We support SSL cert-based authentication of Agent-to-Server and Server-to-Agent communications [1]. Plugins are distributed from Server to Agents via these securable communication channels, so wouldn't setting that up be sufficient to validate Agents are not getting untrusted plugins?

Note, PluginUpdate.updatePlugins() in the Agent is where we pull down the latest set of plugin jars from the Server. We then only deploy exactly that set of plugin jars. Any other plugin jars the happen to be in the Agent plugins dir are rejected.

[1] http://rhq-project.org/display/JOPR2/Securing+Communications

On 03/01/2012 09:58 AM, Costel Cosman wrote:
Hi,

About the proposal to have a "read-only", monitoring agent (See RFC:
https://bugzilla.redhat.com/show_bug.cgi?id=783911), I added a comment 
with an additional idea:

===========================================================================
It seems a good idea to have a "read-only" agent.

The proposed solution (to disable the "write" features like Configuration and
Provisioning and leave only "read" features like Monitoring) still has an
issue: malicious code can be embedded in the monitoring part of the plugins. 

An idea would be to sign the plugin JAR. The agent will check the signature
every time a plugin update is performed. The signature will guarantee that the
plugins come only from a trusted
 source.
============================================================================

What do you think about this idea ?

Regards,
Costel


_______________________________________________
rhq-devel mailing list
rhq-devel@lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/rhq-devel


-- 
Ian Springer
Principal Software Developer
JBoss Operations Network
Red Hat
ian.springer@redhat.com