Product Knowledge Base

Space shortcuts

Page tree

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 2 Next »

The connection to JobScheduler Universal Agent can be secured by HTTPS. For the required Architecture see JobScheduler Universal Agent - Secure HTTPS communication.

This Article describes the steps required to set up secure HTTPS communication.

Get a TLS Certificate

A TLS certificate can be acquired by

  • buying a TLS certificate
  • creating a self-signed certificate

Configure a reverse proxy

JobScheduler Universal Agent itself does not provide configuration options to encrypt it's communication by HTTPS. The recommended solution is to run a reverse proxy on the same host but under a different user.

The reverse proxy needs to be configured to

  • only accept HTTPS connections
  • use the above TLS certificate
  • proxy all HTTPS requests by to localhost on the Agent port using HTTP

 

Sample Apache 2.2 configuration for HTTPS on Port 24445
 <VirtualHost *:24445>
 
  ProxyPass / http://localhost:4445/
  ProxyPassReverse / http://localhost:4445/
 
  # Enable/Disable SSL for this virtual host.
  SSLEngine on
 
  SSLProtocol all -SSLv2 -SSLv3
  SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
  SSLCertificateFile /etc/pki/tls/certs/agent_host.crt
  SSLCertificateKeyFile /etc/pki/tls/private/agent_host.key
 
</VirtualHost>

Import the self-signed certificate into the Java Truststore

This step is not required if the TLS certificate was bought from a trusted certificate authority.

  • Copy the certificate file (e.g. agent_host.crt) to your JobScheduler Master host
  • Locate the JVM that JobScheduler Master is using
    • If you are uncertain, search the scheduler.log file for jvm.dll (Windows) or jvm.so (Unix). This will list the path of your Java installation (JRE or JDK).
  • Run the Java keytool from that Java installation to import the certificate
Importing the self signed certificate with the Java keytool
 keytool -importcert -keystore <java_for_scheduler>/lib/security/cacerts -alias agent_host -file agent_host.crt -storepass changeit

See also: https://blogs.oracle.com/java-platform-group/entry/self_signed_certificates_for_a

Configure JobScheduler Master to use the reverse proxy

The proxy URL along with the HTTPS keyword is configured in the process class for the Agent:

Process class definition with HTTPS
<process_class  max_processes="20" remote_scheduler="https://agent_host:24445"/>
  • No labels