summaryrefslogtreecommitdiff
path: root/qpid/java/broker/etc
diff options
context:
space:
mode:
authorRobert Gemmell <robbie@apache.org>2013-09-23 23:37:32 +0000
committerRobert Gemmell <robbie@apache.org>2013-09-23 23:37:32 +0000
commit59710ea96cf37dc3859ada1dc5fb095b0b2bc6b4 (patch)
tree9057f14c822133a506620251cd253a899b186564 /qpid/java/broker/etc
parentefb5fc9fef693085e1eab22d84bd250f2bc241d6 (diff)
downloadqpid-python-59710ea96cf37dc3859ada1dc5fb095b0b2bc6b4.tar.gz
QPID-5159: fixups after previous directory rename of broker to broker-core
- Add new broker module build.xml - Updates the other modules to rely on broker-core, make it all compile. - 'Un-move' the bin, etc, scripts dirs and other non-core files to 'leave' them in the broker module. - 'Un-move' the Main and MainTest classes to 'leave' them in the broker module. git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1525736 13f79535-47bb-0310-9956-ffa450edef68
Diffstat (limited to 'qpid/java/broker/etc')
-rw-r--r--qpid/java/broker/etc/broker_example.acl131
-rw-r--r--qpid/java/broker/etc/groups29
-rw-r--r--qpid/java/broker/etc/log4j.xml123
-rw-r--r--qpid/java/broker/etc/md5passwd23
-rw-r--r--qpid/java/broker/etc/passwd25
5 files changed, 331 insertions, 0 deletions
diff --git a/qpid/java/broker/etc/broker_example.acl b/qpid/java/broker/etc/broker_example.acl
new file mode 100644
index 0000000000..29dca90f15
--- /dev/null
+++ b/qpid/java/broker/etc/broker_example.acl
@@ -0,0 +1,131 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+### EXAMPLE ACL V2 FILE
+### NOTE: Rules are considered from top to bottom, and the first matching rule governs the decision.
+### Rules may refer to users or groups. Groups are currently defined in the etc/groups file.
+
+### JMX MANAGEMENT ####
+
+# To use JMX management, first give the user/group ACCESS MANAGEMENT permission
+ACL ALLOW administrators ACCESS MANAGEMENT
+ACL ALLOW guest ACCESS MANAGEMENT
+
+# Allow guest to perform read operations on the ServerInformation mbean
+ACL ALLOW guest ACCESS METHOD component="ServerInformation"
+
+# Allow 'administrators' all management operations. To reduce log file noise, only non-read-only operations are logged.
+ACL ALLOW administrators ACCESS METHOD
+ACL ALLOW-LOG administrators ALL METHOD
+
+# Allow 'guest' to view logger levels, and use getter methods on LoggingManagement
+ACL ALLOW guest ACCESS METHOD component="LoggingManagement" name="viewEffectiveRuntimeLoggerLevels"
+ACL ALLOW guest ACCESS METHOD component="LoggingManagement" name="get*"
+
+# Deny access to Shutdown, UserManagement, ConfigurationManagement and LoggingManagement for all other users
+# You could grant specific users access to these beans by adding rules above to allow them
+ACL DENY-LOG ALL ACCESS METHOD component="Shutdown"
+ACL DENY-LOG ALL ACCESS METHOD component="UserManagement"
+ACL DENY-LOG ALL ACCESS METHOD component="ConfigurationManagement"
+ACL DENY-LOG ALL ACCESS METHOD component="LoggingManagement"
+
+# Allow everyone to perform all read operations on the mbeans not listed in the DENY rules above
+ACL ALLOW ALL ACCESS METHOD
+
+### WEB MANAGEMENT ####
+
