AS7 Plugin - Secure Connections to Server

Stefan Negrea snegrea at redhat.com
Wed Aug 1 16:28:59 UTC 2012



----- Original Message -----
> From: "Lukas Krejci" <lkrejci at redhat.com>
> To: rhq-devel at lists.fedorahosted.org
> Sent: Wednesday, August 1, 2012 11:21:13 AM
> Subject: Re: AS7 Plugin - Secure Connections to Server
> 
> On Wednesday, August 01, 2012 12:16:10 Stefan Negrea wrote:
> > ----- Original Message -----
> > 
> > > From: "Lukas Krejci" <lkrejci at redhat.com>
> > > To: rhq-devel at lists.fedorahosted.org
> > > Sent: Wednesday, August 1, 2012 11:04:15 AM
> > > Subject: Re: AS7 Plugin - Secure Connections to Server
> > > 
> > > On Wednesday, August 01, 2012 11:36:23 Stefan Negrea wrote:
> > > 
> > > <snip>
> > > 
> > > > For self-signed certificates, Firefox and
> > > > Chrome display a big red page with a big warning asking the
> > > > user
> > > > whether to
> > > > proceed or not (and even give the option to permanently accept
> > > > the
> > > > certificate). But by default JVM will just reject self-signed
> > > > certificates
> > > > unless the users does some JVM pre-configuration.
> > > 
> > > I believe John Sanda solved this on per connection basis in the
> > > Apache plugin:
> > > 
> > > http://git.fedorahosted.org/git?p=rhq/rhq.git;a=blob;f=modules/plugins/apa
> > > che/src/main/java/org/rhq/plugins/www/util/WWWUtils.java;h=ab4cc571384c58c
> > > 9b96cb4be788d7a9b76f811e7;hb=master#l229
> > > 
> > > Lukas
> > 
> > That implementation is exactly the fourth option from my proposal
> > and the
> > one that I would like to avoid as much as possible because it
> > carries the
> > most risk for the user.
> > 
> 
> Yes, I was more referring to the fact that you claimed this required
> some JVM
> preconfiguration.


Just to clarify, no JVM pre-configuration is required for this. However, if implemented then I would make this configurable at resource level and turned off by default. This will give users the option to enable it for desired servers. 


> 
> I agree it is the least safe option in AS7. We use it in Apache,
> because the
> HTTPS URLs are only ever used for pinging the server to determine
> availability, no other info is fetched from or delivered to that
> location.
> 
> > 
> > "4) Provide an option in the plugin to allow users to accept
> > self-signed
> > certificates. Like the HTTPS option, this will be a boolean option
> > to allow
> > any certificate that defaults to false. The code above will need to
> > change
> > to use a temporary keystore created on demand to store these
> > self-signed
> > certificates at run-time. This approach is NOT recommended due to
> > exposure
> > to man-in-the-middle attacks."
> > > _______________________________________________
> > > rhq-devel mailing list
> > > rhq-devel at lists.fedorahosted.org
> > > https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
> > 
> > _______________________________________________
> > rhq-devel mailing list
> > rhq-devel at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
> _______________________________________________
> rhq-devel mailing list
> rhq-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
> 


More information about the rhq-devel mailing list