Bug 777622 (SOA-131)

Link: Added: This issue is related to JBAS-4540

This is ultimately a non-issue, because the server does not respond to non-local requests, regardless of the binding address.

Link: Added: This issue is a dependency of SOA-101

I'm just not sure we can possibly secure this out of the box.  Certainly, RMI is one of ESB's supported endpoint protocols, and I don't see how we can possibly automatically limit serving the classes across the wire, just based on whatever business classes are present.   That would seem to me, to be something that could only be accomplished programmatically from ESB itself (if possible at all).

It would seem to me that this would have to be something that is documented in the platform documentation, for informing the client on how to secure the server after deploying their projects.

This is fixed in the production config.  Port 8083 still listens, but will only serve deployed EJB remote interfaces by default.  However, this webserver does not throw 404 errors, but rather returns blank content for requests where there is no class found, and this should be understood in testing.

Link: Added: This issue is related to SOA-406

Link: Added: This issue is a dependency of SOA-406

Link: Removed: This issue is a dependency of SOA-406 

Link: Removed: This issue is related to SOA-406 

documented.

Affects: Added: [Release Notes]

Same results with CP01 build.

Attachment: Added: CP01.txt

email from Marc:

Hi Joshua,

 the only reliable workaround is fixing it.
 A fix is available since 20070724,
 see http://jira.jboss.com/jira/browse/JBAS-4540

 For a temporary fix there are some flags in
 the the config for org.jboss.web.WebService mbean
 that promise to disable non-EJB class download.

    <attribute name="Port">8083</attribute>
    <!-- Should resources and non-EJB classes be downloadable -->
    <attribute name="DownloadServerClasses">false</attribute>
    <attribute name="DownloadResources">false</attribute>

Thanks
Marc

Link: Added: This issue depends JBPAPP-245

I see no reason why the standalone server does not behave in the same way. I suspect that when data and jars have been stripped out during its creation that we lost something.

See last comment, this is a documentation issue.  The setting to serve the classes is needed for some of the RMI quick starts.  The user needs to know that with the standalone server it is necessary to change this setting to false in order to secure the environment for production.

Release noted:

3.5.2. Preventing download of non-RMI classes on Port 8083 in the standalone version of the server

If you use RMI (Remote Method Invocation) you will want to make Port 8083 of your server accessible to clients. The EAP version of the server is configured out of the box to restrict the classes that it serves on this port. The standalone server, however, is configured out of the box to serve all deployable classes via this port. This has been done to allow the quickstarts to function correctly by default.

To change this behaviour you need to modify the following line in default/conf/jboss-service.xml:

<!-- Should non-EJB .class files be downloadable -->
<attribute name="DownloadServerClasses">false</attribute>

The value for this attribute is set as true out of the box, and it should be set to false in actual production deployment to prevent the server from serving all deployable classes on Port 8083. 

Verified in the release notes here:

https://svn.corp.jboss.com/repos/soa/trunk/build-tools/docs/SOA_Release_Notes.txt

It's in the CR3 release note too:

    3.5.2. Preventing download of non-RMI classes on Port 8083 in the
    standalone version of the server

   If you use RMI (Remote Method Invocation) you will want to make
   Port 8083 of your server accessible to clients. The EAP version of
   the server is configured out of the box to restrict the classes
   that it serves on this port. The standalone server, however, is
   configured out of the box to serve all deployable classes via this
   port. This has been done to allow the quickstarts to function
   correctly by default.

   To change this behaviour you need to modify the following line in
   default/conf/jboss-service.xml:

 <!-- Should non-EJB .class files be downloadable -->
 <attribute name="DownloadServerClasses">false</attribute>

   The value for this attribute is set as true out of the box, and it
   should be set to false in actual production deployment to prevent
   the server from serving all deployable classes on Port 8083.