+# To use web management, first give the user/group ACCESS MANAGEMENT permission
+ACL ALLOW webadmins ACCESS MANAGEMENT
+
+# ACL for web management console admins
+# All rules below are required for console admin users
+# to perform create/update/delete operations
+ACL ALLOW-LOG webadmins CREATE QUEUE
+ACL ALLOW-LOG webadmins UPDATE QUEUE
+ACL ALLOW-LOG webadmins DELETE QUEUE
+ACL ALLOW-LOG webadmins PURGE QUEUE
+ACL ALLOW-LOG webadmins CREATE EXCHANGE
+ACL ALLOW-LOG webadmins DELETE EXCHANGE
+ACL ALLOW-LOG webadmins BIND EXCHANGE
+ACL ALLOW-LOG webadmins UNBIND EXCHANGE
+ACL ALLOW-LOG webadmins CREATE GROUP
+ACL ALLOW-LOG webadmins DELETE GROUP
+ACL ALLOW-LOG webadmins UPDATE GROUP
+ACL ALLOW-LOG webadmins CREATE USER
+ACL ALLOW-LOG webadmins DELETE USER
+ACL ALLOW-LOG webadmins UPDATE USER
+
+ACL ALLOW-LOG webadmins UPDATE METHOD
+
+# authorise operations changing broker model
+ACL ALLOW-LOG webadmins CONFIGURE BROKER
+
+# authorise operations to view and download broker logs
+ACL ALLOW webadmins ACCESS_LOGS BROKER
+
+# at the moment only the following UPDATE METHOD rules are supported by web management console
+#ACL ALLOW-LOG webadmins UPDATE METHOD component="VirtualHost.Queue" name="moveMessages"
+#ACL ALLOW-LOG webadmins UPDATE METHOD component="VirtualHost.Queue" name="copyMessages"
+#ACL ALLOW-LOG webadmins UPDATE METHOD component="VirtualHost.Queue" name="deleteMessages"
+
+### MESSAGING ###
+# The 'ACCESS VIRTUALHOST' rules below apply to messaging operations (as opposed to management operations)
+
+# Firewall examples
+
+# Deny access to all users from *.example.company1.com and *.example.company2.com
+ACL DENY-LOG all ACCESS VIRTUALHOST from_hostname=".*\.example\.company1.com,.*\.example\.company2.com"
+
+# Deny access to all users in the IP ranges 192.168.1.0-192.168.1.255 and 192.168.2.0-192.168.2.255,
+# using the notation specified in RFC 4632, "Classless Inter-domain Routing (CIDR)"
+ACL DENY-LOG messaging-users ACCESS VIRTUALHOST from_network="192.168.1.0/24,192.168.2.0/24"
+
+# Deny access to all users in the IP ranges 192.169.1.0-192.169.1.255 and 192.169.2.0-192.169.2.255,
+# using wildcard notation.
+ACL DENY-LOG messaging-users ACCESS VIRTUALHOST from_network="192.169.1.*,192.169.2.*"
+
+# Allow 'messaging-users' group to connect to all virtualhosts
+ACL ALLOW-LOG messaging-users ACCESS VIRTUALHOST
+
+# Deny messaging-users management
+ACL DENY-LOG messaging-users ACCESS MANAGEMENT
+
+
+# Client side
+# Allow the 'client' user to publish requests to the request queue and create, consume from, and delete temporary reply queues.
+ACL ALLOW-LOG client CREATE QUEUE temporary="true"
+ACL ALLOW-LOG client CONSUME QUEUE temporary="true"
+ACL ALLOW-LOG client DELETE QUEUE temporary="true"
+ACL ALLOW-LOG client BIND EXCHANGE name="amq.direct" temporary="true"
+ACL ALLOW-LOG client UNBIND EXCHANGE name="amq.direct" temporary="true"
+ACL ALLOW-LOG client PUBLISH EXCHANGE name="amq.direct" routingKey="example.RequestQueue"
+
+# Server side
+# Allow the 'server' user to create and consume from the request queue and publish a response to the temporary response queue created by
+# client.
