Bloody hell, that is an instant, trust destroying, security cock-up. You can set JBoss to bind to a separate IP address (i.e. one not publicly accessible etc.)

Bloody hell, that is an instant, trust destroying, security cock-up. You can set JBoss to bind to a separate IP address (i.e. one not publicly accessible etc.) for all management functions, it is a simple configuration change.