Fuse MQ Enterprise - Managing and Monitoring a Broker

Basic Security Configuration

Overview

The default security settings block access to a broker's remote ports. If you want to access the Fuse MQ Enterprise runtime remotely, you must first customize the security configuration. The first thing you will want to do is create at least one JAAS user. This will enable remote access to the broker.

Other common configuration changes you may want to make are:

configure access to the Web console
assign roles to each of the remote ports to limit access
strengthen the credentials needed to access the remote console

Create a secure JAAS user

By default, no JAAS users are defined for the container, which effectively disables remote access (it is impossible to log on).

To create a secure JAAS user, edit the InstallDir/etc/users.properties file and add a new user field, as follows:

Username=Password,admin

Where Username and Password are the new user credentials. The admin role gives this user the privileges to access all administration and management functions of the container. For more details about JAAS, see JAAS Authentication in Security Guide.

	Warning
	It is strongly recommended that you define custom user credentials with a strong password.

Configure the Web console

If you want to access the Web console (for remote administration of JMS messaging), you must provide the Web console servlet with the credentials it needs to login to the JMS broker.

Edit the InstallDir/etc/system.properties file and modify the webconsole.jmx.* and webconsole.jms.* properties as follows:

webconsole.jmx.user=Username
webconsole.jmx.password=Password
webconsole.jms.user=Username
webconsole.jms.password=Password

Where the Username and Password are the credentials of a JAAS user with admin privileges.

For more details on securing the Web console see Securing the Web Console.

Assigning roles for remote access

You can independently configure roles for the following different administrative protocols:

SSH (remote console login)
To override the default role for the remote console add a sshRole property to the org.apache.karaf.shell PID. The following sets the role to admin:
```
sshRole=admin
```
JMX management
To override the default role for JMX add a jmxRole property to the org.apache.karaf.management PID. The following sets the role to jmx:
```
jmxRole=jmx
```
Web console

Strengthening security on the remote console port

You can employ the following measures to strengthen security on the remote console port:

Make sure that the JAAS user credentials have strong passwords.
Customize the X.509 certificate (replace the Java keystore file, InstallDir/etc/host.key, with a custom key pair).

For more details, see Securing the Fuse MQ Enterprise Container.

Comments powered by Disqus