+ACL ALLOW-LOG server CREATE QUEUE name="example.RequestQueue"
+ACL ALLOW-LOG server CONSUME QUEUE name="example.RequestQueue"
+ACL ALLOW-LOG server BIND EXCHANGE
+ACL ALLOW-LOG server PUBLISH EXCHANGE name="amq.direct" routingKey="TempQueue*"
+
+
+### DEFAULT ###
+
+# Deny all users from performing all operations
+ACL DENY-LOG all all
diff --git a/qpid/java/broker/etc/groups b/qpid/java/broker/etc/groups
new file mode 100644
index 0000000000..e3912ece99
--- /dev/null
+++ b/qpid/java/broker/etc/groups
@@ -0,0 +1,29 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+#
+# To define a group, use the format:
+#
+# <groupname>.users=<user1>,<user2>,...,<usern>
+#
+
+messaging-users.users=guest,client,server
+administrators.users=admin
+webadmins.users=webadmin
+
diff --git a/qpid/java/broker/etc/log4j.xml b/qpid/java/broker/etc/log4j.xml
new file mode 100644
index 0000000000..71a13875a1
--- /dev/null
+++ b/qpid/java/broker/etc/log4j.xml
@@ -0,0 +1,123 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ -
+ - Licensed to the Apache Software Foundation (ASF) under one
+ - or more contributor license agreements. See the NOTICE file
+ - distributed with this work for additional information
+ - regarding copyright ownership. The ASF licenses this file
+ - to you under the Apache License, Version 2.0 (the
+ - "License"); you may not use this file except in compliance
+ - with the License. You may obtain a copy of the License at
+ -
+ - http://www.apache.org/licenses/LICENSE-2.0
+ -
+ - Unless required by applicable law or agreed to in writing,
+ - software distributed under the License is distributed on an
+ - "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ - KIND, either express or implied. See the License for the
+ - specific language governing permissions and limitations
+ - under the License.
+ -
+ --><!DOCTYPE log4j:configuration SYSTEM "log4j.dtd">
+
+<log4j:configuration xmlns:log4j="http://jakarta.apache.org/log4j/" debug="null" threshold="null">
+ <appender class="org.apache.log4j.QpidCompositeRollingAppender" name="ArchivingFileAppender">
+ <!-- Ensure that logs always have the DatePattern appended to the filename.
+ DEFAULT IF NOT CONFIGURED: true -->
+ <param name="StaticLogFileName" value="true"/>
+ <param name="file" value="${QPID_WORK}/log/${logprefix}qpid${logsuffix}.log"/>
+ <!-- Style of rolling to use, by:
+ File Size(1)
+ Date(2)
+ Both(3)
+
+ When Date (or Both) is enabled then the value of DatePattern will determine
+ when the new file is made. e.g. a DatePattern of "'.'yyyy-MM-dd-HH-mm"
+ which includes minutes will cause a new backup file to be made every minute.
+
+ DEFAULT IF NOT CONFIGURED: 3 -->
+ <param name="RollingStyle" value="1"/>
+ <!-- Set the count direction:
+ Negative numbers mean backups are numbered <latest>, .0, .1, .2,..., .n
+ 0 means backup is DatePattern stamped and followed with a Positive number
+ if the DatePattern stamp clashes with other existing backups.
