"Read-only", monitoring agent

Costel Cosman mulderika at yahoo.com
Thu Mar 1 15:59:45 UTC 2012


I know that maybe is exaggerated, but what if an attacker finds out the password of the rhqadmin or any other user that has rights to upload plugins ?
In that case SSL security doesn't help as long the attacker can upload any plugin.






________________________________
 From: John Mazzitelli <jmazzite at redhat.com>
To: rhq-devel at lists.fedorahosted.org 
Sent: Thursday, March 1, 2012 5:52 PM
Subject: Re: "Read-only",  monitoring agent
 
that's a good point - for those more security minded users, we do
support full SSL secured comm between agent and server. Thanks for
pointing that out.

On Thu, 2012-03-01 at 10:36 -0500, Ian Springer wrote:
> We support SSL cert-based authentication of Agent-to-Server and
> Server-to-Agent communications [1]. Plugins are distributed from
> Server to Agents via these securable communication channels, so
> wouldn't setting that up be sufficient to validate Agents are not
> getting untrusted plugins?
> 
> Note, PluginUpdate.updatePlugins() in the Agent is where we pull down
> the latest set of plugin jars from the Server. We then only deploy
> exactly that set of plugin jars. Any other plugin jars the happen to
> be in the Agent plugins dir are rejected.
> 
> [1] http://rhq-project.org/display/JOPR2/Securing+Communications
> 
> On 03/01/2012 09:58 AM, Costel Cosman wrote: 
> > Hi,
> > 
> > About the proposal to have a "read-only", monitoring agent (See RFC:
> > https://bugzilla.redhat.com/show_bug.cgi?id=783911), I added a comment 
> > with an additional idea:
> > 
> > ===========================================================================
> > It seems a good idea to have a "read-only" agent.
> > 
> > The proposed solution (to disable the "write" features like Configuration and
> > Provisioning and leave only "read" features like Monitoring) still has an
> > issue: malicious code can be embedded in the monitoring part of the plugins. 
> > 
> > An idea would be to sign the plugin JAR. The agent will check the signature
> > every time a plugin update is performed. The signature will guarantee that the
> > plugins come only from a trusted
> >  source.
> > ============================================================================
> > 
> > What do you think about this idea ?
> > 
> > Regards,
> > Costel
> > 
> > 
> > _______________________________________________
> > rhq-devel mailing list
> > rhq-devel at lists.fedorahosted.org
> > https://fedorahosted.org/mailman/listinfo/rhq-devel
> 
> 
> -- 
> Ian Springer
> Principal Software Developer
> JBoss Operations Network
> Red Hat
> ian.springer at redhat.com
> _______________________________________________
> rhq-devel mailing list
> rhq-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/rhq-devel


_______________________________________________
rhq-devel mailing list
rhq-devel at lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/rhq-devel
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/rhq-devel/attachments/20120301/b85538fd/attachment-0001.html>


More information about the rhq-devel mailing list