Securing JBOSS JMX and Web Console

After installing the JBOSS Application Server, the jmx console can be accessed by anybody without providing any username/password. This is a big security risk as anybody can perform changes though the jmx and web console. Setting up basic username/password security for the jboss jmx/web console can be accomplished by performing the following steps on the JBOSS Application Server.

1. Edit $JBOSS_HOME/server/all/conf/props/jmx-console-users.properties to add jmx console users. Replace all with your JBOSS profile name. The syntax to add users is username=password. By default admin user would be available in this file with admin as password.

Ex : sysadmin=Password007 ## This configuration will create a new jmx and web console user as sysadmin and set the password as Password007

2. To provide admin privileges on jmx and web console to the newly created user, edit jmx-console-roles.properties file available in $JBOSS_HOME/server/all/conf/props folder and add username=JBossAdmin.

Ex : sysadmin=JBossAdmin ## This configuration will provide admin privileges to sysadmin user on jmx and web console.

3. Edit $JBOSS_HOME/server/all/deploy/jmx-console.war/WEB-INF/jboss-web.xml file and uncomment the security domain as shown below.

<jboss-web>
<security-domain>
java:/jaas/jmx-console
</security-domain>
</jboss-web>

4. Edit $JBOSS_HOME/server/all/deploy/jmx-console.war/WEB-INF/web.xml file and uncomment the security constraint as shown below.

<security-constraint>
<web-resource-collection>
<web-resource-name>
HtmlAdaptor
</web-resource-name>
<description>
An example security config that only allows
users with the role JBossAdmin to access the
HTML JMX console web application
</description>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>JBossAdmin</role-name>
</auth-constraint>
</security-constraint>

5. The location, path or name of the users and roles configuration files i.e. jmx-console-users.properties or jmx-console-roles.properties can be changed by editing $JBOSS_HOME/server/all/conf/login- -config.xml file. Sample configuration is given below.

<application-policy name=”jmx-console”>
<authentication>
<login-module code=
“org.jboss.security.auth.spi.UsersRolesLoginModule”
flag=”required”>
<module-option name=”usersProperties”>
props/jmx-console-users.properties
</module-option>
<module-option name=”rolesProperties”>
props/jmx-console-roles.properties
</module-option>
</login-module>
</authentication>
</application-policy>

6. Edit $JBOSS_HOME/server/all/deploy/management/console-mgr.sar/ web-console.war/WEB-INF/jboss-web.xml file and remove the comment of the security domain as shown below.

<jboss-web>
<security-domain>java:/jaas/web-console</security-domain>
<depends>jboss.admin:service=PluginManager</depends>
</jboss-web>

7. Edit $JBOSS_HOME/server/all/deploy/management/console-mgr.sar/ web-console.war/WEB-INF/web.xml file and remove the comment of the security constraint as shown below.

<security-constraint>
<web-resource-collection>
<web-resource-name>HtmlAdaptor</web-resource-name>
<description>An example security config that only allows
users with the role JBossAdmin to access the
HTML JMX console web application
</description>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>JBossAdmin</role-name>
</auth-constraint>
</security-constraint>

8. Restart JBOSS.

Read More

Sharing Keyboard and Mouse without KVM Switch using Synergy

Synergy is an open source platform independent application which allows you to control two system using the same Keyboard and Mouse without using a KVM Switch and help the organization save few dollars
Latest release of Synergy supports almost all Windows Platforms and Unix platforms with X Windows Version 11 revision 4 or up. Synergy uses the network to share keyboard and mouse hence, all the systems must support TCP/IP Networking .
Synergy is open source and released under the GNU Public License (GPL).
Setting up Synergy on Linux

1.  Download and install Synergy Software from http://sourceforge.net/projects/synergy2/files/
2.  Identify one system as server system and other would be the client.  I always prefer using a unix machine as server.
3.  In this example, I am going to use one Linux System and one Windows System to configure synergy. On the linux system, create /etc/synergy.conf file with the following information.

