Securing the Weblogic Admin Console

It would be very easy to hack [see Google search below] and access your Domain resources very easily. So one should think of Securing your Weblogic Admin and its Domain resources.
 
Just type in "Administration Console" "Sign in" WebLogic inurl:"console" in your Google Search engine and you would find a number of Weblogic Console URL's across globe.

There are 2 ways you can secure your Weblogic Admin Console.
A. Enable Administration Port
B. Changing the console context-path

A. Enable Administration Port 

Weblogic Administration Port helps you secure access to Weblogic Admin Console. By default Weblogic Admin Console is deployed on the AdminServer listen port.

With the Administration Port enabled:

-- The console is only accessible over a non-standard port (which will not be available to world outside your firewall)
-- You will have to use SSL [https protocol] along with Administration Port to access your domain console.
-- You get a dedicated administration listen thread.
-- Administrative requests over any port other than the administration port are rejected.

-- Enables you to separate the Administration traffic from Application traffic in your domain. For example you can access the application with http & 7001 port but you cannot access Weblogic Admin Console with http & 7001 port. You will to use https & 9002 port to do so.

Steps to Enable Administration Port

1. If you have not already done so, in the Change Center of the Administration Console, click "Lock & Edit" 

2. In the left pane, click on the domain name.

3. In the right pane, Select Configuration > General tab. 

4. Click the Enable Administration Port check box flag and specify the appropriate Administration Port.

5. Click Save and in the Change Center of the Administration Console, click "Activate Changes".

Note: No restart required you will be automatically switched to use Administration Port. If not check step6.

6. The Weblogic Admin console will no longer be accessible on your AdminServer Listen Port. You will have to use https protocol with Administration Port to access your Weblogic Admin Console now. For ex: https://localhost:9002/console. 
Now that you are using Administration Port, if you try accessing Weblogic Admin console using standard listen port you would get below message displayed on your browser
"Console/Management requests or requests with <require-admin-traffic> specified to 'true' can only be made through an administration channel"

7. Now the Managed Server will have to use the new HTTPS URL during the start-up. If your Managed Server is starting via Windows service then you will have to re-install the service with new settings. Please refer WebLogic Server instance as Windows Service.

B. Changing the Console context-path

As the context-path for Weblogic Admin console is globally known, it would be very easy to hack [see Google search below] and access your Domain resources very easily. You can now change the Console context-path to your wish.

Steps to change the Console context-path

1. If you have not already done so, in the Change Center of the Administration Console, click "Lock & Edit"

2. In the left pane, click on the domain name.

3. In the right pane, Select Configuration > General tab and click Advanced link at the very bottom of the page.

4. Change the value for Console Context Path field. I am using as admin as my new Console Context Path.

5. Click Save and in the Change Center of the Administration Console, click "Activate Changes".

6. Restart all the Weblogic Server instances specified in the Restart-Checklist for changes to take effect.


7. Once restarted test the Weblogic Console URL with new context-path.
 

That's it.
Please do leave your valuable comments.