lock down JBoss 4.1 and tomcat

[cjburkha]

Hi all,

I come from a mostly Windows background, where defaults are not always the safest.

Somehow I'm now in charge of a JBoss 4.0.1 server with embeded Tomcat, running on Redhat 9.0.

I have removed java-councile and web-consile, are there any other defaults I should turn off?

We are hosting a static web site off this box, and by that I mean it is not accepting any sql calls or posts or anything like that, although the pages are jsp's

My question is, is JBoss pretty secure out of the box, or are there resources I should be lookin into to make it more secure?

Thanks in advance for any advice you can give,

CJB

 

[segment]

You could check out the following paper for starters:

http://www.javaworld.com/javaworld/jw-02-2002/jw-0215-ejbsecurity.html

As with any kind of service running, you should try to minimize the administrative side of things meaning keep too many hands off the configuration. Jail'ing binaries works as does mods (mod_security, etc)