Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Does anybody have experience with securing/hardening ActiveMQ? Check lists or guides would be welcome.

share|improve this question
    
What are you intending to secure/harden ActiveMQ against? On what type of network are you setting up activeMQ? –  yfeldblum Oct 9 '11 at 21:22

1 Answer 1

up vote 6 down vote accepted

In my option you need to think of atleast two factors when implementing the message services. These are authentication and authorization.

Broker authentication

Authentication is the process of making sure the entity's intregrity is intact. Usually this is done by supplying a password. ActiveMQ supports JAAS and also has an API that supports custom built authentication plugins.

The easiest way to implement this is to configure your broker xml file to only allow authenticated users. Example which could be placed under the <plugin> tag in your xml:

<simpleAuthenticationPlugin>
    <users>
        <authenticationUser username="admin" password="password"
        groups="admins,publishers,consumers"/>
    </users>
</simpleAuthenticationPlugin>

The groups provided will be usefull for the authorization of the user. Very usefull when you need to only allow some services to some user groups. Use the createConnection(username, password) method for the authentication procedure.

Broker authorization

Authorization is all about allowing an entity access to a secured resource. Often implemented with the help of ACL's. The following sample XML will provide authorization on a destination:

<authorizationPlugin>
    <map>
        <authorizationMap>
            <authorizationEntries>
                <authorizationEntry topic=">"
                    read="admins" write="admins"admin="admins" />
                <authorizationEntry topic="YourTopic.>"
                    read="consumers" write="publishers"
                    admin="publishers" />
                <authorizationEntry topic="YourTopic.Stats"
                    read="guests" />
            </authorizationEntries>
        </authorizationMap>
    </map>
</authorizationPlugin>

Note that the > wild card provides the authorization scheme recursively to anything under that path.

Message level authorization

Sometimes it can be usefull to add authorization at the message level instead of at the connection level. This is done by creating a java class MessageAuthorizationPolicy thus forcing you to implement the method boolean isAllowedToConsume(ConnectionContextcontext, Message message) . Here you can implement your own criteries of authorization.

To put the authorization policy in good use you need to install and configure it into your ActiveMQ setup. Basicly it is done via these steps:

  • Compile your class into a JAR file
  • Put the JAR in ApacheMQ's lib folder
  • Add a proper messageAuthorizationPolicy element to your configuration
  • Restart ActiveMQ
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.