twiddle doesn't support password parameter

[newbi]

Hello,

We have an application deployed on JbossAS4.0.1sp1. In spite of the fact that jmx-console is secured by password, twiddle tool can still access the server without password.

Is this a security hole of this version of jboss? It seems that since jboss 4.0.2 twiddle tool supports password parameter.

Our problem is that we cannot plan a migration to 4.0.2 and this issue is critical.

thanks

newbi

[newbi]

We've activated the jmx-invoker authentication which also forces twiddle authentication.

But we've got another problem - the shutdown also asks for authentication and for 4.0.1 shutdown doesn't support password parameter (another bug of 4.0.1).

any workaround?

tks

newbi

[dimitris]

It's not bug, it's a feature. You should be able to shutdown the server through twiddle as well. Look on the avaiable operations of the jboss.system:type=Server mbean, if I recall.