lolcreds

Public credential defaults and exposure patterns for authorized security testing.

Apache ActiveMQ

Apache Software Foundationother3 credentials

Credentials3 documented
01

JAAS User Password

apache-activemq / jaas-user-password

ActiveMQ Classic commonly uses JAAS PropertiesLoginModule authentication with users.properties and groups.properties referenced from login.config and the broker configuration.

user definedsecretusername/password

Looks like

pattern
pattern

ActiveMQ users.properties username=password entry; use only with ActiveMQ JAAS user file context

(?m)^[A-Za-z0-9_.@-]{1,128}\s*=\s*[^#\r\n]{1,255}$

Location

config file
conf/users.properties, users.properties, conf/groups.properties, groups.properties, conf/login.config, login.config, conf/activemq.xml, activemq.xml

JAAS user/password and group files referenced by ActiveMQ broker configuration

secret store

Kubernetes Secrets, Docker secrets, cloud secret managers, and deployment vaults

source code

Broker configs, Docker Compose files, tests, examples, and deployment repositories

logs

Broker authentication failures, startup logs, debug traces, and CI output

public interface
tcp/61616, /admin

ActiveMQ broker and web management login surfaces

Notes

No ASF-owned credential-value environment variables were confirmed for this block; deployment images may define their own variables.

02

Anonymous Access Configuration

apache-activemq / anonymous-access

ActiveMQ can allow anonymous broker access by setting anonymousAccessAllowed on the simpleAuthenticationPlugin. Clients without username and password are assigned an anonymous identity/group.

user definedcontext dependentother

Looks like

pattern
pattern

ActiveMQ configuration allowing clients without credentials

anonymousAccessAllowed\s*=\s*['"]?true['"]?

Location

config file
conf/activemq.xml, activemq.xml

Broker authentication plugin configuration

source code

Committed broker configs, Helm charts, Docker Compose files, and examples

image

Container images or VM images containing permissive broker config

Notes

Anonymous access is not a credential, but it creates passwordless broker access and should be triaged with network exposure and destination ACLs.

03

Web Console Password

apache-activemq / web-console-password

ActiveMQ deployments often protect the web console with Jetty realm or JAAS credentials separate from broker client credentials.

user definedsecretusername/password

Looks like

pattern
pattern

Jetty realm user entry in jetty-realm.properties; use only with ActiveMQ web-console context

(?m)^[A-Za-z0-9_.@-]{1,128}\s*:\s*[^,\r\n]{1,255}\s*,\s*[A-Za-z0-9_, -]+

Location

config file
conf/jetty-realm.properties, jetty-realm.properties, conf/login.config, login.config, conf/activemq.xml, activemq.xml

Web console realm files, JAAS configuration, and broker web config

public interface
/admin

Browser-based broker management interface

secret store

Deployment vaults, container secrets, and CI/CD variables

source code

Committed web-console realm files, examples, and deployment repos

logs

Web console authentication logs and startup output

Notes

Do not model admin/admin or other sample credentials as universal defaults unless a specific package or image source states they ship that way.

Scope

Authorized use

LOLCreds helps map the credential surface of real products: known defaults, generated values, credential locations, and exposure patterns.