Secure Glassfish v3 Admin Console
By default, the admin console can be accessed by the outside world. I prefer to have it accessible to localhost only (so I can ssh tunnel it only).
Open the admin console, and on the menu, Configuration -> Network Config -> Network Listeners -> admin-listener, and edit the IP to state 127.0.0.1, hit save, then restart Glassfish.