0

I'm using java application server behind web application firewall (nginx with TLS & mod_security).

Java application is running in Internal network segment behind WAF. Requests from the Internet comes to java application server only via WAF which is running on different host in DMZ.

I want to monitor various metrics of java application. JVM provides JMX service out of the box for monitoring and management, so it's very easy to setup java application process monitoring by tools like Nagios & Zabbix. Monitoring server will be running on same network segment as java server or in special Management network segment.

My Questions:

  1. Is it secure to expose JMX service to local network (internal segment)?
  2. Is safe to monitor java application with JMX when application is processing secure data?
  3. If not, should I use some http-jmx bridge like Jolokia and not expose JMX? In this case I'll have to setup manually all the metrics in Nagios/Zabbix. For JMX the standard java JMX metrics are pre-configured.
  4. Is SNMP a good replacement of JMX for monitoring?
1
  1. You can configure JMX to be exposed on the local network with SSL and various authentication methods and controls enabled. JMX will be listening on a port different from the Java application. Assuming that the nginx server is configured to only proxy to the Java server's application port, then without that machine getting compromised, then JMX will not get exposed outside your internal network.

  2. JMX is generally considered safe in this regard. If you application exposes more metrics through JMX, then there maybe a leakage there, but typically not through the default JVM provided resources.

  3. This wouldn't be any more secure than normal JMX. If you utilized a local agent to query JMX and push data to Nagios/Zabbix/Graphite, that would be more secure.

  4. Oh, dear lord, no.

2
  • Thank you, @Shackledtodesk for your answer. Nginx is just a proxy, JMX port is restricted to access from DMZ by iptables. Yes, it's a good idea to setup a monitoring agent.Could you please explain briefly what's wrong with SNMP? Oct 28 '16 at 12:32
  • I admit to being a bit sarcastic with regards to my SNMP comment. But unless you are using SNMP v3, I wouldn't consider it secure. And while it's nice to possibly use a single monitoring/metrics protocol when you have a mix of network devices and servers, I find SNMP to be more hassle than it's generally worth when there are more modern protocols available. Nov 2 '16 at 7:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.