SSL在Artemis上实现，但是具有无效信任存储和用户凭据的客户端能够连接到代理

Question

<acceptors>
<!-- Acceptor for every supported protocol -->
     <acceptor name="artemis">tcp://0.0.0.0:61616?tcpSendBufferSize=1048576;tcpReceiveBufferSize=1048576;amqpMinLargeMessageSize=102400;protocols=CORE,AMQP,STOMP,HORNETQ,MQTT,OPENWIRE;useEpoll=true;amqpCredits=1000;amqpLowCredits=300;amqpDuplicateDetection=true;supportAdvisory=false;suppressInternalManagementObjects=false</acceptor>

     <!-- AMQP Acceptor.  Listens on default AMQP port for AMQP traffic.-->
     <acceptor name="amqp">tcp://0.0.0.0:5672?tcpSendBufferSize=1048576;tcpReceiveBufferSize=1048576;protocols=AMQP;useEpoll=true;amqpCredits=1000;amqpLowCredits=300;amqpMinLargeMessageSize=102400;amqpDuplicateDetection=true</acceptor>

     <!-- STOMP Acceptor. -->
     <acceptor name="stomp">tcp://0.0.0.0:61613?tcpSendBufferSize=1048576;tcpReceiveBufferSize=1048576;protocols=STOMP;useEpoll=true</acceptor>

     <!-- HornetQ Compatibility Acceptor.  Enables HornetQ Core and STOMP for legacy HornetQ clients. -->
     <acceptor name="hornetq">tcp://0.0.0.0:5445?anycastPrefix=jms.queue.;multicastPrefix=jms.topic.;protocols=HORNETQ,STOMP;useEpoll=true</acceptor>

     <!-- MQTT Acceptor -->
     <acceptor name="mqtt">tcp://0.0.0.0:1883?tcpSendBufferSize=1048576;tcpReceiveBufferSize=1048576;protocols=MQTT;useEpoll=false</acceptor>
     
     <!-- SSL Acceptor -->
    <acceptor name="netty-ssl-acceptor">tcp://0.0.0.0:61617?tcpSendBufferSize=1048576;tcpReceiveBufferSize=1048576;sslEnabled=true;keyStorePath=E:/apache-artemis-2.18.0/bin/localBroker/etc/sprink.jks;keyStorePassword=changeit;trustStorePath=E:/apache-artemis-2.18.0/bin/localBroker/etc/sprinktrust.ts;trustStorePassword=changeit;needClientAuth=true;protocols=CORE,AMQP,STOMP,HORNETQ,MQTT,OPENWIRE</acceptor>

 </acceptors>

import org.apache.activemq.artemis.jms.client.ActiveMQConnectionFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.jms.annotation.EnableJms;
import org.springframework.jms.config.DefaultJmsListenerContainerFactory;
import org.springframework.jms.core.JmsTemplate;


import javax.jms.JMSException;


@Configuration
@EnableJms
public class MQTTConfig {

    @Value("${activemq.broker-url}")
    private String brokerUrl;

    @Value("${activemq.ssl-url}")
    private String sslUrl;

    @Value("${JMS_BROKER_TRUSTSTORE}")
    private String pathToTrustStore;

    @Value("${JMS_BROKER_KEYSTORE}")
    private String pathToKeystore;

    @Value("${JMS_BROKER_TRUSTSTORE_PASSWORD}")
    private String truststorePassword;

    @Value("${JMS_BROKER_KEYSTORE_PASSWORD}")
    private String keystorePassword;

    /**
     * Initialise the connection factory that will be used
     */

    @Bean
    public ActiveMQConnectionFactory artemisSSLConnectionFactory() {
        ActiveMQConnectionFactory artemisConnectionFactory = new ActiveMQConnectionFactory("tcp://localhost:61617?&" + "sslEnabled=true&" +
                "trustStorePath=" + pathToTrustStore + "&trustStorePassword=changeit&needClientAuth=true");
        artemisConnectionFactory.setUser("user");
        artemisConnectionFactory.setPassword("password");
        return artemisConnectionFactory;
    }

    /**
     * Initialise {@link JmsTemplate} as required
     */
    @Bean
    public JmsTemplate jmsTemplate() throws JMSException {
        JmsTemplate jmsTemplate = new JmsTemplate();
        jmsTemplate.setConnectionFactory(artemisSSLConnectionFactory());
        jmsTemplate.setExplicitQosEnabled(true);

        //setting PuSubDomain to true configures JmsTemplate to work with topics instead of queues
        jmsTemplate.setPubSubDomain(true);
        jmsTemplate.setDeliveryMode(DeliveryMode.NON_PERSISTENT);
        jmsTemplate.setDeliveryPersistent(true);
        return jmsTemplate;
    }

