Java KVM Console with an SSH Tunnel Through a Jumphost

Question

I'm trying to use a KVM Console via an SSH tunnel and I'm getting a Connection Refused Java Error. Here is what I'm doing:

On my Macbook I am establishing an SSH tunnel to my remote server via a jumphost with the following command:

ssh -L 1234:TARGET_SERVER:443 jumphost.foo.com

Next I connect to the remote server's GUI via: https://127.0.0.1:1234

Everything works great. I log into the server, click the Java KVM Console button and my browser downloads the viewer.jnlp applet. Inside the jnlp file all the HTTPS references list https://127.0.0.1:443 and when running this jnlp file Java returns an error saying,

Unable To Launch Application

So I go into the file using VI and I change all the port 443 settings to port 1234. Now everything references https://127.0.0.1:1234. I then run the JNLP file again (using javaws) and I'm getting somewhere. I first get the message about this being an Untrusted connection, should I continue? I select Continue. Next it downloads the KVM application and the next message is: Do you want to run this application? So I select Run.

This is when Java fails and effectively says Connection Refused in the Java Console Logs. What I assume is the problem is likely related to the SSH tunnelling, but I cannot figure out what I need to do in order to correct the problem. I need to run a Java JNLP through a Jumphost using a tunnel and knows what the solution; also access a remote server which is offline and only accessible through the IPMI connection.

Java Console Log:

--Java Web Start 11.191.2.12 x86_64
Using JRE version 1.8.0_191-b12 Java HotSpot(TM) 64-Bit Server VM
User home directory = /my/homedir
----------------------------------------------------
c:   clear console window
f:   finalize objects on finalization queue
g:   garbage collect
h:   display this help message
m:   print memory usage
o:   trigger logging
p:   reload proxy configuration
q:   hide console
r:   reload policy configuration
s:   dump system and deployment properties
t:   dump thread list
v:   dump thread stack
0-5: set trace level to <n>
----------------------------------------------------
Missing Application-Name manifest attribute for: https://127.0.0.1:1234/software/avctNuova.jar.pack.gz
MAC OS X
KVM/VM Client Version: 5.04.02 (Build 192)
replace numpad
replace numpad
** Max Size: W = 1920 H = 976
** Window Pref Size: W = 1024 H = 812
** Max Size: W = 1920 H = 976
** Window Pref Size: W = 1024 H = 812
JNLPClassLoader: Finding library libVMAPI_DLL.dylib
JNLPClassLoader: Finding library libjawt.dylib
JNLPClassLoader: Finding library libavctKVMIO.dylib
Try again with the reduced mode protocol list
Already tried the reduced mode protocol list, quitting
java.net.ConnectException: Connection refused (Connection refused)
    at java.net.PlainSocketImpl.socketConnect(Native Method)
    at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)
    at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)
    at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)
    at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
    at java.net.Socket.connect(Socket.java:589)
    at java.net.Socket.connect(Socket.java:538)
    at java.net.Socket.<init>(Socket.java:434)
    at java.net.Socket.<init>(Socket.java:211)
    at com.avocent.protocol.apcp.ProtocolAPCP.createBasicSocket(Unknown Source)
    at com.avocent.protocol.apcp.ProtocolAPCP.getAvspSocket(Unknown Source)
    at com.avocent.protocol.apcp.ProtocolAPCP.getAvspPrimarySocket(Unknown Source)
    at com.avocent.protocol.avsp.AvspKvmSession.connectToPort(Unknown Source)
    at com.avocent.protocol.avsp.AvspKvmSession.connectToPort(Unknown Source)
    at com.avocent.api.viewer.RPAPIClientViewer.sendConnectRequestToServer(Unknown Source)
    at com.avocent.api.viewer.RPAPIClientViewer.openViewerClient(Unknown Source)
    at com.avocent.app.kvm.DefaultViewerMainController.startSession(Unknown Source)
    at com.avocent.app.kvm.DefaultViewerMainController.startApp(Unknown Source)
    at com.avocent.nuova.kvm.CiscoViewerMainController.startApp(Unknown Source)
    at com.avocent.nuova.kvm.Main.runApp(Unknown Source)
    at com.avocent.nuova.kvm.Main.main(Unknown Source)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at com.sun.javaws.Launcher.executeApplication(Unknown Source)
    at com.sun.javaws.Launcher.executeMainClass(Unknown Source)
    at com.sun.javaws.Launcher.doLaunchApp(Unknown Source)
    at com.sun.javaws.Launcher.run(Unknown Source)
    at java.lang.Thread.run(Thread.java:748)
CoreSessionListener : connection failed
in CoreSessionListner : fireOnSessionStateChanged 
 KVM session state SESSION_FAILED

Answer 1

You will probably need to add an exception for this host to the java.security file located within your JRE/JDK paths. If you are going through a proxy or have any kind of self signed or not root trusted certificates in the chain (or you are accessing via http and not https) then you need to tell Java that it is OK to do so.