[WebServer] Tomcat Configuration Access Restrictions: Access whitelist and access blacklist

Objective:

Yesterday the Tomcat server was configured to run PHP environment, but by observing Tomcat these days logs found that there are many inexplicable IP access to the host under the inexplicable address, such as:/80,/testproxy.php,/cache/global/img/ Gs.gif, CONNECT check.best-proxies.ru:80, and so on, and later by searching these access IP is the address of the port scan, in order to prevent these IP scanning, further ensure the security and stability of the server, you can configure the Tomcat Server.xml restricts access to some IP.

1123.249.27.191--[04/apr/2016:00:18:33 +0800]"Get/80 http/1.0" 404 5762185.25.151.159--[04/apr/2016:00:36:39 +0800]"get/testproxy.php http/1.1" 404 5763172.82.166.210--[04/apr/2016:02:01:49 +0800]"Get/cache/global/img/gs.gif http/1.1" 404 576495.213.187.189--[04/apr/2016:02:03:05 +0800]"CONNECT check.best-proxies.ru:80 http/1.1" 400 -591.196.50.33--[04/apr/2016:03:26:23 +0800]"get/testproxy.php http/1.1" 404 5766123.249.27.193--[04/apr/2016:03:51:22 +0800]"Get/80 http/1.0" 404 5767213.246.45.128--[04/apr/2016:08:11:22 +0800]"Get/cache/global/img/gs.gif http/1.1" 404 576

View Logs

Configuration:

Locate the Conf/server.xml at the root of the TOMCAT server and add a property className to the <Host> node with the value "Org.apache.catalina.valves.RemoteAddrValve" of <Valve> nodes:

 1  <  valve  classname  = "Org.apache.catalina.valves.RemoteAddrValve"   allow  = ""  2  = "123.249.27.19[1-3]|115.239.228.1[4-6]|169.54.233.1 (1[6-9]|2[0-6]) |62.138.2. (209|12 (2|3) |21 (3|4)) |123.151. (149.222|42.61) |61.147. (121.73|103.119|247.85) |115.239.228.202|112.74.206.117 " 3  denystatus  = "403"  />  

Where the Allow attribute can be configured to access the whitelist, the Deny property can be configured to access the blacklist and both support regular expressions. The value of the Deny property in the code above is a regular expression in my server log for the IP address of the port scan, which is very long but simple to write. A list of IP addresses for port scanning is attached here: http://antivirus.neu.edu.cn/scan/list.php

The Denystatus property value of 403 means: When IP access in Deny, 403 of the status code is returned, that is, no access rights.

The modification completes after saving the Server.xml file to restart the server, when the black list of IP again access to see the effect, the returned status code is 403:

123.249.27.192-- [04/apr/2016:21:29:53 +0800] "get/80 http/1.0" 403-

　　

This is the end of the configuration, but personally think there should be another way, but did not try, that is, by configuring the Tomcat server only through the domain name access, not allowed through the IP access, is also a way to avoid port scanning, do not know that is right. Attach reference to disable IP access:

1.http://www.iyunv.com/thread-42853-1-1.html

2.http://blog.csdn.net/tangdc88/article/details/17283617

Done.

[WebServer] Tomcat Configuration Access Restrictions: Access whitelist and access blacklist