Simple way to lock up your JBoss AS instance

JBoss AS is distributed by default as not secured (locked up).

If you want to work with locked up version you can try this easy way.


  1. Download Groovy script (source code at
  2. Install Groovy:
    -- use
    -- use your OS favourite method: Fedora: yum install groovy
  3. run: groovy securejboss.groovy <JBOSS SERVER HOME>
    You can specify more then one JBoss Server Home directories. In that case common/deploy content will generate warning because it already is secured.
  4. check output for possible problems (pay special attention to warnings)


Note: Always test your installation if it is secured properly.


The script currently supports JBoss AS 6.1.0.Final and 6.0.0.Final. Check later for JBoss AS 5 and 5.1 support.


Example on Fedora:


1. wget

2. unzip -q ~/Downloads/ (already downloaded in $HOME/Downloads directory)

3. sudo yum install groovy

4. groovy securejboss.groovy jboss-6.1.0.Final/server/default/

Output example:

Working on ServerHome=jboss-6.1.0.Final/server/default/

JBoss AS Version: 6.1.0.Final

securing JBoss Security Domain: jmx-console


securing jmx-console.war


securing HttpInvoker


securing JBoss Security Domain: JBossWS


securing jbossws-console.war


securing JMXConnector


securing JBoss Security Domain: hornetq