAAS Security.

	Warning
	It is strongly recommended that you define custom user credentials with a strong password.

If you want to access the Apache ActiveMQ Web console (for remote administration of JMS messaging), you must provide the Web console servlet with the credentials it needs to login to the JMS broker.

Edit the InstallDir/etc/system.properties file and modify the webconsole.jmx.* and webconsole.jms.* properties as follows:

webconsole.jmx.user=Username
webconsole.jmx.password=Password
webconsole.jms.user=Username
webconsole.jms.password=Password

Where the Username and Password are the credentials of a JAAS user with admin privileges.

Figure 1 shows the ports exposed by the Fuse ESB Enterprise container by default.

Figure 1. Ports Exposed by the Fuse ESB Enterprise Container

The following ports are exposed by the container:

You can access the remote console port whenever both of the following conditions are true:

For example, to log on to the remote console port from the same machine where the container is running, enter the following command:

./client -u Username -p Password

Where the Username and Password are the credentials of a JAAS user with admin privileges. For more details, see Using Remote Connections to Manage a Container.

You can employ the following measures to strengthen security on the remote console port:

The JMX port is enabled by default and secured by JAAS authentication. In order to access the JMX port, you must have configured JAAS with at least one set of login credentials. To connect to the JMX port, open a JMX client (for example, jconsole) and connect to the following JMX URI:

service:jmx:rmi:///jndi/rmi://localhost:1099/karaf-root

You must also provide valid JAAS credentials to the JMX client in order to connect.

	Note
	In general, the tail of the JMX URI has the format /karaf-ContainerName. If you change the container name from root to some other name, you must modify the JMX URI accordingly.

All of the Web consoles are installed as servlets in the container's embedded Jetty container. The Web consoles share the same HTTP server port, which is powered by Jetty. You can optionally enable the following Web consoles in Fuse ESB Enterprise:

The Karaf Web console is already secured by JAAS authentication. To add SSL security, see Securing the Web Console in Security Guide.