Ultimamente me estoy peleando con jboss. Como de cualquier pelea, se aprende algo. Así que anotamos lo que hemos aprendido.

• LdapExtLoginModule
• Configuring LDAP for an application from the ground
• Secure Jboss
• How to create a mini web site to serve static content

Todo lo que cuente a partir de este punto es sobre esta versión. Como Jboss es tan caprichoso con las versiones, posíblemente haya cambios significativos entre una versión y la siguiente, aunque sea un minor change. A ver si alguien le da un par de collejas al equipo de desarrollo y se centran los muchachos, que me tienen….

¿Quieres que todo el log de una clase concreta quede registrado?? Por ejemplo, todo lo que venga de la clase “org.jboss.security.auth.spi.LdapLoginModule” que esté al máximo nivel de depurado posible???

Pues es bien sencillo, abrimos el fichero JBOSS_HOME\server\xxx\conf\jboss-log4j.xml y añadimos algo como ésto:

   <category name="org.jboss.security.auth.spi.LdapLoginModule" additivity="false">
     <priority value="DEBUG"/>
     <appender-ref ref="FILE"/>
   </category>

y se obra el milagro milagrete:

2010-10-15 14:49:39,300 DEBUG [org.jboss.security.auth.spi.LdapLoginModule] (http-127.0.0.1-8080-5) Bad password for username=perico

Una cosa que me ha tenido bastante desconcertado es el hecho de que jboss no es visible desde fuera de la máquina donde está instalado. Mirando por aquí y por allí, he visto que para conseguir que sea visible desde fuera, hay que configurar la propiedad jboss.bind.address.

Parece ser que los muchachos de jboss, tan atentos ellos como siempre, han dejado ese asunto al pairo y hay que establecer eso como un parámetro que se pasa al ejecutar el servidor.

¿Cómo podemos hacerlo un poco más elaborado???

Es sencillo, yo he modificado el fichero run.conf.bat para que contenga una mínima configuración guardada en un fichero y también el fichero run.bat para que la lea.

En run.conf.bat añadiremos esto al principio:

rem jboss bind addess: listen for all the interfaces
rem set BIND_ADDRESS="127.0.0.1" 
set BIND_ADDRESS="0.0.0.0" 

lo que nos permitirá establecer sobre qué dirección queremos que escuche jboss. Por defecto, 0.0.0.0 son “todas las posibles”. Os recomiendo esto especialmente si quereis que os funcione con IPv6.

En run.bat añadiremos –host=%BIND_ADDRESS% justo donde puede verse aquí:

:RESTART
"%JAVA%" %JAVA_OPTS% ^
   -Djava.endorsed.dirs="%JBOSS_ENDORSED_DIRS%" ^
   -classpath "%JBOSS_CLASSPATH%" ^
   org.jboss.Main -c %CURRENT_CONFIG% --host=%BIND_ADDRESS% %*

if ERRORLEVEL 10 goto RESTART

I am copying this webpage:

http://www.articlesbase.com/security-articles/exploitation-and-remediation-of-jboss-application-server-default-configuration-vulnerability-1889469.html

because I found very interesting: it covers a topic in securization important.

Exploitation and Remediation of JBoss Application Server default configuration vulnerability

A lot of servers these days are found to have their JBoss Management Console open to the world, without any authentication, no password or default password!

A huge and silly vulnerability!

JBoss Management Console or JMX-Console provides a view into the microkernel of the Jboss application server, as well as access to the MBeans of the application server. This console can be used to configure the MBeans of the JBoss server. With default configuration the JMX console on url http://vulnerablehost:8080/jmx-console/ can be accessed without authentication or sometime bypassing authentication using default credentials (admin/admin).

What an attacker can do?

Any remote user can completely control the server, having full control to a lot of server configurations and internal network and infrastructure information disclosure, you can change the web service listening port (I test this with one of them, then I put back the original port), view internal IPs and start connections to a client, a lot of server absolute paths, you can change security configurations… too much power with almost no knowledge needed.

Two most common exploitation scenarios: Shutting down JBoss with the JMX Console Open the JMXConsole in your browser (for example: http://localhost:8080/jmx-console)

Navigate to the jboss.system:type=Server mbean (hint : you can probably just CTRL-F and enter in the dialog box)

Click on the jboss.system:

Scroll down to “Shutdown” and press invoke

Say bye bye to JBoss.

Inclusion of malicious URLs using the DeploymentScanner:

It is necessary to create a WAR file with WEB-INF a JSP to execute system commands.

Navigate the browser to the

jboss.deployment:flavor=URL,

type=DeploymentScanner mbean

(http://[host]:8080/jmx-console/HtmlAdaptor?action=inspectMBean&name=jboss.deployment:type=DeploymentScanner,flavor=URL)

Add the URL of the customized WAR file with the addURL() command

Access the deployed application and start executing commands with the same privilege assigned to the Application server itself.

How to guard against:

Secure the JMX Console using a username/password file

Locate the jmx-console.war directory. Normally found in server/default/deploy in your JBOSS_HOME directory.

Edit the WEB-INF/web.xml; uncomment the security-constraint block.

Edit the WEB-INF/jmx-console-users.properties or server/default/conf/props/jmx-console-users.properties (version>=4.0.2) and WEB-INF/jmx-console- roles.properties or server/default/conf/props/jmx-console-roles.properties (version>=4.0.2) and change the users and passwords to what you desire. Please note: They will need the JBossAdmin role specified in the web.xml file to run the JMX Console.

Edit the WEB-INF/jboss-web.xml, uncomment the security-domain block. The security-domain value of jmx-console maps is declared in the login-config.xml JAAS configuration file which defines how authentication and authorization is done.

Secure the JMX Console using your own JAAS domain

Edit the WEB-INF/web.xml as above, uncommenting the security-constraint block. Change the role-name value to be the role in your domain that can access the console

Edit the WEB-INF/jboss-web.xml as in step1, set the security domain to be the name of your security domain. For example, if your login-config.xml has an application-policy whose name is MyDomain then your JAAS domain java:/jaas/MyDomain

Redeploy the application

Secure the web console

In the deploy directory, locate management/web-console.war and make the same changes as above to the WEB-INF/web.xml, WEB-INF/jboss-web.xml and the users/groups properties file.

Read more: http://www.articlesbase.com/security-articles/exploitation-and-remediation-of-jboss-application-server-default-configuration-vulnerability-1889469.html#ixzz12uem4hCj Under Creative Commons License: Attribution