WSO2 Integrator MI - Hardened ESB with Web Control Plane

What is WSO2 Integrator: MI

WSO2 Integrator: MI (formerly WSO2 Micro Integrator) is an open-source, configuration-driven integration runtime - an enterprise service bus for connecting APIs, services, databases, SaaS platforms and legacy systems. It mediates messages between protocols and formats: REST and SOAP services, JMS and RabbitMQ queues, file and FTP transfers, scheduled tasks and database-backed data services. Integrations are declared as Synapse artifacts - REST APIs, proxy services, sequences, endpoints, message stores and processors - and deployed as composite applications built with the WSO2 Integrator extension for VS Code. It is Apache-2.0 licensed, with no feature gating and no separate enterprise edition.

Why self-host WSO2 Integrator: MI

Integration middleware sees your most sensitive traffic: customer records in flight, credentials for every downstream system, and the payloads that move between them. Running it on your own VM keeps that traffic and those secrets inside your subscription and your network boundary, which matters for GDPR and for data-residency commitments. Self-hosting also removes per-message or per-connector pricing - the cost is the VM, whatever the throughput - and keeps the integration logic in portable Synapse XML rather than a proprietary hosted format.

What this VM image adds

Security hardening:

• No shipped credentials - the distributions carry a documented default administrator account; this image generates a random password for the control plane and a separate one for the management API on first boot, and verifies the defaults no longer authenticate
• Regenerated TLS keystores - the upstream keystores contain a publicly known private key behind a published password; a fresh 2048-bit key pair is generated at first boot and both truststores are re-passworded
• Rotated signing secrets - every JWT signing key used by the control plane is replaced with a random 48-character secret, so session tokens cannot be forged
• HTTPS-only administration - the management API is restricted to its TLS listener; the plaintext administration port is disabled outright
• TLS 1.2 and 1.3 only - on every listener, replacing an upstream default that still enabled TLS 1.0 and 1.1
• CVE scan - every image is scanned for vulnerabilities with Trivy before release
• UFW firewall - only the integration endpoint, the management API and the console are reachable; internal control-plane listeners stay on the host
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control

OS hardening (CIS Level 1):

• CIS Level 1 hardened - CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd - system call auditing for critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access
• Kernel hardening - SYN cookies, ASLR, rp_filter, TCP BBR
• /tmp as tmpfs - nosuid, nodev, noexec
• Azure IMDS endpoints - egress rules pre-configured (169.254.169.254, 168.63.129.16)

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report - OpenSCAP HTML at /etc/lynxroute/cis-report.html
• Tailored CIS profile - /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Generated credentials - /root/wso2mi-credentials.txt, readable only by root

Quick Start

1. Deploy the VM from Azure Marketplace (Standard_D2s_v3 or larger recommended - the image runs two JVM services)
2. SSH: ssh -i key.pem <username>@<PUBLIC_IP> (username set during VM creation, default: azureuser)
3. Read the generated passwords: sudo cat /root/wso2mi-credentials.txt
4. Open the control plane console at https://<PUBLIC_IP>:9446/ and sign in as admin - the runtime is already registered and reporting its artifacts, with no setup
5. Deploy an integration by dropping a Synapse XML file into the hot-deploy directory shown in the credentials file, then call it over TLS on port 8253

The image ships a self-signed certificate, so browsers warn on first visit - install your own certificate before production use, and restrict the network security group so only your network reaches the console and the management API.