[root@linuxhost ~]# cat /etc/synergy.conf
# define the hosts
section: screens
linuxhost:
windowshost:
end
# define links i.e. which host is @ which side
section: links
linuxhost:
right=windowshost
windowshost:
left=linuxhost
end
[root@linuxhost ~]#

There are two sections in the configuration file.
Screens: This section defines the hosts or systems on which you want to share keyboard and mouse.  The dns must be configured or else an entry has to be made in the hosts file before using the host names in /etc/synergy.conf file.
Links: This section defines which host is on which side i.e. in the above example windows host machine is @ the right side of linux machine, so if you move the mouse pointer to the right side on linux machine, the pointer should go to Windows Machine and vice versa.
4.  Execute the following command to start Synergy as Server on Linux Machine.  You should see a message in /var/log/messages files that the synergy server is started.

[root@linuxhost ~]# synergys
[root@linuxhost ~]# tail -1 /var/log/messages
Mar 31 12:35:54 linuxhost Synergy 1.3.1: NOTE: synergys.cpp,500: started server
[root@linuxhost ~]#

5.  To make sure synergy starts at system boot time, add “synergys ” to /etc/rc.local file.
6.  Now open synergy application on the windows system.
7.  Select “Use another computer’s shared keyboard and mouse (client) and type the linux system’s hostname in “Other Computer’s Host Name” text box.

8.  Click on “Test”.

9.  If you see a message “Connected to server”, then the configuration is successful.
10.  Close the test window and click on “Stop”.

11.  Now, click on “AutoStart”

12.  Click on “Install” under “When Computer Starts”.  You will get a dialog box saying “Installed auto-start”.  Click on “OK”.

13.  Click on “Start”.  You will get a message that synergy is successfully started.  Click on “OK”

Cheers!!

Read More

Setting up slewing NTP option in Linux

Many times while installing/configuring Oracle Cluster, DBA’s receive the following error message.

Checking NTP daemon command line for slewing option “-x”

Check: NTP daemon command line

Node Name   Slewing Option Set?

vcsnode1 no

vcsnode2 no

Result:NTP daemon slewing option check failed on some nodes PRVF-5436 : The NTP daemon running on one or more nodes lacks the slewing option “-x”Result: Clock synchronization check using Network Time Protocol(NTP) failed

To fix this error, slewing needs to be configured.
Follow the below steps to configure slewing in Linux.

• Stop ntpd daemon using the following command.

[root@vcsnode1 ~]# service ntpd stop

Shutting down ntpd:  [OK]

[root@vcsnode1 ~]#

• Edit /etc/sysconfig/ntpd file.  Usually the file looks as given below.

[root@vcsnode1 sysconfig]# cat ntpd
# Drop root to id ‘ntp:ntp’ by default.
OPTIONS=”-u ntp:ntp -p /var/run/ntpd.pid”

# Set to ‘yes’ to sync hw clock after successful ntpdate
SYNC_HWCLOCK=no
[root@vcsnode1 sysconfig]#

• Edit the file and add “-x” to  “OPTIONS=”-u ntp:ntp -p /var/run/ntpd.pid”" line befor e”-u”
• After editing the file, the contents should look like given below

[root@vcsnode1 sysconfig]# cat ntpd
# Drop root to id ‘ntp:ntp’ by default.
OPTIONS=”-x -u ntp:ntp -p /var/run/ntpd.pid”

# Set to ‘yes’ to sync hw clock after successful ntpdate
SYNC_HWCLOCK=no
[root@vcsnode1 sysconfig]#

• Start ntpd daemon using the following command

[root@VCSNode2 ~]# service ntpd start

Starting ntpd:  [OK]

[root@VCSNode2 ~]#

• Ask the DBA to install/proceed to configure Oracle Cluster

Cheers!!

