jbossAS 4.0.1sp1 twiddle doesn't support password parameter

[newbi]

Hello,

it seems that under jbossAS 4.0.1sp1 twiddle tool doesn't support password parameter, which could be a security weakness.

Any available workaround?

thanks

newbi

[peterj]

Actually, I think that would make it more secure because if you secure the JMX invoker service on the server, then you will not be able to use twiddle at all. ;-)

I don't know if this would work, but you could try using the twiddle.jar, twiddle.bat and twiddle.sh from the 4.0.5 release with 4.0.1.

[peterj]

Or you could modify twiddle to support username and password parameters. If I were to do this, I would compare the 4.0.5 source with the 4.0.1 source, make the appropriate changes to 4.0.1 and build it. The source for twiddle is at console/src/main/org/jboss/console/twiddle.

[newbi]

We cannot modify twiddle to support password. We have about 6000 potential users.

newbi

[newbi]

It seems that secure the jmx-console (jmx invoker) is not enough to secure twiddle tool.

We have activated the authentication of jmx-console in the jmx-invoker-service.xml file, but we still use twiddle without password.

newbi

[newbi]

Since JbossAS 4.0.2 twiddle tool supports login/password.

newbi

[newbi]

In fact secure jmx-console allows to secure twiddle tool also but there is an unwished impact in jbossAS4.0.1:

shutdown doesn't work anymore (the bug was fixed for jbossAS4.0.2)

tks

newbi