When you get:

WARNING! POTENTIAL SECURITY RISK. It has been detected that the MessageSucker component which sucks messages from one node to another has not had its password changed from the installation default. Please see the JBoss Messaging user guide for instructions on how to do this.

Just check this out :

$grep “CHANGE ME” /usr/local/jboss/server/default/deploy/messaging/messaging-jboss-beans.xml
<property name=”suckerPassword”>CHANGE ME!!</property>