PLEASE READ: Important Message Regarding Security

nancyg — Fri, 23 Jul 2010 13:54:14 GMT

All-Thanks to Jeff Potts at Metaversant ( http://www.metaversant.com), Alfresco has become aware of a potential security loophole where the jBPM process deployer servlet runs without authentication. This means that a valid user may deploy a workflow that grants them admin access or similar. However,

Re: PLEASE READ: Important Message Regarding Security

heydenb — Wed, 04 Aug 2010 12:28:23 GMT

Another way to solve this security loophole is via an Apache HTTP server in front of the Alfresco installation (Tomcat).

    <Location "/alfresco/jbpm/deployprocess" >
        Deny from all
    </Location>

I always install and configure a separate Apache server which connects to Alfresco on tomcat via mod_proxy_ajp (binary protocol). Normally I even disable the HTTP connector on port 8080. And I also configure Apache to serve the static files using Aliasses on the static directories.

    ProxyPass /alfresco/images !
    ProxyPass /alfresco/css !
    ProxyPass /alfresco/scripts !
    ProxyPass /alfresco/swf !
    ProxyPass /alfresco/yui !
    ProxyPass /alfresco ajp://localhost:8009/alfresco
    ProxyPassReverse /alfresco ajp://localhost:8009/alfresco

    Alias /alfresco/images "/opt/alfresco/tomcat/webapps/alfresco/images"
    Alias /alfresco/css "/opt/alfresco/tomcat/webapps/alfresco/css"
    Alias /alfresco/scripts "/opt/alfresco/webapps/alfresco/scripts"
    Alias /alfresco/swf "/opt/alfresco/webapps/alfresco/swf"
    Alias /alfresco/yui "/opt/alfresco/webapps/alfresco/yui"

Advantages:
- Tomcat does not have to serve static files. Apache does that a lot better and faster
- Use port 80 by default
- Using a rewrite rule, I can add /alfresco automatically.
- A lot more secure to offer your end users an Apache interface and keep the Tomcat interface including the management console separate. Only open port 80 (and 443) in the firewall.
- Very easy to implement SSL on Apache
…

In short, just use a Web Server for what it's built and use the Application Server to serve the application, and nothing more.

Implementing this security fix took me only one minute and no restart of Alfresco was required. Even more, the Alfresco war is still original.

topic PLEASE READ: Important Message Regarding Security in Alfresco Archive

PLEASE READ: Important Message Regarding Security

Re: PLEASE READ: Important Message Regarding Security