How to secure a ActiveMQ?

Question

Does anybody have experience with securing/hardening ActiveMQ? Check lists or guides would be welcome.

Answer 1

In my option you need to think of atleast two factors when implementing the message services. These are authentication and authorization.

Broker authentication

Authentication is the process of making sure the entity's intregrity is intact. Usually this is done by supplying a password. ActiveMQ supports JAAS and also has an API that supports custom built authentication plugins.

The easiest way to implement this is to configure your broker xml file to only allow authenticated users. Example which could be placed under the tag in your xml:

<simpleAuthenticationPlugin>
    <users>
        <authenticationUserusername="admin"password="password"
        groups="admins,publishers,consumers"/>
    </users>
</simpleAuthenticationPlugin>

The groups provided will be usefull for the authorization of the user. Very usefull when you need to only allow some services to some user groups. Use the createConnection(username, password) method for the authentication procedure.

Broker authorization

Authorization is all about allowing an entity access to a secured resource. Often implemented with the help of ACL's. The following sample XML will provide authorization on a destination:

<authorizationPlugin>
    <map>
        <authorizationMap>
            <authorizationEntries>
                <authorizationEntrytopic=">"
                    read="admins"write="admins"admin="admins" />
                <authorizationEntrytopic="YourTopic.>"
                    read="consumers"write="publishers"
                    admin="publishers" />
                <authorizationEntrytopic="YourTopic.Stats"
                    read="guests" />
            </authorizationEntries>
        </authorizationMap>
    </map>
</authorizationPlugin>

Note that the > wild card provides the authorization scheme recursively to anything under that path.

Message level authorization

Sometimes it can be usefull to add authorization at the message level instead of at the connection level. This is done by creating a java class MessageAuthorizationPolicy thus forcing you to implement the method boolean isAllowedToConsume(ConnectionContextcontext, Message message) . Here you can implement your own criteries of authorization.

To put the authorization policy in good use you need to install and configure it into your ActiveMQ setup. Basicly it is done via these steps:

• Compile your class into a JAR file
• Put the JAR in ApacheMQ's lib folder
• Add a proper messageAuthorizationPolicy element to your configuration
• Restart ActiveMQ