Mixing
JavaEE + JBoss: Verify all deployed war files
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}
0
my customer has a JavaEE compliant server. I send him some war-Files and corresponding checksums for deployment. Now I would like to prevent that the operators manipulate the war file before deployment.
Is there any possibility to verify the war file along the checksums on server startup? Is there a possibility to get the checksum of the current deployed war file? Is there already such a feature in e.g. a JBoss EAP?
Regards, Rokko
security java-ee jboss
asked Jan 3 at 7:48
Rokko_11Rokko_11
338314
add a comment |
0
my customer has a JavaEE compliant server. I send him some war-Files and corresponding checksums for deployment. Now I would like to prevent that the operators manipulate the war file before deployment.
Is there any possibility to verify the war file along the checksums on server startup? Is there a possibility to get the checksum of the current deployed war file? Is there already such a feature in e.g. a JBoss EAP?
Regards, Rokko
security java-ee jboss
asked Jan 3 at 7:48
Rokko_11Rokko_11
338314
You might want to try Signing and Verifying JAR Files to accomplish this. You can sign the WAR file as if it was a JAR file.
– Steve C
Jan 6 at 6:10
One of the way :# sha1sum TestApp.war cb16a87d23644fb166000b4b739ef12257b77326 Test.war- Above value should match with below directory name under "data/content/cb" inside <EAP_HOME>:# ls -lart drwxrwxr-x. 2 tmp tmp 4096 Jan 8 03:38 16a87d23644fb166000b4b739ef12257b77326
– Giri
Jan 12 at 14:19
add a comment |
0
0
0
my customer has a JavaEE compliant server. I send him some war-Files and corresponding checksums for deployment. Now I would like to prevent that the operators manipulate the war file before deployment.
Is there any possibility to verify the war file along the checksums on server startup? Is there a possibility to get the checksum of the current deployed war file? Is there already such a feature in e.g. a JBoss EAP?
Regards, Rokko
security java-ee jboss
asked Jan 3 at 7:48
Rokko_11Rokko_11
338314
my customer has a JavaEE compliant server. I send him some war-Files and corresponding checksums for deployment. Now I would like to prevent that the operators manipulate the war file before deployment.
Is there any possibility to verify the war file along the checksums on server startup? Is there a possibility to get the checksum of the current deployed war file? Is there already such a feature in e.g. a JBoss EAP?
Regards, Rokko
security java-ee jboss
security java-ee jboss
asked Jan 3 at 7:48
Rokko_11Rokko_11
338314
asked Jan 3 at 7:48
Rokko_11Rokko_11
338314
asked Jan 3 at 7:48
Rokko_11Rokko_11
338314
asked Jan 3 at 7:48
Rokko_11Rokko_11
338314
asked Jan 3 at 7:48
Rokko_11Rokko_11
338314
338314
You might want to try Signing and Verifying JAR Files to accomplish this. You can sign the WAR file as if it was a JAR file.
– Steve C
Jan 6 at 6:10
One of the way :# sha1sum TestApp.war cb16a87d23644fb166000b4b739ef12257b77326 Test.war- Above value should match with below directory name under "data/content/cb" inside <EAP_HOME>:# ls -lart drwxrwxr-x. 2 tmp tmp 4096 Jan 8 03:38 16a87d23644fb166000b4b739ef12257b77326
– Giri
Jan 12 at 14:19
add a comment |
You might want to try Signing and Verifying JAR Files to accomplish this. You can sign the WAR file as if it was a JAR file.
– Steve C
Jan 6 at 6:10
One of the way :# sha1sum TestApp.war cb16a87d23644fb166000b4b739ef12257b77326 Test.war- Above value should match with below directory name under "data/content/cb" inside <EAP_HOME>:# ls -lart drwxrwxr-x. 2 tmp tmp 4096 Jan 8 03:38 16a87d23644fb166000b4b739ef12257b77326
– Giri
Jan 12 at 14:19
You might want to try Signing and Verifying JAR Files to accomplish this. You can sign the WAR file as if it was a JAR file.
– Steve C
Jan 6 at 6:10
You might want to try Signing and Verifying JAR Files to accomplish this. You can sign the WAR file as if it was a JAR file.
