Recently, we have been talking a lot about JMX – especially about using the Monitis JMX Agent to monitor your JBoss server. As I mentioned in my previous post, in JBoss 6.x and earlier versions, the JMX web console and the JMX connector do not require authentication. This obviously presents a security risk – anyone who knows the hostname and port number can connect to your JBoss server, and not only examine the MBean properties, but even invoke administrative operations. Fortunately, there are some easy steps you can take to prevent this from happening on your production servers. But first, let’s talk briefly about two components of the JBoss management ecosystem.

• The JMX Console Most developers who deploy applications on JBoss are familiar with the JMX console. It is basically a JEE webapp, deployed as a .WAR file . The console comes bundled with JBoss versions up to 6.x (JBoss 7 uses a different management infrastructure, but we will talk more about that in a future post). Like any web application, it can be secured declaratively by modifying its deployment descriptors. Usually, it can be accesses using a URL like this: http://localhost:8080/jmx-console
• The JMX Connector accepts remote JMX/RMI connections (on port 1090 by default). Management applications (such as jconsole or the Monitis JMX Agent) use it to connect to JBoss MBean server.
  Read the full post