Is GlassFish Admin console (port 4848) secure?

问题:

With understanding of secure Internet connections limited to SSL, I'm doubtful about the security of GlassFish Admin console. Normal secure HTTP connections use https://domain/ URLs but in GlassFish http://domain:4848/ is used to login to Admin console. Is there some kind of encryption going on between the browser and the server when using that administration port, or does all that communication go unsecurely, naked to possible hackers?

GlassFish documentation guide how to use the Admin console but I haven't found any mention about this security concern.

回答1:

SSL can be enabled for Admin console inside Admin console -> Configurations -> HTTP Service -> HTTP Listeners -> admin-listener (responsible for listening for 4848 port)

There is a secure checkbox option that is not enabled by default. After enabling it Admin console will force the use of SSL. For example http:/domain:4848/ redirects to https://domain:4848/

..not entirely sure if just checkin secure option for admin-listener did the trick, as saving the change the console froze. After that I also changed AS_ADMIN_SECURE=true in GlassFish's config/asadminenv.conf.

回答2:

I don't know if this is a Glassfish v3.1 only feature but you can turn on SSL on console admin by running the following command

asadmin enable-secure-admin

As it's described here http://blogs.oracle.com/quinn/entry/securing_adminstration_in_glassfish_server1

回答3:

If you have an install script in order to be able to install your development/production environment reliably again and again, you might want to set the corresponding glassfish property at that script using this line:

asadmin set --port 4848 --user admin --passwordfile password-file.txt server.http-service.http-listener.admin-listener.security-enabled=true

回答4:

"checkin secure option for admin-listener" is working after I restart the server.

回答5:

If it used SSL, you would access it as https://domain:4848/

You can see more information by choosing "Page info" from your browser's menu. If you have accessed the page through an https URL, you should see a small lock icon somewhere on the browser window, and that icon should be clickable.