– Steve C
Jan 6 at 6:10
One of the way :
# sha1sum TestApp.war cb16a87d23644fb166000b4b739ef12257b77326 Test.war - Above value should match with below directory name under "data/content/cb" inside <EAP_HOME>: # ls -lart drwxrwxr-x. 2 tmp tmp 4096 Jan 8 03:38 16a87d23644fb166000b4b739ef12257b77326– Giri
Jan 12 at 14:19
One of the way :
# sha1sum TestApp.war cb16a87d23644fb166000b4b739ef12257b77326 Test.war - Above value should match with below directory name under "data/content/cb" inside <EAP_HOME>: # ls -lart drwxrwxr-x. 2 tmp tmp 4096 Jan 8 03:38 16a87d23644fb166000b4b739ef12257b77326– Giri
Jan 12 at 14:19
add a comment |
1 Answer
1
active
oldest
votes
0
A managed deployment (war/ear/jar) is hashed on deployment : this hash is accessible through the jboss-cli:
/deployment=helloworld-mdb.war:read-resource(include-runtime) {
"outcome" => "success",
"result" => {
"content" => [{"hash" => bytes {
0xd1, 0xa1, 0x0a, 0xb1, 0x0a, 0xe5, 0xd9, 0xeb,
0x9d, 0x86, 0xba, 0x66, 0x8e, 0x24, 0x14, 0xc0,
0x13, 0x72, 0xd1, 0x1a
}}],
"disabled-time" => undefined,
"disabled-timestamp" => undefined,
"enabled" => true,
"enabled-time" => 1546534691069L,
"enabled-timestamp" => "2019-01-03 17:58:11,069 CET",
"managed" => true,
"name" => "helloworld-mdb.war",
"owner" => undefined,
"persistent" => true,
"runtime-name" => "helloworld-mdb.war",
"status" => "OK",
"subdeployment" => undefined,
"subsystem" => {
"messaging-activemq" => undefined,
"undertow" => undefined,
"ejb3" => undefined,
"logging" => undefined
}
} }
You can see the 'hash' in bytes
answered Jan 3 at 16:59
ehsavoieehsavoie
1,38286
One of the way :# sha1sum TestApp.war cb16a87d23644fb166000b4b739ef12257b77326 Test.war- Above value should match with below directory name under "data/content/cb" inside <EAP_HOME>:# ls -lart drwxrwxr-x. 2 tmp tmp 4096 Jan 8 03:38 16a87d23644fb166000b4b739ef12257b77326
– Giri
Jan 12 at 14:19
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54018264%2fjavaee-jboss-verify-all-deployed-war-files%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
0
A managed deployment (war/ear/jar) is hashed on deployment : this hash is accessible through the jboss-cli:
/deployment=helloworld-mdb.war:read-resource(include-runtime) {
"outcome" => "success",
"result" => {
"content" => [{"hash" => bytes {
0xd1, 0xa1, 0x0a, 0xb1, 0x0a, 0xe5, 0xd9, 0xeb,
0x9d, 0x86, 0xba, 0x66, 0x8e, 0x24, 0x14, 0xc0,
0x13, 0x72, 0xd1, 0x1a
}}],
"disabled-time" => undefined,
"disabled-timestamp" => undefined,
"enabled" => true,
"enabled-time" => 1546534691069L,
"enabled-timestamp" => "2019-01-03 17:58:11,069 CET",
"managed" => true,
"name" => "helloworld-mdb.war",
"owner" => undefined,
"persistent" => true,
"runtime-name" => "helloworld-mdb.war",
"status" => "OK",
"subdeployment" => undefined,
"subsystem" => {
"messaging-activemq" => undefined,
"undertow" => undefined,
"ejb3" => undefined,
"logging" => undefined
}
} }
You can see the 'hash' in bytes
answered Jan 3 at 16:59
ehsavoieehsavoie
1,38286
One of the way :# sha1sum TestApp.war cb16a87d23644fb166000b4b739ef12257b77326 Test.war- Above value should match with below directory name under "data/content/cb" inside <EAP_HOME>:# ls -lart drwxrwxr-x. 2 tmp tmp 4096 Jan 8 03:38 16a87d23644fb166000b4b739ef12257b77326
– Giri
Jan 12 at 14:19
add a comment |
0
A managed deployment (war/ear/jar) is hashed on deployment : this hash is accessible through the jboss-cli:
/deployment=helloworld-mdb.war:read-resource(include-runtime) {
"outcome" => "success",
"result" => {
"content" => [{"hash" => bytes {
0xd1, 0xa1, 0x0a, 0xb1, 0x0a, 0xe5, 0xd9, 0xeb,
0x9d, 0x86, 0xba, 0x66, 0x8e, 0x24, 0x14, 0xc0,
0x13, 0x72, 0xd1, 0x1a
}}],
"disabled-time" => undefined,
"disabled-timestamp" => undefined,
"enabled" => true,
"enabled-time" => 1546534691069L,
"enabled-timestamp" => "2019-01-03 17:58:11,069 CET",
"managed" => true,
"name" => "helloworld-mdb.war",
"owner" => undefined,
"persistent" => true,
"runtime-name" => "helloworld-mdb.war",
"status" => "OK",
"subdeployment" => undefined,
"subsystem" => {
"messaging-activemq" => undefined,
"undertow" => undefined,
"ejb3" => undefined,
"logging" => undefined
}
} }
You can see the 'hash' in bytes
answered Jan 3 at 16:59
