4.9 Install Changes
Jay Shaughnessy
jshaughn at redhat.com
Mon Sep 9 17:01:48 UTC 2013
As of this morning (commit c424425a6d97ee31c7ddba165b2c58656b13cf9a)
there is now a facility to generate the obfuscated management user
password to be set in rhq-server.properties. It is the exact same
mechanism used to generate the DB or Storage node obfuscated passwords:
Run rhq-installer.sh with the --encodepassword option. This will output
the property values to be set in rhq-server.properties, given the
password provided on the commandline. For example:
> rhq-installer.sh|bat --encodepassword sample
*** Encoded password properties for rhq-server.properties:
*** rhq.server.database.password=-e823e068e392e44
*** rhq.storage.password=-e823e068e392e44
*** rhq.server.management.password=7863706f1c52d283c01a46fb21111357
To use the same password for everything just run the utility one time.
Run it multiple times for different passwords, using only the relevant
outputted property.
On 9/6/2013 5:07 PM, Jay Shaughnessy wrote:
>
> Devels,
>
> There is a recent commit that applies some security-related changes
> we've been asked to apply. In particular, you will now see changes in
> rhq-server.properties instructing you to set two new properties prior
> to installation.
>
> Note that when building -Pdev your dev container will have already had
> these values set, as in the past, so there is no required action. But
> for non-dev-container installs they will need to be set. The two
> properties are:
>
> jboss.bind.address
> rhq.server.management.password
>
> jboss.bind.address is no longer set automatically to 0.0.0.0. It must
> now be explicitly set, as desired. It can be set to 0.0.0.0 to simply
> maintain the previous behavior.
>
> rhq.server.management.password holds an obfuscated value for the RHQ
> Server's 'rhqadmin' management user. It must be set to a valid
> management user password. It can be easily set to the previous
> default by uncommenting the line in rhq-server.properties.
>
> *** Currently the previous default must be used ***
>
> This is due to the fact that we don't yet have a password generator in
> place for this value. The algorithm is different than for the
> obfuscation used for the db and storage node passwords, because it is
> AS generated. When set to a non-default value the discovered
> rhq-server resource will not be able to connect, as it uses the
> default value. So, non-default values will also need to be applied to
> rhq-server resource connection properties to get the plugin to connect
> to the server.
>
> Upgrades do not need to worry about setting these, the upgrade will
> take care of it.
>
> I'll update you as soon as we have a mechanism for generating the
> management user password values.
>
> Jay
> _______________________________________________
> rhq-devel mailing list
> rhq-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
More information about the rhq-devel
mailing list