4.9 Install Changes

Jay Shaughnessy jshaughn at redhat.com
Mon Sep 9 17:01:48 UTC 2013


As of this morning (commit c424425a6d97ee31c7ddba165b2c58656b13cf9a) 
there is now a facility to generate the obfuscated management user 
password to be set in rhq-server.properties.  It is the exact same 
mechanism used to generate the DB or Storage node obfuscated passwords:

Run rhq-installer.sh with the --encodepassword option. This will output 
the property values to be set in rhq-server.properties, given the 
password provided on the commandline.  For example:

 > rhq-installer.sh|bat --encodepassword sample

*** Encoded password properties for rhq-server.properties:
*** rhq.server.database.password=-e823e068e392e44
*** rhq.storage.password=-e823e068e392e44
*** rhq.server.management.password=7863706f1c52d283c01a46fb21111357

To use the same password for everything just run the utility one time.  
Run it multiple times for different passwords, using only the relevant 
outputted property.


On 9/6/2013 5:07 PM, Jay Shaughnessy wrote:
>
> Devels,
>
> There is a recent commit that applies some security-related changes 
> we've been asked to apply.  In particular, you will now see changes in 
> rhq-server.properties instructing you to set two new properties prior 
> to installation.
>
> Note that when building -Pdev your dev container will have already had 
> these values set, as in the past, so there is no required action.  But 
> for non-dev-container installs they will need to be set.  The two 
> properties are:
>
>   jboss.bind.address
>   rhq.server.management.password
>
> jboss.bind.address is no longer set automatically to 0.0.0.0.  It must 
> now be explicitly set, as desired.  It can be set to 0.0.0.0 to simply 
> maintain the previous behavior.
>
> rhq.server.management.password holds an obfuscated value for the RHQ 
> Server's 'rhqadmin' management user.  It must be set to a valid 
> management user password.  It can be easily set to the previous 
> default by uncommenting the line in rhq-server.properties.
>
> *** Currently the previous default must be used ***
>
> This is due to the fact that we don't yet have a password generator in 
> place for this value.  The algorithm is different than for the 
> obfuscation used for the db and storage node passwords, because it is 
> AS generated.  When set to a non-default value the discovered 
> rhq-server resource will not be able to connect, as it uses the 
> default value.  So, non-default values will also need to be applied to 
> rhq-server resource connection properties to get the plugin to connect 
> to the server.
>
> Upgrades do not need to worry about setting these, the upgrade will 
> take care of it.
>
> I'll update you as soon as we have a mechanism for generating the 
> management user password values.
>
> Jay
> _______________________________________________
> rhq-devel mailing list
> rhq-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/rhq-devel



More information about the rhq-devel mailing list