I know that maybe is exaggerated, but what if an attacker finds out the password of the rhqadmin or any other user that has rights to upload plugins ?
In that case SSL security doesn't help as long the attacker can upload any plugin.





From: John Mazzitelli <jmazzite@redhat.com>
To: rhq-devel@lists.fedorahosted.org
Sent: Thursday, March 1, 2012 5:52 PM
Subject: Re: "Read-only", monitoring agent

that's a good point - for those more security minded users, we do
support full SSL secured comm between agent and server. Thanks for
pointing that out.

On Thu, 2012-03-01 at 10:36 -0500, Ian Springer wrote:
> We support SSL cert-based authentication of Agent-to-Server and
> Server-to-Agent communications [1]. Plugins are distributed from
> Server to Agents via these securable communication channels, so
> wouldn't setting that up be sufficient to validate Agents are not
> getting untrusted plugins?
>
> Note, PluginUpdate.updatePlugins() in the Agent is where we pull down
> the latest set of plugin jars from the Server. We then only deploy
> exactly that set of plugin jars. Any other plugin jars the happen to
> be in the Agent plugins dir are rejected.
>
> [1] http://rhq-project.org/display/JOPR2/Securing+Communications
>
> On 03/01/2012 09:58 AM, Costel Cosman wrote:
> > Hi,
> >
> > About the proposal to have a "read-only", monitoring agent (See RFC:
> > https://bugzilla.redhat.com/show_bug.cgi?id=783911), I added a comment
> > with an additional idea:
> >
> > ===========================================================================
> > It seems a good idea to have a "read-only" agent.
> >
> > The proposed solution (to disable the "write" features like Configuration and
> > Provisioning and leave only "read" features like Monitoring) still has an
> > issue: malicious code can be embedded in the monitoring part of the plugins.
> >
> > An idea would be to sign the plugin JAR. The agent will check the signature
> > every time a plugin update is performed. The signature will guarantee that the
> > plugins come only from a trusted
> >  source.
> > ============================================================================
> >
> > What do you think about this idea ?
> >
> > Regards,
> > Costel
> >
> >
> > _______________________________________________
> > rhq-devel mailing list
> > rhq-devel@lists.fedorahosted.org
> > https://fedorahosted.org/mailman/listinfo/rhq-devel
>
>
> --
> Ian Springer
> Principal Software Developer
> JBoss Operations Network
> Red Hat
> ian.springer@redhat.com
> _______________________________________________
> rhq-devel mailing list
> rhq-devel@lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/rhq-devel


_______________________________________________
rhq-devel mailing list
rhq-devel@lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/rhq-devel