Issue in using rsa bsafe 6.1.2 with jmx management on UBuntu - rsa

Question

We have a java application which needs to use RSA BSAFE v6.1.2 as security provider and use jmx to expose few management API. Our application is not able to start, it just hangs, control never comes to Main class containing main(String[] args) method.
On the other hand, if we do not try to use jmx management, then it works fine.
In summary:
Following command just hangs:
/usr/lib/jvm/java-7-openjdk-amd64/jre/bin/java -jar -server -Dcom.sun.management.jmxremote.port=9003 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false appname.jar
But, following command works fine:
/usr/lib/jvm/java-7-openjdk-amd64/jre/bin/java -jar -server appname.jar
Do we need any setting changes in java.security file or some where else to ensure that jmx works fine?
thank you for help.
Following is part of output of jstack -l PID. By looking at the stack trace: It seems that following is the rsa related thread that is running for long time.
"main" prio=10 tid=0x00007f64c400a000 nid=0x6d42 runnable [0x00007f64cb18e000]
java.lang.Thread.State: RUNNABLE
at java.io.FileInputStream.readBytes(Native Method)
at java.io.FileInputStream.read(FileInputStream.java:272)
at sun.security.provider.SeedGenerator$URLSeedGenerator.getSeedBytes(SeedGenerator.java:551)
at sun.security.provider.SeedGenerator.generateSeed(SeedGenerator.java:139)
at sun.security.provider.SecureRandom.engineGenerateSeed(SecureRandom.java:125)
at java.security.SecureRandom.generateSeed(SecureRandom.java:517)
at com.rsa.cryptoj.o.bs.generateSeed(Unknown Source)
at com.rsa.jcm.f.ae.c(Unknown Source)
at com.rsa.jcm.f.ae.b(Unknown Source)
at com.rsa.jcm.f.ae.a(Unknown Source)
at com.rsa.jcm.f.ae.a(Unknown Source)
- locked <0x00000000f6d8fd20> (a com.rsa.jcm.f.ae)
at com.rsa.jcm.f.ho.generateSeed(Unknown Source)
at com.rsa.jcm.f.ko.getSeed(Unknown Source)
- locked <0x00000000f604c1f8> (a java.lang.Class for com.rsa.jcm.f.ko)
at com.rsa.jcm.f.cu.f(Unknown Source)
at com.rsa.jcm.f.cu.m(Unknown Source)
at com.rsa.jcm.f.cu.setAlgorithmParams(Unknown Source)
- locked <0x00000000f6e6c258> (a com.rsa.jcm.f.cu)
at com.rsa.cryptoj.o.cw$b.setAlgorithmParams(Unknown Source)
at com.rsa.cryptoj.o.nt$a.b(Unknown Source)
at com.rsa.cryptoj.o.nt$a.<init>(Unknown Source)
at com.rsa.cryptoj.o.nt$i.<init>(Unknown Source)
at com.rsa.cryptoj.o.ke$152.a(Unknown Source)
at com.rsa.cryptoj.o.kc.newInstance(Unknown Source)
at sun.security.jca.GetInstance.getInstance(GetInstance.java:236)
at sun.security.jca.GetInstance.getInstance(GetInstance.java:164)
at java.security.SecureRandom.getInstance(SecureRandom.java:276)
at java.security.SecureRandom.getDefaultPRNG(SecureRandom.java:198)
at java.security.SecureRandom.<init>(SecureRandom.java:155)
at java.rmi.server.ObjID.<clinit>(ObjID.java:89)
at sun.rmi.transport.LiveRef.<init>(LiveRef.java:74)
at sun.rmi.server.UnicastServerRef.<init>(UnicastServerRef.java:139)
at sun.management.jmxremote.ConnectorBootstrap$PermanentExporter.exportObject(ConnectorBootstrap.java:187)
at javax.management.remote.rmi.RMIJRMPServerImpl.export(RMIJRMPServerImpl.java:116)
at javax.management.remote.rmi.RMIJRMPServerImpl.export(RMIJRMPServerImpl.java:95)
at javax.management.remote.rmi.RMIConnectorServer.start(RMIConnectorServer.java:403)
- locked <0x00000000f571e000> (a javax.management.remote.rmi.RMIConnectorServer)
at sun.management.jmxremote.ConnectorBootstrap.exportMBeanServer(ConnectorBootstrap.java:778)
at sun.management.jmxremote.ConnectorBootstrap.startRemoteConnectorServer(ConnectorBootstrap.java:457)
- locked <0x00000000f554b420> (a java.lang.Class for sun.management.jmxremote.ConnectorBootstrap)
at sun.management.Agent.startAgent(Agent.java:260)
at sun.management.Agent.startAgent(Agent.java:456)

Answer 1

I am pretty sure that has nothing to do with JMX. Its about the way the SeedGenerator works under some system (ubuntu) configuration. I am also fighting this issue with a current Droplet (Ubuntu 14_04 with Java 8 and Tomcat 8).
Right now i dont know why we have this issue on this specific DigitalOcean droplet, where other droplets (older ubuntu, older Java) have no problems.
BTW, your package using the SeedGenerator (com.rsa.cryptoj) is causing this. In my situation its a Tomcat SessionIdGenerator which uses the SeedGenerator. And it doesnt hang, it just takes an unbelivable amount of time to create the Seed. At least in my situation. 5 mins and more.
Unfortunately i cant present a solution but people tend to play with java.security file in lib folder of JVM. In detail the paramter "securerandom.source=file:/dev/random"