In many environments, users want to restrict access to ActiveMQ web server (Jetty) and web console application in particular. Here’s how to do it for ActiveMQ 5.3.1 version of broker.
In 5.3.1, the whole web server configuration is placed in the ${ACTIVEMQ_HOME}/conf/jetty.xml file. The configuration file you can find at here is a drop-in replacement for a default jetty configuration and you should place it in your configuration folder.
Besides that you’ll need to create a ${ACTIVEMQ_HOME}/conf/jetty-realm.properties with the following content:
It’s a classic Jetty hash user realm file that defines one user, with it’s password and roles in each line (Downloadable from here). By default, as you can see in the realm file, you can use admin/admin credentials to access ActiveMQ web server. You should adapt this file to your security needs.
So, after making these changes and restarting your broker, you should get basic authentication dialog before you’d be able to proceed. If you want to later on disable the authentication, you can do that easily by changing the line
to
ActiveMQ 5.4.0 will come with this configuration enabled by default and if you wish to secure older versions of the ActiveMQ take a look at this article.