ehsavoieehsavoie
1,38286
One of the way :# sha1sum TestApp.war cb16a87d23644fb166000b4b739ef12257b77326 Test.war- Above value should match with below directory name under "data/content/cb" inside <EAP_HOME>:# ls -lart drwxrwxr-x. 2 tmp tmp 4096 Jan 8 03:38 16a87d23644fb166000b4b739ef12257b77326
– Giri
Jan 12 at 14:19
add a comment |
0
0
0
A managed deployment (war/ear/jar) is hashed on deployment : this hash is accessible through the jboss-cli:
/deployment=helloworld-mdb.war:read-resource(include-runtime) {
"outcome" => "success",
"result" => {
"content" => [{"hash" => bytes {
0xd1, 0xa1, 0x0a, 0xb1, 0x0a, 0xe5, 0xd9, 0xeb,
0x9d, 0x86, 0xba, 0x66, 0x8e, 0x24, 0x14, 0xc0,
0x13, 0x72, 0xd1, 0x1a
}}],
"disabled-time" => undefined,
"disabled-timestamp" => undefined,
"enabled" => true,
"enabled-time" => 1546534691069L,
"enabled-timestamp" => "2019-01-03 17:58:11,069 CET",
"managed" => true,
"name" => "helloworld-mdb.war",
"owner" => undefined,
"persistent" => true,
"runtime-name" => "helloworld-mdb.war",
"status" => "OK",
"subdeployment" => undefined,
"subsystem" => {
"messaging-activemq" => undefined,
"undertow" => undefined,
"ejb3" => undefined,
"logging" => undefined
}
} }
You can see the 'hash' in bytes
answered Jan 3 at 16:59
ehsavoieehsavoie
1,38286
A managed deployment (war/ear/jar) is hashed on deployment : this hash is accessible through the jboss-cli:
/deployment=helloworld-mdb.war:read-resource(include-runtime) {
"outcome" => "success",
"result" => {
"content" => [{"hash" => bytes {
0xd1, 0xa1, 0x0a, 0xb1, 0x0a, 0xe5, 0xd9, 0xeb,
0x9d, 0x86, 0xba, 0x66, 0x8e, 0x24, 0x14, 0xc0,
0x13, 0x72, 0xd1, 0x1a
}}],
"disabled-time" => undefined,
"disabled-timestamp" => undefined,
"enabled" => true,
"enabled-time" => 1546534691069L,
"enabled-timestamp" => "2019-01-03 17:58:11,069 CET",
"managed" => true,
"name" => "helloworld-mdb.war",
"owner" => undefined,
"persistent" => true,
"runtime-name" => "helloworld-mdb.war",
"status" => "OK",
"subdeployment" => undefined,
"subsystem" => {
"messaging-activemq" => undefined,
"undertow" => undefined,
"ejb3" => undefined,
"logging" => undefined
}
} }
You can see the 'hash' in bytes
answered Jan 3 at 16:59
ehsavoieehsavoie
1,38286
answered Jan 3 at 16:59
ehsavoieehsavoie
1,38286
answered Jan 3 at 16:59
ehsavoieehsavoie
1,38286
answered Jan 3 at 16:59
ehsavoieehsavoie
1,38286
1,38286
One of the way :# sha1sum TestApp.war cb16a87d23644fb166000b4b739ef12257b77326 Test.war- Above value should match with below directory name under "data/content/cb" inside <EAP_HOME>:# ls -lart drwxrwxr-x. 2 tmp tmp 4096 Jan 8 03:38 16a87d23644fb166000b4b739ef12257b77326
– Giri
Jan 12 at 14:19
add a comment |
One of the way :# sha1sum TestApp.war cb16a87d23644fb166000b4b739ef12257b77326 Test.war- Above value should match with below directory name under "data/content/cb" inside <EAP_HOME>:# ls -lart drwxrwxr-x. 2 tmp tmp 4096 Jan 8 03:38 16a87d23644fb166000b4b739ef12257b77326
– Giri
Jan 12 at 14:19
One of the way :
# sha1sum TestApp.war cb16a87d23644fb166000b4b739ef12257b77326 Test.war - Above value should match with below directory name under "data/content/cb" inside <EAP_HOME>: # ls -lart drwxrwxr-x. 2 tmp tmp 4096 Jan 8 03:38 16a87d23644fb166000b4b739ef12257b77326– Giri
Jan 12 at 14:19
One of the way :
# sha1sum TestApp.war cb16a87d23644fb166000b4b739ef12257b77326 Test.war - Above value should match with below directory name under "data/content/cb" inside <EAP_HOME>: # ls -lart drwxrwxr-x. 2 tmp tmp 4096 Jan 8 03:38 16a87d23644fb166000b4b739ef12257b77326– Giri
Jan 12 at 14:19
add a comment |
draft saved
draft discarded
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54018264%2fjavaee-jboss-verify-all-deployed-war-files%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
You might want to try Signing and Verifying JAR Files to accomplish this. You can sign the WAR file as if it was a JAR file.
– Steve C
Jan 6 at 6:10
One of the way :
# sha1sum TestApp.war cb16a87d23644fb166000b4b739ef12257b77326 Test.war- Above value should match with below directory name under "data/content/cb" inside <EAP_HOME>:# ls -lart drwxrwxr-x. 2 tmp tmp 4096 Jan 8 03:38 16a87d23644fb166000b4b739ef12257b77326– Giri
Jan 12 at 14:19