Read More

Configuring Jboss Cluster using Apache JK Module:

Configuring Jboss Cluster using Apache JK Module:

Jboss clustering is used to enable application failover and load balancing.  To configure jboss cluster, you need to Jboss Application Servers with similar configuration and one apache server.  Apache can also be configured on any one of the jboss application server.

Please follow the below steps to configure a jboss cluster using Apache JK Module.

1. Install apache 2.0.x server.

2. Download and install JK module from apache.org.  If the JK module is installed, you would find a file with name mod_jk.so in /etc/httpd/modules folder provided the apache (http) server’s configuration files reside in /etc/httpd folder.

3. Load the JK module by adding below line /etc/httpd/conf/httpd.conf file (Apache Configuration File)

LoadModule jk_module modules/mod_jk.so

4. Once the module is loaded, add the following entries at the end of the /etc/httpd/conf/httpd.conf (Apache configuration file)

<IfModule mod_jk.c>

include conf/modjk.conf

</IfModule>

5. Now create modjk.conf file in /etc/httpd/conf folder with the following contents

JkLogFile logs/modjk.log

JkLogLevel info

JkWorkersFile conf/jkworkers.properties

JkMountFile conf/jkmount.properties

<Location /status/>

JkMount jkstatus

Order deny,allow

Allow from all

</Location>

  6. Once modjk configuration file is created, create the jkworkers.properties file in 

      /etc/httpd/conf/ with the following contents.

worker.list=jboss,jkstatus

# Entries for 1st node

worker.node1.type=ajp13

worker.node1.host=10.154.2.202 ## IP address of 1st node

worker.node1.port=8009

worker.node1.lbfactor=1

worker.node1.disabled=false

worker.node1.socket_timeout=10

worker.node1.connect_timeout=20000

# Entries for 2nd node

worker.node2.type=ajp13

worker.node2.host=10.154.2.186 ## IP address of 2nd node

worker.node2.port=8009

worker.node2.lbfactor=1

worker.node2.disabled=false

worker.node2.socket_timeout=10

worker.node2.connect_timeout=20000

#Load Balancer

worker.jboss.type=lb

worker.jboss.balance_workers=node1,node2

worker.jboss.sticky_session=true

worker.jboss.sticky_session_force=false

worker.jboss.method=R

worker.jboss.lock=P

worker.jkstatus.type=status

7. Now, create the jkmount.properties file in /etc/httpd/conf/ folder with the following contents

/jmx-console*=jboss

/application/* = jboss

Replace your application url in place of “/application/*” above i.e. if your application is url is  http://jbossserver:8080/myapp replace “/myapp/*” with “/aplication/*”

8. Restart httpd (apache) server.

Now, we have completed the apache configuration however the jboss configuration is still pending.   

9. Copy server/all to server/nodex.

10.Add jvm route to differentiate jboss instances by updating.  To add jvm route, locate a line which contains “<Engine name=jboss.web defaultHost=localhost>” in $JBOSS_HOME/deploy/jboss-web.deployer/server.xml file and replace it with “<Engine name=jboss.web defaulHost=localhost jvmRoute=nodex)”

11. Now, as a last step, enable JK Module in Jboss.  To enable JK Module, locate a line which contains “<attribute name=UseJK> false </attribute>” and replace it with “<attribute name=UseJKtrue </attribute>” in $JBOSS_HOME/server/nodex/deploy/jboss-web.deployer/META-INF/jboss-service.xml file

12. Repeat steps 9,10 & 11 for all the Jboss Nodes.  You need to replace nodex with the appropriate node number i.e. node1, node2 etc.

13. Restart jboss application server with new profile i.e. node1, node2 etc.

Deploying Web Applications:

You need to deploy the applications on any node in server/profile/farm folder. Replace profile with the appropriate profile i.e. node1, node2 etc based upon the node on which you are deploying your applications.  Once application is deployed on any one node in the cluster, the cluster service will copy those applications on other nodes automatically and the application would be available on all the nodes.

