[
https://issues.apache.org/jira/browse/GERONIMO-4896?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12787403#action_12787403
]
Ashish Jain commented on GERONIMO-4896:
---------------------------------------
This can be achieved by creating a new java agent which will take care of
setting the properties before the main class for the deployer is invoked.
The implementation can be provided in anyway as suggested by the community. As
of now I have written a hello world implementation where I
have hardcoded all the values. Please advice if this seems to be a viable
option and what implementation is acceptable??
Just uploading the agent class for reference.
> Commands to a Secure JMX Connector require the SSL keyStorePassword to be
> specified on command line
> ---------------------------------------------------------------------------------------------------
>
> Key: GERONIMO-4896
> URL: https://issues.apache.org/jira/browse/GERONIMO-4896
> Project: Geronimo
> Issue Type: Bug
> Security Level: public(Regular issues)
> Affects Versions: 2.1.5, 2.2, 3.0
> Reporter: Kevan Miller
> Fix For: 2.1.5, 3.0, Wish List
>
>
> To my knowledge, it is not possible to run a Geronimo command (e.g. deploy.sh
> deploy or gsh geronimo/stop-server) to a server with a secure JMX Connector
> (running SSL, without specifying the following Java system properties on the
> command line:
> javax.net.ssl.keyStore and javax.net.ssl.keyStorePassword
> For example:
> {code}
> export GERONIMO_HOME=~/target/geronimo-jetty6-javaee5-2.2-SNAPSHOT
> export
> JAVA_OPTS="-Djavax.net.ssl.keyStore=$GERONIMO_HOME/var/security/keystores/geronimo-default
> -Djavax.net.ssl.keyStorePassword=secret
> -Djavax.net.ssl.trustStore=$GERONIMO_HOME/var/security/keystores/geronimo-default
> -Djavax.net.ssl.trustStorePassword=secret"
> $GERONIMO_HOME/bin/deploy.sh -u system -p manager --secure list-modules
> --stopped
> {code}
> javax.net.ssl.keyStorePassword causes a problem, since this means the
> keyStorePassword is available, in-the-clear, to someone inspecting executing
> processes. For example while a deploy command was active, someone could run
> 'ps auxww | grep deployer.jar' and discover the keyStorePassword for the
> KeyStore.
> Geronimo should provide a mechanism, whereby users can specify the
> keyStorePassword without making that secret available to anyone inspecting
> processes running on the current system. Ideally, the password could be
> encrypted/obfuscated within a file (just as passwords can be
> encrypted/obfuscated in var/config/config.xml).
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
