Tomcat6 only allows to specify domain name access, disables IP address access, and prevents malicious parsing

2015.02.27

Suddenly colleague reaction, in Baidu search other domain name, unexpectedly opened and we peer to the same site, my first reaction is the source code was stolen. Later found that the domain name is malicious parsing, resolution 1, prohibit the IP address access to Project 2, only allow the specified domain name access.

Environment: Tomcat 6

Method: Modify the Tomcat 6 configuration file Tomcat/conf/server.xml, implement the principle, the tomcat default parameter Defaulthost point to a non-existent domain name, and add the same virtual directory, so when an unknown domain name resolved, Access to the default virtual directory, but there are no items in this directory, so the effect is achieved.

The following is the number of my profile parameters only posted between Engine Oh ~

<engine name= "Catalina" defaulthost= "192.168.1.1" > <!--default parameters I set my server's extranet IP address--

      <!--for clustering, documentation a look at:
   & nbsp;     /docs/cluster-howto.html  (Simple)
          /docs/config/cluster.html (reference documentation)-->
       <!--
      <cluster classname= " Org.apache.catalina.ha.tcp.SimpleTcpCluster "/>
     -->       

      <!--the request dumper valve dumps useful debugging information about
 & nbsp;         the request and response data received and sent by Tomcat.
           documentation at:/docs/config/valve.html--
      <!--
      <valve classname= " Org.apache.catalina.valves.RequestDumperValve "/>
     -->

      <!--This Realm uses the userdatabase configured in the global JNDI
  & nbsp;        resources under the key "Userdatabase" .  any edits
            that is performed against this userdatabase is immediately
           available for use by the realm. -->
      <realm classname= "Org.apache.catalina.realm.UserDatabaseRealm"
              resourcename= "Userdatabase"/>

      <!--Define The default virtual host
            note:xml Schema validation won't work with Xerces 2.2.
      -->
             Unpackwars = "true" autodeploy= "true"
         xmlvalidation= "false" Xmlnamespaceaware= "false",
      <context path= "" Docbase= "/home/web/ Apache-tomcat-6.0.39/webapps/abc "debug=" 0 "reloadable=" true "/> <!--Specify the project address of the virtual directory-->
          

Unpackwars= "true" autodeploy= "true"
Xmlvalidation= "false" Xmlnamespaceaware= "false" >
</Host>

</Engine>

Tomcat6 only allows to specify domain name access, disables IP address access, and prevents malicious parsing