Is GlassFish Admin console (port 4848) secure?

Question

With understanding of secure Internet connections limited to SSL, I'm doubtful about the security of GlassFish Admin console. Normal secure HTTP connections use http**s**://domain/ URLs but in GlassFish http://domain:4848/ is used to login to Admin console. Is there some kind of encryption going on between the browser and the server when using that administration port, or does all that communication go unsecurely, naked to possible hackers?

GlassFish documentation guide how to use the Admin console but I haven't found any mention about this security concern.

Answer 1

If it used SSL, you would access it as https://domain:4848/

You can see more information by choosing "Page info" from your browser's menu. If you have accessed the page through an https URL, you should see a small lock icon somewhere on the browser window, and that icon should be clickable.

Answer 2

SSL can be enabled for Admin console inside Admin console -> Configurations -> HTTP Service -> HTTP Listeners -> admin-listener (responsible for listening for 4848 port)

There is a secure checkbox option that is not enabled by default. After enabling it Admin console will force the use of SSL. For example http:/domain:4848/ redirects to https://domain:4848/

..not entirely sure if just checkin secure option for admin-listener did the trick, as saving the change the console froze. After that I also changed AS_ADMIN_SECURE=true in GlassFish's config/asadminenv.conf.

Answer 3

If you have an install script in order to be able to install your development/production environment reliably again and again, you might want to set the corresponding glassfish property at that script using this line:

asadmin set --port 4848 --user admin --passwordfile password-file.txt server.http-service.http-listener.admin-listener.security-enabled=true

Answer 4

"checkin secure option for admin-listener" is working after I restart the server.