    /**
     * Initialise {@link DefaultJmsListenerContainerFactory} as required
     */
    @Bean
    public DefaultJmsListenerContainerFactory jmsListenerContainerFactory() throws JMSException {
        DefaultJmsListenerContainerFactory factory = new DefaultJmsListenerContainerFactory();
        factory.setConnectionFactory(artemisSSLConnectionFactory());
        //setting PuSubDomain to true configures the DefaultJmsListenerContainerFactory to work with topics instead of queues
        factory.setPubSubDomain(true);
        return factory;
    }

}

artemis-users.properties文件如下所示

admin = ENC(1024...)
system=manager
user=password
guest=password

artemis-roles.properties定义了以下角色

admins = admin
users=user

管理员和用户在broker.xml中被授予特权，如下所示

<security-settings>
   <security-setting match="#">
      <permission type="createNonDurableQueue" roles="admins, users"/>
      <permission type="deleteNonDurableQueue" roles="admins, users"/>
      <permission type="createDurableQueue" roles="admins, users"/>
      <permission type="deleteDurableQueue" roles="admins, users"/>
      <permission type="createAddress" roles="admins, users"/>
      <permission type="deleteAddress" roles="admins, users"/>
      <permission type="consume" roles="admins, users"/>
      <permission type="browse" roles="admins, users"/>
      <permission type="send" roles="admins, users"/>
      <!-- we need this otherwise ./artemis data imp wouldn't work -->
      <permission type="manage" roles="admins"/>
   </security-setting>
</security-settings>

通过上述设置，任何客户机使用任何信任存储或用户名和密码都可以在端口61617上连接到代理，并生成和使用消息。我错过了什么，让这种情况发生？

Answer 1

事情是这样运作的。

首先，Artemis上的login.config文件有一个GuestLoginModule，该链接称它链接到PropertiesLoginModule，并且guest模块允许没有凭据甚至无效凭据的客户端连接到代理。现在，默认情况下，GuestLoginModule如下所示

org.apache.activemq.artemis.spi.core.security.jaas.GuestLoginModule sufficient
   debug=false
   org.apache.activemq.jaas.guest.user="admin"
   org.apache.activemq.jaas.guest.role="admins";

请注意，客人被视为管理员。我的artemis-users.properties文件已经定义了一个guest用户（如我在上面的原始文章中所见），所以我在artemis-roles.properties文件中创建了一个“guest”组，并将这个guest用户分配给这个组。然后，我更改了GuestLoginModule中的管理映射，以便该模块引用Guests。GuestLoginModule现在如下所示

org.apache.activemq.artemis.spi.core.security.jaas.GuestLoginModule sufficient
   debug=false
   org.apache.activemq.jaas.guest.user="guest"
   org.apache.activemq.jaas.guest.role="guests";

broker.xml文件中的安全设置可以根据相关用例修改以适应guest功能，我的文件没有guest用户的任何用例，所以guest没有权限。

完成后，我尝试连接到代理，并得到null证书链异常。通过在连接工厂配置中包含密钥存储来修复此问题。因为needClientAuth设置为true（启用了dual auth)，Artemis需要客户机通过绑定从根CA派生的密钥对来构建相关的密钥库，所以我的连接工厂配置从

@Bean
public ActiveMQConnectionFactory artemisSSLConnectionFactory() {
    ActiveMQConnectionFactory artemisConnectionFactory = new ActiveMQConnectionFactory("tcp://localhost:61617?&" + "sslEnabled=true&" +
            "trustStorePath=" + pathToTrustStore + "&trustStorePassword=changeit&needClientAuth=true");
    artemisConnectionFactory.setUser("user");
    artemisConnectionFactory.setPassword("password");
    return artemisConnectionFactory;
}

到

@Bean
public ActiveMQConnectionFactory artemisSSLConnectionFactory() {
    ActiveMQConnectionFactory artemisConnectionFactory = new ActiveMQConnectionFactory("tcp://localhost:61617?&" + "sslEnabled=true&" +
            "trustStorePath=" + pathToTrustStore + "&trustStorePassword=changeit&keyStorePath="+ pathToKeystore +"&keyStorePassword=changeit&needClientAuth=true");
    artemisConnectionFactory.setUser("user");
    artemisConnectionFactory.setPassword("password");
    return artemisConnectionFactory;
}

这里唯一的区别是增加了密钥库路径和密码。当代理只是配置中的truststore时，它没有连接。如果需要一种方式auth，只需省略acceptor中的needClientAuth字段，因为它在默认情况下被设置为false。

这才是最终奏效的办法。