Securing the connection between slave host controller and master host controller

[karink]

Hi everybody

This question is related to this documentation https://docs.jboss.org/author/display/AS7/Securing+the+Management+Interfaces (JBoss 7.1.1 final)

Here a snippet from this documentation

<management>

      <security-realms>

         <security-realm name="TestRealm">

            <server-identities>

               <secret value="c2xhdmVfcGFzc3dvcmQ=" />

            </server-identities>

         </security-realm>

       </security-realms>

       ...

    </management>

    <domain-controller>

       <remote host="127.0.0.1" port="9999" security-realm="TestRealm" />

    </domain-controller>

....

The value specified for the secret is the password encoded using Base64. On attempting to connect to the remote domain controller the Base64 password will be decoded and the connection will authenticate using the name of the host (in this example 'slave') and the password obtained from the secret.  The master domain controller will also need to be configured with a realm that contains the user 'slave' with the specified password.

As far as I understood it would be possible to use a VAULT expression to encrypt the secret value in the host.xml file. I don't understand how the transport (from the slave host controller to the master host controller) of this secret will look like (is it plain or encrypted)?

Thanks for your help

Regards
Karin

[ctomc]

Hi,

you can just use vault expression in place of secret value.

some thing along this lines:

<secret value="${VAULT::keystore_pass::password::NmZiYmRmOGQtMTYzZS00MjE3LTllODMtZjI4OGM2NGJmODM4TElORV9CUkVBS3ZhdWx0}" />

for more info:

https://community.jboss.org/wiki/JBossAS7SecuringPasswords

https://community.jboss.org/wiki/AS7UtilisingMaskedPasswordsViaTheVault

--

tomaz

[karink]

Hi Tomaz

thanks for your answer. I already know the Vault feature for storing/securing the password on the file system in a secure way.

Although, my question was not how to store it securely on the file system, but how the password will be transmitted from slave to master host controller on the network.

I don't understand that? Is it done just plain or DIGEST or something else

Regards
Karin

[dlofthouse]

It is the server side of the configuration that decides if the password will be transmitted using Digest or Plain - in general our default preference is to always use Digest authentication but we fall back to Plain when the server side of the configuration does not supply the information needed for Digest.

Server side in order to use Digest we need to be able to access either the plain text password for the user or we need to access a pre prepared hash of their username and password with the realm - for configurations that can't supply either of these we then fall back to the Plain mechanism.  In practice this means that we use Digest when the properties file is used but fall back to Plain when either Ldap or Jaas are used for the verification.

This week I am starting work on the following task to make it possible to plug in different stores so we don't need to rely on the JAAS integration that makes us fall back to Plain: -

  https://issues.jboss.org/browse/AS7-4194

There are a couple of slightly higher priority tasks I need to look at sooner but will also review for LDAP based authentication how we can implement a pass through digest mechanism against LDAP to again eliminate the plain text passwords: -

  https://issues.jboss.org/browse/AS7-4195

[karink]

ok, cool.

thanks