1.1

4. Export a certificate that can be used by clients of the JMX Agent:
$ keytool -export -alias jmxagent -keystore admin.keystore -file
jmxagent_cert.crt
Enter keystore password: password
Certificate stored in file <jmxagent_cert.crt>
5. Import the certificate into a new trust store that will be used by a JMX client:
$ keytool -import -file jmxagent_cert.crt -alias jmxagent -keystore
clientTrustStore -storepass password
6.
Using a text editor, create an agent.properties file in the JMX Agent directory with the following
property definitions:
agent-ssl-enabled=true
agent-ssl-require-authentication=false
Note: Also include any additional properties required to start the JMX Agent and connection to your
SQLFire distributed system (for example, define mcast-port and locators). This example
accesses the JMX Agent using RMI; if you also want to access the Agent using HTTPS, include the
property definition http-ssl-require-authentication=true.
7.
Using a text editor, create an security.properties file in the JMX Agent directory with the following
property definitions:
javax.net.ssl.keyStoreType=jks
javax.net.ssl.keyStore=/path/admin.keystore
javax.net.ssl.keyStorePassword=password
javax.net.ssl.trustStore=/path/admin.keystore
javax.net.ssl.trustStorePassword=password
security-username=username
security-userPassword=password
Be sure to replace the indicated paths and passwords with the actual values for your system. Note that
security-username and security-password provide credentials to authenticate the JMX Agent
to the SQLFire distributed system that it monitors. See Configuring User Authentication on page 237 for
information about configuring authentication for SQLFire members.
8. Start the JMX Agent using the command:
sqlf agent start -dir=agent-directory-path
-J-DgemfireSecurityPropertyFile=path-to-security-properties
9. When starting the JMX client that will acess the JMX Agent, specify the
-J-Djavax.net.ssl.trustStore and -J-Djavax.net.ssl.trustStorePassword options
to point access the client trust store. For example, to start jconsole:
$ jconsole -J-DgemfireSecurityPropertyFile=./clientTrustStore
-J-Djavax.net.ssl.trustStorePassword=password
10.
In jconsole, access the JMX Agent over SSL by specifying the remote process
service:jmx:rmi://localhost/jndi/rmi://localhost:1099/jmxconnector. (Specify
the correct address or RMI port number if you started the Agent using non-default values.)
vFabric SQLFire MBeans
SQLFire uses MBeans associated with the vFabric Gemfire component to monitor the distributed system and
its contents. The JMX MBeans are ModelMBeans that manage instances of the Admin API objects housed in
the JMX Agent’s MBeanServer. The JMX Agent hosts an MBeanServer, instances of all MBeans registered for
managing a distributed system, and server connectors for various types of clients.
303
Using Java Management Extensions (JMX)