activemq专栏之jmx代理不安全？

root 601 32282 0 16:48 pts/1 00:00:00 grep java

root 5325 5323 1 Jul14 ? 00:46:03 /usr/java/jdk/bin/java -Djava.util.logging.config.file=/app/usr/local/tomcat7-sec/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Xms1024m -Xmx4096m -Xss1024K -XX:PermSize=512m -XX:MaxPermSize=2048m -Djava.endorsed.dirs=/app/usr/local/tomcat7-sec/endorsed -classpath /app/usr/local/tomcat7-sec/bin/bootstrap.jar:/app/usr/local/tomcat7-sec/bin/tomcat-juli.jar -Dcatalina.base=/app/usr/local/tomcat7-sec -Dcatalina.home=/app/usr/local/tomcat7-sec -Djava.io.tmpdir=/app/usr/local/tomcat7-sec/temp org.apache.catalina.startup.Bootstrap start

2、查找对应的配置项

查找该进程中配置有1099端口的文件

[root@iZ1adui04qZ webapps]# grep -rl “1099” ./

./activemq-web-console-5.14.3/WEB-INF/classes/org/apache/activemq/web/config/OsgiConfiguration.class

./activemq-web-console-5.14.3/META-INF/maven/org.apache.activemq/activemq-web-console/pom.xml

至此，1099端口占用的位置就清楚了，是一个旧版本的activeMq的console是启用的。

接下来我们看看这两个文件里究竟有什么东东，以及这两个文件的功能分别是什么？

OsgiConfiguration.class

package org.apache.activemq.web.config;

import java.util.Collection;

import java.util.Dictionary;

import java.util.Hashtable;

import javax.jms.ConnectionFactory;

import javax.management.remote.JMXServiceURL;

import org.osgi.framework.Bundle;

import org.osgi.framework.BundleContext;

import org.osgi.framework.FrameworkUtil;

import org.osgi.framework.ServiceRegistration;

import org.osgi.service.cm.ConfigurationException;

import org.osgi.service.cm.ManagedService;

public class OsgiConfiguration

extends AbstractConfiguration

implements ManagedService

{

private ServiceRegistration service;

private String jmxUrl = “service:jmx:rmi:///jndi/rmi://localhost:1099/karaf-root”;

private String jmxUser = “karaf”;

private String jmxPassword = “karaf”;

private String jmsUrl = “tcp://localhost:61616”;

private String jmsUser = “karaf”;

private String jmsPassword = “karaf”;

public OsgiConfiguration()

{

BundleContext context = FrameworkUtil.getBundle(getClass()).getBundleContext();

Dictionary<String, String> properties = new Hashtable();

properties.put(“service.pid”, “org.apache.activemq.webconsole”);

this.service = context.registerService(ManagedService.class.getName(), this, properties);

}

public String getJmxPassword()

{

return this.jmxPassword;

}

public Collection getJmxUrls()

{

return makeJmxUrls(this.jmxUrl);

}

public String getJmxUser()

{

return this.jmxUser;

}

public ConnectionFactory getConnectionFactory()

{

return makeConnectionFactory(this.jmsUrl, this.jmsUser, this.jmsPassword);

}

public void updated(Dictionary dictionary)

throws ConfigurationException

{

if (dictionary != null)

{

this.jmxUrl = ((String)dictionary.get(“webconsole.jmx.url”));

if (this.jmxUrl == null) {

throw new IllegalArgumentException(“A JMS-url must be specified (system property webconsole.jmx.url”);

}

this.jmxUser = ((String)dictionary.get(“webconsole.jmx.user”));

this.jmxPassword = ((String)dictionary.get(“webconsole.jmx.password”));

this.jmsUrl = ((String)dictionary.get(“webconsole.jms.url”));

this.jmsUser = ((String)dictionary.get(“webconsole.jms.user”));

this.jmsPassword = ((String)dictionary.get(“webconsole.jms.password”));

}

}

}

以下内容出现在META-INF/maven/org.apache.activemq/activemq-web-console/pom.xml中，应该是编译时的默认配置信息：

com.sun.management.jmxremote

给大家的福利

零基础入门

对于从来没有接触过网络安全的同学，我们帮你准备了详细的学习成长路线图。可以说是最科学最系统的学习路线，大家跟着这个大的方向学习准没问题。

同时每个成长路线对应的板块都有配套的视频提供：

因篇幅有限，仅展示部分资料
加入社区》https://bbs.csdn.net/forums/4304bb5a486d4c3ab8389e65ecb71ac0