Proximetry AirSync Security Patch JBoss Incomplete Security Constraints

Size: px

Start display at page:

Download "Proximetry AirSync Security Patch JBoss Incomplete Security Constraints"

Madeline Thomas
5 years ago
Views:

1 Proximetry AirSync Security Patch JBoss Incomplete Security Constraints Version 1.0 TR2080 November 11,

2 Copyright Proximetry, Inc. ALL RIGHTS RESERVED Notice: No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording, or stored in a database or retrieval system for any purpose without the express written permission of Proximetry, Inc. Proximetry, Inc. reserves the right to make changes to this document at any time without notice and assumes no responsibility for its use. Proximetry, Inc. products and services can only be ordered under the terms and conditions of Proximetry Inc. s applicable agreements. This document contains the most current information available at the time of publication. Proximetry is a trademark of Proximetry, Inc., in the USA and other countries. Microsoft and Windows are registered trademarks of Microsoft Corporation. MySQL is a registered trademark of MySQL AB. JBoss is a trademark of Mark Fleury. Java is a trademark of Sun Microsystems, Inc. Intel and Pentium are registered trademarks of Intel Corporation. AMD is a trademark of Advanced Micro Devices, Inc. All other brand or product names are or may be trademarks or service marks of and are used to identify products or services of their respective owners. 2

3 Table of Contents PREFACE... 4 Intended Audience... 4 Product Version... 4 Document Revision Level... 4 Document Conventions... 4 JBOSS SECURITY CONSTRAINS UPDATE... 6 JBoss Incomplete Security Constraints 3

4 Preface The JBoss Application Server is a component of the AirSync system. The security settings of JBoss have significant influence on the overall security of an AirSync managed network. Recently it has come to light that the default security configuration for the version of JBoss that is delivered with AirSync is incomplete. This document provides information how to update JBoss security constraints. A full description of the problem can be found on Red Hat s web site, under following link: Intended Audience This document is intended for system administrators and/or network information technology staff who are responsible for the AirSync system s installation and maintenance.. Product Version The document corresponds to all AirSync versions from release 3.2 to 3.6. Document Revision Level Revision Date Description Version 1.0 November 2011 Initial version Document Conventions This guide uses the following typographic conventions: Convention Description Bold Italic screen/code Text on a window, other than the window title, including menus, menu options, buttons, and labels. Variable. Text displayed or entered on screen or at the command prompt. JBoss Incomplete Security Constraints 4

5 boldface screen font Information you must enter is in boldface screen font. < italic screen > Variables appear in italic screen font between angle brackets. [ ] Default responses to system prompts are in square brackets. This guide uses icons to draw your attention to certain information. Warnings are the most critical. Icon Meaning Description Note Notes call attention to important and/or additional information. Tip Tips provide helpful information, guidelines, or suggestions for performing tasks more effectively. Caution WARNING Cautions notify the user of adverse conditions and/or consequences (e.g., disruptive operations). Warnings notify the user of severe conditions and/or consequences (e.g., destructive operations). JBoss Incomplete Security Constraints 5

6 JBoss Security Constraints Update WARNING Caution Updating JBoss Application Server security constrains is highly recommended. Instructions provided in this document assume that AirSync server is installed using default installation options in /home/airsync directory. In other case all instructions have to be adjusted to existing installation. The JBoss security constraints configuration is located in the following configuration file: /home/airsync/services/jboss/server/default/deploy/jmx-console.war/web- INF/web.xml To update JBoss complete the following steps: 1. Stop AirSync services: /etc/init.d/airsync stop 2. Open the web.xml configuration file using a text editor 3. Find the following fragment: <security-constraint> <web-resource-collection> <web-resource-name>htmladaptor</web-resource-name> <description>an example security config that only allows users with the role JBossAdmin to access the HTML JMX console web application </description> <url-pattern>/*</url-pattern> <http-method>get</http-method> <http-method>post</http-method> </web-resource-collection> <auth-constraint> <role-name>jbossadmin</role-name> </auth-constraint> </security-constraint> 4. Remove following lines: JBoss Incomplete Security Constraints 6

7 <http-method>get</http-method> <http-method>post</http-method> 5. Save the updated web.xml configuration file 6. Restart AirSync services: /etc/init.d/airsync start JBoss Incomplete Security Constraints 7

8 Proximetry, Inc. Corporate Headquarters 909 West Laurel Street, Suite 200 San Diego, CA U.S.A Phone: JBoss Incomplete Security Constraints 8