5.13 JMX console

The JMX console is only enabled for local access. This is used by the controller for metering and can also be used for debugging.

To enable JMX console remote access, edit /opt/sdn/virgo/bin/dmk.sh. The following line determines whether JMX allows remote access or not:

-Dcom.sun.management.jmxremote.local.only=true \

Any changes to this file require a controller restart to recognize the change.

5.14 Security practices

5.14.1Security procedure

1.Update the following passwords:

•Keystore

•Truststore

•Jarsigning

•Admin Token

•Service Token

•Authentication Manager

2.Log into http://<cont_IP>:/8443/sdu/ui as the SDN user.

3.Select Configurations.

4.Select the component com.hp.sdn.ctl.of.impl.AuthenticationManager.

5.Select Modify.

6.Set the AdminToken to the newly chosen Keystore (authentication) admin token.

7.Set the ServiceToken to the newly chosen internal communication secret.

8.Set the KeystorePass to the value that you will be using to secure the SSL Keystore.

9.Set the TruststorePass to the value that you will be using to secure the SSL Truststore.

10.Update the Keystore Admin Token in the file etc/keystore/keystore.conf.

Change the Admin Token from admin_token=ADMIN to admin_token=<AdminTokenSetInControllerConf>.

11.Update the Keystore password to match the password changed in Step 1 using the following: keytool-storepasswd-storepassskyline-new<KeystorePassFromControllerConfig>-keystore/opt/sdn/admin/keystore.

12.Update the Keystore’s internal serverkey to match the keystore’s password using the following:

keytool-keypasswd-alias serverkey-storepass <KeystorePassFromControllerConfig>-keystore skyline-new <KeystorePassFromControllerConfig>-keystore/opt/sdn/admin/keystore.

13.Update the Truststore password to match the Truststore password in Step 1 using the following:

keytool-storepasswd-storepass skyline-new foobar-keystore/opt/sdn/admin/truststore.

14.Update the jar signing keystore password (named sdnjar_trust.jks) using the following:

keytool-storepasswd-storepass skyline-new <newpass4sign>-keystore/opt/sdn/admin/sdnjar_trust.jks.

This password does not have to match the others.

5.13 JMX console 71