6 Replies Latest reply on Jan 7, 2008 3:09 PM by mark33

    Securing Jboss - Class Loading in jboss-service.xml

    wiley173

      Hello,

      I'm using jboss-3.2.6 ~
      I commented out the portion for class loading to tighten up the security of the server in the /server/default/conf/jboss-service.xml - I don't need this service ...


       <!--
       <mbean code="org.jboss.web.WebService"
       name="jboss:service=WebService">
       <attribute name="Port">8083</attribute> -->
       <!-- Should resources and non-EJB classes be downloadable -->
       <!-- <attribute name="DownloadServerClasses">true</attribute>
       <attribute name="Host">${jboss.bind.address}</attribute>
       <attribute name="BindAddress">${jboss.bind.address}</attribute>
       </mbean>
       -->
      


      My question is how can I stop this from being called when I start the server to avoid these errors ...

      
      
      MBeans waiting for other MBeans:
      ObjectName: jboss.ejb:service=EJBDeployer
       state: CONFIGURED
       I Depend On: jboss:service=TransactionManager
       jboss:service=WebService
      
       Depends On Me:
      
      MBEANS THAT ARE THE ROOT CAUSE OF THE PROBLEM:
      ObjectName: jboss:service=WebService
       state: NOTYETINSTALLED
       I Depend On:
       Depends On Me: jboss.ejb:service=EJBDeployer
      
      
      12:35:30,078 ERROR [Server] (main) Root deployment has missing dependencies; continuing
      Incomplete Deployment listing:
      Packages waiting for a deployer:
      org.jboss.deployment.DeploymentInfo@18500576 { url=file:/C:/jboss-3.2.6/server/default/tmp/deploy/tmp35941FiboApp.ear-contents/FiboEJB.jar }
       deployer: null
       status: Starting
       state: START_SUBDEPLOYMENTS
       watch: file:/C:/jboss-3.2.6/server/default/tmp/deploy/tmp35941FiboApp.ear-contents/FiboEJB.jar
       lastDeployed: 1129664128781
       lastModified: 1129664128765
       mbeans:
      
      MBeans waiting for other MBeans:
      ObjectName: jboss.ejb:service=EJBDeployer
       state: CONFIGURED
       I Depend On: jboss:service=TransactionManager
       jboss:service=WebService
      
       Depends On Me:
      
      MBEANS THAT ARE THE ROOT CAUSE OF THE PROBLEM:
      ObjectName: jboss:service=WebService
       state: NOTYETINSTALLED
       I Depend On:
       Depends On Me: jboss.ejb:service=EJBDeployer
      
      
       at org.jboss.deployment.MainDeployer.checkIncompleteDeployments(MainDeployer.java:1155)
       at org.jboss.deployment.MainDeployer.deploy(MainDeployer.java:607)
       at org.jboss.deployment.MainDeployer.deploy(MainDeployer.java:588)
       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
       at java.lang.reflect.Method.invoke(Method.java:585)
       at org.jboss.mx.server.ReflectedDispatcher.dispatch(ReflectedDispatcher.java:60)
       at org.jboss.mx.server.Invocation.dispatch(Invocation.java:62)
       at org.jboss.mx.server.Invocation.dispatch(Invocation.java:54)
       at org.jboss.mx.server.Invocation.invoke(Invocation.java:82)
       at org.jboss.mx.server.AbstractMBeanInvoker.invoke(AbstractMBeanInvoker.java:197)
       at org.jboss.mx.server.MBeanServerImpl.invoke(MBeanServerImpl.java:473)
       at org.jboss.mx.util.MBeanProxyExt.invoke(MBeanProxyExt.java:176)
       at $Proxy5.deploy(Unknown Source)
       at org.jboss.system.server.ServerImpl.doStart(ServerImpl.java:407)
       at org.jboss.system.server.ServerImpl.start(ServerImpl.java:311)
       at org.jboss.Main.boot(Main.java:145)
       at org.jboss.Main$1.run(Main.java:399)
       at java.lang.Thread.run(Thread.java:595)
      


      thank you


        • 1. Re: Securing Jboss - Class Loading in jboss-service.xml
          wiley173

          I got rid of the Fibo.ear to stop any confusion in my question ....

          this is the error with nothing deployed ...