+ Positive numbers mean backups are numbered 0, 1, 2, ..., n, <latest>
+
+ DEFAULT IF NOT CONFIGURED: -1 -->
+ <param name="CountDirection" value="0"/>
+ <!-- Maximum File Size:
+ DEFAULT IF NOT CONFIGURED: 10MB -->
+ <param name="MaxFileSize" value="1MB"/>
+ <!-- Date Pattern:
+ DEFAULT IF NOT CONFIGURED: "'.'yyyy-MM-dd" -->
+ <param name="DatePattern" value="'.'yyyy-MM-dd-HH-mm"/>
+ <!-- Maximum number of backup files:
+ 0 means no backups
+ -1 means infinite backups
+
+ DEFAULT IF NOT CONFIGURED: 0 -->
+ <param name="MaxSizeRollBackups" value="-1"/>
+ <!-- Compress(gzip) the backup files to the backup location:
+ DEFAULT IF NOT CONFIGURED: FALSE -->
+ <param name="CompressBackupFiles" value="true"/>
+ <!-- Compress the backup files using a second thread:
+ DEFAULT IF NOT CONFIGURED: FALSE -->
+ <param name="CompressAsync" value="true"/>
+ <!-- Backup Location:
+ DEFAULT IF NOT CONFIGURED: same dir as log file -->
+ <param name="backupFilesToPath" value="${QPID_WORK}/backup/log"/>
+
+ <layout class="org.apache.log4j.PatternLayout">
+ <param name="ConversionPattern" value="%d %-5p [%t] (%c{2}) - %m%n"/>
+ </layout>
+ </appender>
+
+ <appender class="org.apache.log4j.FileAppender" name="FileAppender">
+ <param name="File" value="${QPID_WORK}/log/${logprefix}qpid${logsuffix}.log"/>
+ <param name="Append" value="false"/>
+
+ <layout class="org.apache.log4j.PatternLayout">
+ <param name="ConversionPattern" value="%d %-5p [%t] (%c{2}) - %m%n"/>
+ </layout>
+ </appender>
+
+ <appender class="org.apache.log4j.ConsoleAppender" name="STDOUT">
+ <layout class="org.apache.log4j.PatternLayout">
+ <param name="ConversionPattern" value="%d %-5p [%t] (%c{2}) - %m%n"/>
+ </layout>
+ </appender>
+
+ <!-- Provide warnings to standard output -->
+ <logger additivity="true" name="org.apache.qpid">
+ <level value="warn"/>
+ </logger>
+
+ <!-- Enable info messages for the status-logging hierarchy -->
+ <logger additivity="true" name="qpid.message">
+ <level value="info"/>
+ </logger>
+
+ <!-- Subscription state may toggle frequently for clients with low prefetch
+ so switch off this operational logging by default-->
+ <logger additivity="true" name="qpid.message.subscription.state">
+ <level value="off"/>
+ </logger>
+
+ <!-- Enable log messages for the queue notifications -->
+ <logger additivity="true" name="org.apache.qpid.server.queue.NotificationCheck">
+ <level value="info"/>
+ </logger>
+
+ <!-- Set the commons logging that the XML parser uses to WARN, it is very chatty at debug -->
+ <logger name="org.apache.commons">
+ <level value="warn"/>
+ </logger>
+
+ <!-- Log all info events to file -->
+ <root>
+ <level value="info"/>
+ <appender-ref ref="FileAppender"/>
+ <!--appender-ref ref="ArchivingFileAppender"/-->
+ </root>
+
+</log4j:configuration>
diff --git a/qpid/java/broker/etc/md5passwd b/qpid/java/broker/etc/md5passwd
new file mode 100644
index 0000000000..f7185c0e92
--- /dev/null
+++ b/qpid/java/broker/etc/md5passwd
@@ -0,0 +1,23 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+guest:CE4DQ6BIb/BVMN9scFyLtA==
+client:CE4DQ6BIb/BVMN9scFyLtA==
+server:CE4DQ6BIb/BVMN9scFyLtA==
+admin:ISMvKXpXpadDiUoOSoAfww==
+webadmin:rda7WOE5vhAzJNBNgtj1RQ==
diff --git a/qpid/java/broker/etc/passwd b/qpid/java/broker/etc/passwd
new file mode 100644
index 0000000000..f0dcb80f25
--- /dev/null
+++ b/qpid/java/broker/etc/passwd
@@ -0,0 +1,25 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+guest:guest
+client:guest
+server:guest
+admin:admin
+
+webadmin:webadmin
+