glassfish
  1. glassfish
  2. GLASSFISH-12912

create-instance should be disabled on instances

    Details

    • Type: Bug Bug
    • Status: Resolved
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: 3.1
    • Fix Version/s: 3.1_b28
    • Component/s: admin
    • Labels:
      None
    • Environment:

      Operating System: All
      Platform: All

    • Issuezilla Id:
      12,912

      Description

      I have no DAS running. I have an instance, i1, running w/ admin port = 24848

      1. asadmin --port 24848 create-instance i2
      Enter the value for the node option> localhost

      remote failure: Exception while adding the new configuration
      org.jvnet.hk2.config.TransactionFailure: Can''t find the default config (an
      element named "default-
      config") in domain.xml. You may specify the name of an existing config element
      next time. : org.jvnet.hk2.config.TransactionFailure: Can''t find the default co
      nfig (an element named "default-config") in domain.xml. You may specify the
      name of an existing config element next time.

      Command create-instance failed.

      ========================================

      Easy Fix – disable the command on instances.

        Activity

        Hide
        Byron Nevins added a comment -

        See 12911 for similar bug.

        I swear I'm not on a QA expedition. These bugs are just popping out at me
        automatically! In this case I had the following env. variable set so I called
        the instance by mistake. Good thing I did so this bug was identified!

        AS_ADMIN_PORT=24848

        btw the above is VERY VERY handy (thanks Bill!)

        Show
        Byron Nevins added a comment - See 12911 for similar bug. I swear I'm not on a QA expedition. These bugs are just popping out at me automatically! In this case I had the following env. variable set so I called the instance by mistake. Good thing I did so this bug was identified! AS_ADMIN_PORT=24848 btw the above is VERY VERY handy (thanks Bill!)
        Hide
        Tom Mueller added a comment -

        As with issue 12911, it will not be possible for asadmin to directly run a remote
        command on an instance once Tim's changes are in. But if you want to implement
        this, that would be fine.

        Show
        Tom Mueller added a comment - As with issue 12911, it will not be possible for asadmin to directly run a remote command on an instance once Tim's changes are in. But if you want to implement this, that would be fine.
        Hide
        Byron Nevins added a comment -

        Note that it is specifically and explicitly determining if it is running inside
        of a server instance, and then explicitly trying to start itself even though it
        is illogical. Almost the textbook definition of a bug.

        The code is confusing to the next person maintaining it and unnecessary.

        EXTREMELY easy to fix permanently.

        Show
        Byron Nevins added a comment - Note that it is specifically and explicitly determining if it is running inside of a server instance, and then explicitly trying to start itself even though it is illogical. Almost the textbook definition of a bug. The code is confusing to the next person maintaining it and unnecessary. EXTREMELY easy to fix permanently.
        Hide
        Jennifer Chou added a comment -

        Target for MS6.
        Fail if env is not DAS.

        if(!env.isDas())

        { String msg = Strings.get("notAllowed"); logger.warning(msg); report.setActionExitCode(ActionReport.ExitCode.FAILURE); report.setMessage(msg); return; }
        Show
        Jennifer Chou added a comment - Target for MS6. Fail if env is not DAS. if(!env.isDas()) { String msg = Strings.get("notAllowed"); logger.warning(msg); report.setActionExitCode(ActionReport.ExitCode.FAILURE); report.setMessage(msg); return; }
        Hide
        Jennifer Chou added a comment -

        There are 2 cases - running asadmin --port 24848 create-instance i2 with and
        without DAS running.

        1) With DAS running

        asadmin start-domain
        asadmin create-local-instance i1
        asadmin start-local-instance i1
        asadmin --port 24848 create-instance i2
        Enter the value for the node option> localhost
        remote failure: Exception while adding the new configuration Can''t find the def
        ault config (an element named "default-config") in domain.xml. You may specify
        the name of an existing config element next time. : org.jvnet.hk2.config.Transac
        tionFailure: Can''t find the default config (an element named "default-config")
        in domain.xml. You may specify the name of an existing config element next time
        .
        Can''t find the default config (an element named "default-config") in domain.xml
        . You may specify the name of an existing config element next time.

        Command create-instance failed.

        2) Without DAS running

        asadmin start-domain
        asadmin create-local-instance i1
        asadmin stop-domain
        asadmin start-local-instance i1
        asadmin --port 24849 create-instance i2
        Enter admin user name> admin
        Enter admin password for user "admin">
        Authentication failed for user: admin
        (Usually, this means invalid user name and/or password)
        Command create-instance failed.

        =====================
        I can fix case #1 with the fix above and an error message is diplayed:
        This fix is checked in CreateInstanceCommand.

        asadmin start-domain
        asadmin create-local-instance i1
        asadmin start-local-instance i1
        asadmin --port 24848 create-instance i2
        Enter the value for the node option> localhost
        remote failure: This command can only be run on DAS.

        Command create-instance failed.
        ===========================================

        Transfer to Tim to look into a better error message for case #2.

        Show
        Jennifer Chou added a comment - There are 2 cases - running asadmin --port 24848 create-instance i2 with and without DAS running. 1) With DAS running asadmin start-domain asadmin create-local-instance i1 asadmin start-local-instance i1 asadmin --port 24848 create-instance i2 Enter the value for the node option> localhost remote failure: Exception while adding the new configuration Can''t find the def ault config (an element named "default-config") in domain.xml. You may specify the name of an existing config element next time. : org.jvnet.hk2.config.Transac tionFailure: Can''t find the default config (an element named "default-config") in domain.xml. You may specify the name of an existing config element next time . Can''t find the default config (an element named "default-config") in domain.xml . You may specify the name of an existing config element next time. Command create-instance failed. 2) Without DAS running asadmin start-domain asadmin create-local-instance i1 asadmin stop-domain asadmin start-local-instance i1 asadmin --port 24849 create-instance i2 Enter admin user name> admin Enter admin password for user "admin"> Authentication failed for user: admin (Usually, this means invalid user name and/or password) Command create-instance failed. ===================== I can fix case #1 with the fix above and an error message is diplayed: This fix is checked in CreateInstanceCommand. asadmin start-domain asadmin create-local-instance i1 asadmin start-local-instance i1 asadmin --port 24848 create-instance i2 Enter the value for the node option> localhost remote failure: This command can only be run on DAS. Command create-instance failed. =========================================== Transfer to Tim to look into a better error message for case #2.
        Hide
        Tim Quinn added a comment -

        This should now be fixed.

        The correct behavior, from a security perspective, in both case #1 and #2 is for
        the instance to reject the attempt to run an admin command from a client
        directly to an instance with an authentication error.

        We want to prevent all admin access from clients directly to instances, except
        for local commands that know to use the locally-provisioned password. Yet
        obviously the DAS and those local commands do need to talk to the instance admin
        port. The authentication logic is where we tell whether to accept a given
        request or not, based on whether it's an instance or the DAS receiving the
        request and on what kind of authentication was provided on the request.

        Show
        Tim Quinn added a comment - This should now be fixed. The correct behavior, from a security perspective, in both case #1 and #2 is for the instance to reject the attempt to run an admin command from a client directly to an instance with an authentication error. We want to prevent all admin access from clients directly to instances, except for local commands that know to use the locally-provisioned password. Yet obviously the DAS and those local commands do need to talk to the instance admin port. The authentication logic is where we tell whether to accept a given request or not, based on whether it's an instance or the DAS receiving the request and on what kind of authentication was provided on the request.

          People

          • Assignee:
            Tim Quinn
            Reporter:
            Byron Nevins
          • Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved: