Differences

This shows you the differences between two versions of the page.

--- java:jboss [2010/10/15 12:43] – creado rlunaro
+++ java:jboss [2024/10/05 17:00] (current) – rlunaro
@@ Line 2: / Line 2: @@
 Ultimamente me estoy peleando con jboss. Como de cualquier pelea, se aprende algo. Así que anotamos lo que hemos aprendido.
+  * [[LdapExtLoginModule]]
+  * [[LDAPConfigFromTheGround|Configuring LDAP for an application from the ground]]
+  * [[http://community.jboss.org/wiki/SecureJBoss|Secure Jboss]]
+  * [[StaticMiniSiteInJBoss|How to create a mini web site to serve static content]]
 ===== Version JBoss [The Oracle] 5.1.0.GA =====
@@ Line 19: / Line 26: @@
    </category>
 </code>
+y se obra el milagro milagrete:
+<code>
+-10-15 14:49:39,300 DEBUG [org.jboss.security.auth.spi.LdapLoginModule] (http-127.0.0.1-8080-5) Bad password for username=perico
+</code>
+==== Como hacer que jboss sea visible desde fuera de mi máquina ====
+Una cosa que me ha tenido bastante desconcertado es el hecho de que jboss no es visible desde fuera de la máquina donde está instalado. Mirando por aquí y por allí, he visto que para conseguir que sea visible desde fuera, hay que configurar la propiedad ''jboss.bind.address''.
+Parece ser que los muchachos de jboss, tan atentos ellos como siempre, han dejado ese asunto al pairo y hay que establecer eso como un parámetro que se pasa al ejecutar el servidor.
+**¿Cómo podemos hacerlo un poco más elaborado???**
+Es sencillo, yo he modificado el fichero ''run.conf.bat'' para que contenga una mínima configuración guardada en un fichero y también el fichero ''run.bat'' para que la lea.
+En ''run.conf.bat'' añadiremos esto al principio:
+<code>
+rem jboss bind addess: listen for all the interfaces
+rem set BIND_ADDRESS="127.0.0.1"
+set BIND_ADDRESS="0.0.0.0"
+</code>
+lo que nos permitirá establecer sobre qué dirección queremos que escuche jboss. Por defecto, 0.0.0.0 son "todas las posibles". Os recomiendo esto especialmente si quereis que os funcione con IPv6.
+En ''run.bat'' añadiremos ''--host=%BIND_ADDRESS%'' justo donde puede verse aquí:
+<code>
+:RESTART
+"%JAVA%" %JAVA_OPTS% ^
+   -Djava.endorsed.dirs="%JBOSS_ENDORSED_DIRS%" ^
+   -classpath "%JBOSS_CLASSPATH%" ^
+   org.jboss.Main -c %CURRENT_CONFIG% --host=%BIND_ADDRESS% %*
+if ERRORLEVEL 10 goto RESTART
+</code>
+==== Securing JMX Console ====
+I am copying this webpage:
+[[http://www.articlesbase.com/security-articles/exploitation-and-remediation-of-jboss-application-server-default-configuration-vulnerability-1889469.html]]
+because I found very interesting: it covers a topic in securization important.
+Exploitation and Remediation of JBoss Application Server default configuration vulnerability
+A lot of servers these days are found to have their JBoss Management Console open to the world, without any authentication, no password or default password!
+A huge and silly vulnerability!
+JBoss Management Console or JMX-Console provides a view into the microkernel of the Jboss application server, as well as access to the MBeans of the application server. This console can be used to configure the MBeans of the JBoss server.  With default configuration the JMX console on url http://vulnerablehost:8080/jmx-console/ can be accessed without authentication or sometime bypassing authentication using default credentials (admin/admin).
+What an attacker can do?
+Any remote user can completely control the server, having full control to a lot of server configurations and internal network and infrastructure information disclosure, you can change the web service listening port (I test this with one of them, then I put back the original port), view internal IPs and start connections to a client, a lot of server absolute paths, you can change security configurations… too much power with almost no knowledge needed.
+Two most common exploitation scenarios:
+Shutting down JBoss with the JMX Console
+Open the JMXConsole in your browser (for example: http://localhost:8080/jmx-console)
+Navigate to the jboss.system:type=Server mbean (hint
+: you can probably just CTRL-F and enter in the dialog box)
+Click on the jboss.system:
+Scroll down to "Shutdown" and press invoke
+Say bye bye to JBoss.
+Inclusion of malicious URLs using the DeploymentScanner:
+It is necessary to create a WAR file with WEB-INF a JSP to execute system commands.
+Navigate the browser to the
+jboss.deployment:flavor=URL,
+type=DeploymentScanner mbean
+(http://[host]:8080/jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.deployment:type=DeploymentScanner,flavor=URL)
+Add the URL of the customized WAR file with the addURL() command
+Access the deployed application and start executing commands with the same privilege assigned to the Application server itself.
+How to guard against:
+Secure the JMX Console using a username/password file
+Locate the jmx-console.war directory. Normally found in server/default/deploy in your JBOSS_HOME directory.
+Edit the WEB-INF/web.xml; uncomment the security-constraint block.
+Edit the WEB-INF/jmx-console-users.properties or server/default/conf/props/jmx-console-users.properties (version>=4.0.2) and WEB-INF/jmx-console- roles.properties or server/default/conf/props/jmx-console-roles.properties (version>=4.0.2) and change the users and passwords to what you desire.  Please note: They will need the JBossAdmin role specified in the web.xml file to run the JMX Console.
+Edit the WEB-INF/jboss-web.xml, uncomment the security-domain block. The security-domain value of jmx-console maps is declared in the login-config.xml JAAS configuration file which defines how authentication and authorization is done.
+Secure the JMX Console using your own JAAS domain
+Edit the WEB-INF/web.xml as above, uncommenting the security-constraint block. Change the role-name value to be the role in your domain that can access the console
+Edit the WEB-INF/jboss-web.xml as in step1, set the security domain to be the name of your security domain. For example, if your login-config.xml has an application-policy whose name is MyDomain then your JAAS domain java:/jaas/MyDomain
+Redeploy the application
+Secure the web console
+In the deploy directory, locate management/web-console.war and make the same changes as above to the WEB-INF/web.xml, WEB-INF/jboss-web.xml and the users/groups properties file.
+Read more: http://www.articlesbase.com/security-articles/exploitation-and-remediation-of-jboss-application-server-default-configuration-vulnerability-1889469.html#ixzz12uem4hCj
+Under Creative Commons License: Attribution