topic Disabling RMI and firewall issues in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/disabling-rmi-and-firewall-issues/m-p/213972#M167102 <HTML><HEAD></HEAD><BODY><SPAN>Hi</SPAN><BR /><BR /><SPAN>My goal is to set-up alfresco (3.2r) on my box (Ubuntu 9.10) so that's only accessible though https.</SPAN><BR /><SPAN>I don't need nor want FTP, SMB, cifs, RMI etc connectivity.&nbsp; </SPAN><BR /><SPAN>I ftped the archived and unzipped in /opt/alfresco.</SPAN><BR /><BR /><SPAN>My configuration is the following :</SPAN><BR /><SPAN>apache + mod_jk + tomcat.</SPAN><BR /><BR /><SPAN>Apache config</SPAN><BR /><PRE class="language-none line-numbers"><CODE><BR />&lt;VirtualHost *:80&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ServerName <A href="http://www.mysite.com" rel="nofollow noopener noreferrer">www.mysite.com</A><BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DocumentRoot /home/www<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Location /phpmyadmin&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RewriteEngine on<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RewriteCond %{HTTPS} off<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RewriteRule ^(.*)$ <A href="https://www.mysite.com/phpmyadmin" rel="nofollow noopener noreferrer">https://www.mysite.com/phpmyadmin</A> [R]<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/Location&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Location /share&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RewriteEngine on<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RewriteCond %{HTTPS} off<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RewriteRule ^(.*)$ <A href="https://www.mysite.com/share/" rel="nofollow noopener noreferrer">https://www.mysite.com/share/</A> [R]<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/Location&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Location /alfresco&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RewriteEngine on<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RewriteCond %{HTTPS} off<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RewriteRule ^(.*)$ <A href="https://www.mysite.com/alfresco/" rel="nofollow noopener noreferrer">https://www.mysite.com/alfresco/</A> [R]<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/Location&gt;<BR />&lt;/VirtualHost&gt;<BR /><BR />&lt;VirtualHost *:443&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ServerName <A href="http://www.mysite.com" rel="nofollow noopener noreferrer">www.mysite.com</A><BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DocumentRoot /home/www<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SSLEngine on<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP<BR /><BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SSLCertificateFile&nbsp;&nbsp;&nbsp; /etc/apache2/ssl/cert<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SSLCertificateKeyFile /etc/apache2/ssl/key<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SSLCACertificateFile&nbsp; /etc/apache2/ssl/chain<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; JkMount /alfresco worker1<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; JkMount /alfresco/* worker1<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; JkMount /share worker1<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; JkMount /share/* worker1<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SetEnvIf User-Agent ".*MSIE.*" \<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; nokeepalive ssl-unclean-shutdown \<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; downgrade-1.0 force-response-1.0<BR />&lt;/VirtualHost&gt;<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>mod_jk workers.properties</SPAN><BR /><PRE class="language-none line-numbers"><CODE><BR />workers.tomcat_home=/opt/alfresco/tomcat<BR />workers.java_home=/usr/lib/jvm/java-6-sun<BR />ps=/<BR />worker.list=worker1<BR />worker.worker1.port=8009<BR />worker.worker1.host=localhost<BR />worker.worker1.type=ajp13<BR />worker.worker1.lbfactor=1<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>server.xml (hopefully relevant extracts)</SPAN><BR /><PRE class="language-none line-numbers"><CODE><BR />&nbsp;&nbsp;&nbsp; &lt;Connector port="8080" protocol="HTTP/1.1" URIEncoding="UTF-8"<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; connectionTimeout="20000"<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; redirectPort="8443" /&gt;<BR /> &lt;Connector port="8009" protocol="AJP/1.3" redirectPort="8443" /&gt;<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><BR /><BR /><SPAN>Through apache I redirect, on port 80, all requests to alfresco to port 443 where apache uses mod_jk to communicate with tomcat.</SPAN><BR /><SPAN>So far, so good : https works fine.</SPAN><BR /><BR /><SPAN>Now alfresco is available on port 8080 (which I don't want).</SPAN><BR /><SPAN>If in the server.xml file I disable the port 8080 connection (and still use mod_jk) alfresco won't start.</SPAN><BR /><SPAN>So I left it as it is: the site is available on http through port 8080 and on https through the regular port.</SPAN><BR /><SPAN> </SPAN><BR /><SPAN>I thought I could prevent that by disabling accessibility to port 8080 with iptables (rejecting all incoming traffic on port 8080).</SPAN><BR /><SPAN>If the iptables rule is set BEFORE I run the "alfresco.sh start" command, alfresco won't start (it can't acquire the port).</SPAN><BR /><SPAN>If I wait about 80s or so and&nbsp; alfresco is running,&nbsp; I can block port 8080.</SPAN><BR /><BR /><SPAN>I thought I could modify the alfresco.sh script to flush or load iptables, but since alfresco launches the "real" startup scripts (that I do want to break) I am always out of sync.</SPAN><BR /><BR /><SPAN>So here are my (stupid&nbsp; ?) questions :</SPAN><BR /><UL><LI>How do I have alfresco only available through https, coexisting peacefully with apache ?</LI><BR /><LI>I have already managed to disable cifs and ftp (setting ftp/cifs.enabled=false in alfresco-global-properties). What should I do to disable the last rmi connectivity ?</LI><BR /><LI>What would be a smart way to protect ports 8009 and 8100 (ie ajp and ooffice) ?</LI><BR /><LI>How does one configure a firewall with alfresco (sub-question, Am I doing this completly the wrong way??)</LI></UL><SPAN>Thank you,</SPAN><BR /><BR /><SPAN>Georges</SPAN></BODY></HTML> Sat, 20 Feb 2010 16:28:18 GMT georgesm 2010-02-20T16:28:18Z Disabling RMI and firewall issues https://connect.hyland.com/t5/alfresco-archive/disabling-rmi-and-firewall-issues/m-p/213972#M167102 HiMy goal is to set-up alfresco (3.2r) on my box (Ubuntu 9.10) so that's only accessible though https.I don't need nor want FTP, SMB, cifs, RMI etc connectivity.&nbsp; I ftped the archived and unzipped in /opt/alfresco.My configuration is the following :apache + mod_jk + tomcat.Apache config&lt;VirtualHo Sat, 20 Feb 2010 16:28:18 GMT https://connect.hyland.com/t5/alfresco-archive/disabling-rmi-and-firewall-issues/m-p/213972#M167102 georgesm 2010-02-20T16:28:18Z Re: Disabling RMI and firewall issues https://connect.hyland.com/t5/alfresco-archive/disabling-rmi-and-firewall-issues/m-p/213973#M167103 <HTML><HEAD></HEAD><BODY><SPAN>I am looking for the same thing.</SPAN><BR /><BR /><SPAN>A related thread doesn't discuss this either (</SPAN><A href="http://forums.alfresco.com/en/viewtopic.php?f=9&amp;t=8965" rel="nofollow noopener noreferrer">http://forums.alfresco.com/en/viewtopic.php?f=9&amp;t=8965</A><SPAN>). One poster says Explorer and Share are both working, but I think that 8080 is still open for this.</SPAN><BR /><BR /><SPAN>I can disable 8080 access via my external access firewall, but I would like to have internal folks only use 8443 also.</SPAN></BODY></HTML> Tue, 09 Mar 2010 14:53:14 GMT https://connect.hyland.com/t5/alfresco-archive/disabling-rmi-and-firewall-issues/m-p/213973#M167103 dangruhn 2010-03-09T14:53:14Z