How to secure JBoss's home page ?

[plaugraud]

Hello everybody,

I'm quite new in working with JBoss, but for a short time I deployed successfully JBoss 4.0.2 and an application (CRM).
Now I opened access from outside of the LAN for testing and everybody can have access to the root page (http://mydomain:8080/) with its Tomcat status, JMX Console and JBoss Web Console.

How can I prevent them to access this page ?

Thx, Rudolf.

[poyge394]

JMX console and Web console are deployed on jboss like a ordinary application, so you just nead to set a ordinary Authentication and Authorization controll, this is already provided, you nead just uncomment.
jmxconsole:
\deploy\jmx-console.war\WEB-INF\jboss-web.xml
webconsole: \deploy\management\console-mgr.sar\web-console.war\WEB-INF \jboss-web.xm

/ Poyan

[plaugraud]

Thank you very much, Poyan.

In the mean time I've achieved successfully to setup the security for JMX and JBoss web console.
In the web.xml, there should be also uncommented the <security-constraint>.
Also important is to change the password in the ..-user.properties, which is by default 'admin'.

Regards, Rudolf

[scphantm]

what about the tomcat status pages, how do i dissable them?