[AMQ-1164] ManagementContext opens insecure server

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: 4.1.0
• Fix Version/s: NEEDS_REVIEW
• Component/s: JMX
• Assignee: Unassigned
• Reporter: Christopher G. Stach II
• Created: 19/Feb/07 19:30
• Updated: 17/Feb/12 20:42
• Resolved: 17/Feb/12 20:42

Description

The use case is setting up an RMI server on a fixed port (using <amq:managementContext rmiServerPort="xxx">) in order to pass through a firewall. This RMI server doesn't honor the com.sun.mangement.password.file et al environment variables. Simply guessing the hostname and port (and the default port being a well known port, meaning "no guesswork at all") is enough to take full control of AMQ.

Further, but somewhat unrelated, if one sets up a password protected Tiger JMX MBean server, AMQ can't configure it, giving a read only error message.