title: Configure Kafka to expose JMX only on 127.0.0.1
body: <p>I'm struggling to configure Kafka's JMX to be exposed only on <code>localhost</code>. By default, when I start Kafka, it exposes three ports, whereas two of them are automatically bound to <code>0.0.0.0</code>, meaning that they're accessible to everyone.</p>
  
  <p>I managed to bind the broker itself to <code>127.0.0.1</code> (because I only need it locally), but the JMX ports are really giving me headaches.</p>
  
  <p>I have to following env vars defined:</p>
  
  <pre><code>export JMX_PORT=${JMX_PORT:-9999}
  export KAFKA_JMX_OPTS="-Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.rmi.port=$JMX_PORT -Dcom.sun.management.jmxremote.port=$JMX_PORT -Dcom.sun.management.jmxremote=true -Djava.rmi.server.hostname=127.0.0.1 -Djava.net.preferIPv4Stack=true"
  </code></pre>
  
  <p>If I now look at the bound ports/ips, I see this:</p>
  
  <pre><code>$ netstat -tulpn | grep 9864
  tcp        0      0 0.0.0.0:9999            0.0.0.0:*               LISTEN      9864/java
  tcp        0      0 0.0.0.0:44895           0.0.0.0:*               LISTEN      9864/java
  tcp        0      0 127.0.0.1:9092          0.0.0.0:*               LISTEN      9864/java
  </code></pre>
  
  <p>meaning that JMX listens on <code>0.0.0.0</code>, and there's even another open port <code>44895</code> which I don't know its purpose.</p>
  
  <p>What I'd like to achieve is that Kafka ports are only opened on <code>127.0.0.1</code>. Can anybody give a hint? Thanks in advance!</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>I was partially successful by adding <code>-Dcom.sun.management.jmxremote.host=localhost</code>, but there's still one open port exposed on <code>0.0.0.0</code>:</p>
  
  <pre><code>$ netstat -tulpn | grep 12789
  tcp        0      0 127.0.0.1:9999          0.0.0.0:*               LISTEN      12789/java
  tcp        0      0 0.0.0.0:43513           0.0.0.0:*               LISTEN      12789/java
  tcp        0      0 127.0.0.1:9092          0.0.0.0:*               LISTEN      12789/java
  </code></pre>