          12:43:10,953 ERROR [URLDeploymentScanner] (main) Incomplete Deployment listing:
          MBeans waiting for other MBeans:
          ObjectName: jboss.ejb:service=EJBDeployer
           state: CONFIGURED
           I Depend On: jboss:service=TransactionManager
           jboss:service=WebService
          
           Depends On Me:
          
          MBEANS THAT ARE THE ROOT CAUSE OF THE PROBLEM:
          ObjectName: jboss:service=WebService
           state: NOTYETINSTALLED
           I Depend On:
           Depends On Me: jboss.ejb:service=EJBDeployer
          
          
          12:43:11,390 ERROR [Server] (main) Root deployment has missing dependencies; continuing
          Incomplete Deployment listing:
          MBeans waiting for other MBeans:
          ObjectName: jboss.ejb:service=EJBDeployer
           state: CONFIGURED
           I Depend On: jboss:service=TransactionManager
           jboss:service=WebService
          
           Depends On Me:
          
          MBEANS THAT ARE THE ROOT CAUSE OF THE PROBLEM:
          ObjectName: jboss:service=WebService
           state: NOTYETINSTALLED
           I Depend On:
           Depends On Me: jboss.ejb:service=EJBDeployer
          
          
           at org.jboss.deployment.MainDeployer.checkIncompleteDeployments(MainDeployer.java:1155)
           at org.jboss.deployment.MainDeployer.deploy(MainDeployer.java:607)
           at org.jboss.deployment.MainDeployer.deploy(MainDeployer.java:588)
           at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
           at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
           at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
           at java.lang.reflect.Method.invoke(Method.java:585)
           at org.jboss.mx.server.ReflectedDispatcher.dispatch(ReflectedDispatcher.java:60)
           at org.jboss.mx.server.Invocation.dispatch(Invocation.java:62)
           at org.jboss.mx.server.Invocation.dispatch(Invocation.java:54)
           at org.jboss.mx.server.Invocation.invoke(Invocation.java:82)
           at org.jboss.mx.server.AbstractMBeanInvoker.invoke(AbstractMBeanInvoker.java:197)
           at org.jboss.mx.server.MBeanServerImpl.invoke(MBeanServerImpl.java:473)
           at org.jboss.mx.util.MBeanProxyExt.invoke(MBeanProxyExt.java:176)
           at $Proxy5.deploy(Unknown Source)
           at org.jboss.system.server.ServerImpl.doStart(ServerImpl.java:407)
           at org.jboss.system.server.ServerImpl.start(ServerImpl.java:311)
           at org.jboss.Main.boot(Main.java:145)
           at org.jboss.Main$1.run(Main.java:399)
           at java.lang.Thread.run(Thread.java:595)
          


          • 2. Developer Notebook Orielly
            wiley173

            Okay, dumb Idea. As soon as you disable the class download service or ejb deployer your ejb's stop working.

            page 143 Chapter 9:

            so how do I stop external clients from accessing http://:8083/login-config.xml or worse yet http::8083/props/jmx-console-users.properties

            without disabling the correct deployment of EJB's ...
            ==================================
            okay so I just set DownloadServerClasses to false as suggested ...
            solved the problem - I see the light

            thank you and good night.

            • 3. Re: Securing Jboss - Class Loading in jboss-service.xml

              I could be mistaken, but I don't think the EJBDeployer actually has a real runtime dependence on jboss:service=WebService. Remove the depends tag on EJBDeployer in jboss-service.xml and you should be fine.

              • 4. Re: Securing Jboss - Class Loading in jboss-service.xml
                wiley173

                You are correct of course ... and thanks for the book and the response. That worked beautifully and I was able to comment out the entire class loader and still deploy my ejb. I removed the dependency as you suggested. Still learning ....

                thanks again !

                • 5. Re: Securing Jboss - Class Loading in jboss-service.xml
                  wiley173

                  by the way I didn't mean you had a dumb idea I just thought I screwed up something again .......

                  -adios

                  • 6. Re: Securing Jboss - Class Loading in jboss-service.xml
                    mark33

                     

                    "norman.richards@jboss.com" wrote:
                    I could be mistaken, but I don't think the EJBDeployer actually has a real runtime dependence on jboss:service=WebService. Remove the depends tag on EJBDeployer in jboss-service.xml and you should be fine.


                    here is the line in my jboss-service.xml

                    jboss.ejb:service=EJBDeployer

                    I wonder where do I remove the depends here if you can kindly point out to me.

                    thanks