Accessing the Web Applications:

The application can now be accessed directly by accessing the apache http server url i.e.http://httpserver/application. Replace httpserver with domainname or ip address of http server and application with the application you configured in jkmount.properties file. The additional port number is not required to access the Web application. The JK module will automatically forward the request to specific port on JBOSS Application Server.

Read More

Recovering Linux without getting into rescue mode

In large organizations, mostly the servers would be managed remotely through the console (ilo/drac/imm). The large company's also change the root password on all servers periodically which mostly happen through scripts.  If, due to any reason, the root password is not updated on server and if the server crash due to any file system related issues, the system admin has to spent lot of time to recover the server because the system admin cannot even get into single user mode due to the fact that file system has issues and the root password is not known.   In these situations, the system admin has to boot the system with the Linux Boot CD and get into rescue mode to recover server/root password. The large organizations also mostly would not have a CD at the datacenter and the system admins are expected to use boot.iso (which comes with the linux distribution) to get into rescue mode.  Since, the iso image is connected from user desktop, mostly the server (high end) would take huge time to boot up and get into rescue mode.

However, there is an easy method to quickly recover the server in these situations.  Linux allows system admins to provide kernel parameters at boot time (grub screen). rc.sysinit script is responsible for checking the file system(s) and mounting them in the read/write mode.  If the system admin can skip the init process and get a root prompt, the kernel will not check for the file system and drop you to the # prompt.  The following steps needs to be followed to skip init from loading into the memory in the booting process.

1. Reboot the server.

2. At the Grub Prompt, press “a” to provide additional kernel parameters.

3. Add “init=/bin/bash” at the end and press “Enter”. Basically, we are just telling the kernel to load /bin/bash in place of init to skip init from loading into the memory.  The kernel would load /bin/bash in place of init and would drop you to the # Prompt. But, since rc.sysinit script is not yet executed, the root file system is mounted in read-only mode. Hence you need to mount the root file system in read/write mode before making any changes to the system configuration. 

4.  mount the root file system in read/write mode using the following command :

bash-3.1# mount -o remount,rw /

 5.Now you can do everything, which you can do from single user mode.  Update any config file, scan file systems for errors or even enable/disable services at boot time. Once you are done, type exit and hit enter to reboot the server.  You would get an error message, “Kernel panic – not syncing : Attempted to kill init !”. Ignore the error and hard reboot the server.

Cheers,

Vaibhav

Read More

RPM Package Management a Quick How To

Quick How to on Red Hat Package Manager (RPM)

How to install packages with all the dependency packages if all the packages are available at a common repository?

Ans : rpm -ivh --aid packagename.

How to check, where a particular package installed it’s configuration files.
Ans : rpm -qc packagename.

How to check the change log of the installed package.
Ans : rpm -q --changelog packagename.

How to check, where a particular package installed it’s doc files.
Ans : rpm -qd packagenme

How to check all the files installed by package?
Ans : rpm -q --filesbypkg packagename

How to check the version of files installed by a package
Ans : rpm -qi packagename

How to check the dependencies for a particular packages i.e. Required libraries packages etc.
Ans : rpm -q -R packagename.

How to upgrade the packages which are already installed on to the linux box.
Ans : rpm -F install options packagename.

What is the command to update only the rpm database.
Ans : rpm -i --justdb packagename

What is the command to check whether a particular package installation would be successful but would not actually install the package.
Ans : rpm -ivh --test packagename

How to check that a particular file belong to which package
Ans : rpm -qf filename

How to list files in a package
Ans : rpm -ql packagename

How to verify whether the files installed by package are intact or been tampered/corrupted.
Ans : rpm -qs packagename

What is the command to create a new RPM Database
Ans : rpm --initdb

What is the command to rebuild the RPM Database
Ans : rpm --rebuilddb

Cheers!!

Vaibhav

Read More