cryostat-legacy icon indicating copy to clipboard operation
cryostat-legacy copied to clipboard

[Task] Investigate usage of empty JMX password

Open tthvo opened this issue 2 years ago • 0 comments

I wonder if the target JVM would actually accept a jmxremote.password file defining a user with an empty password. Maybe we need to be more lenient for that case. Something to investigate anyway, out of scope of this particular PR. It could be tested by modifying Cryostat's own entrypoint.sh something like this:

diff --git a/src/main/extras/app/entrypoint.bash b/src/main/extras/app/entrypoint.bash
index 185d0340..4f9cd524 100755
--- a/src/main/extras/app/entrypoint.bash
+++ b/src/main/extras/app/entrypoint.bash
@@ -25,8 +25,10 @@ function createJmxCredentials() {
     fi
 
     echo -n "$CRYOSTAT_RJMX_USER $CRYOSTAT_RJMX_PASS" > "$PWFILE"
+    echo -n "NOPASS " >> "$PWFILE"
     chmod 400 "$PWFILE"
     echo -n "$CRYOSTAT_RJMX_USER readwrite" > "$USRFILE"
+    echo -n "NOPASS readwrite" >> "$USRFILE"
     chmod 400 "$USRFILE"
 }

but then there would also be required changes to the Credentials API and/or frontend to allow blank passwords to be stored.

Originally posted by @andrewazores in https://github.com/cryostatio/cryostat/pull/1257#discussion_r1036225158

tthvo avatar Nov 30 '22 21:11 tthvo