[WebServer] Tomcat Configuration Access Restrictions: Access whitelist and access blacklist

Source: Internet
Author: User

Objective:

Yesterday the Tomcat server was configured to run PHP environment, but by observing Tomcat these days logs found that there are many inexplicable IP access to the host under the inexplicable address, such as:/80,/testproxy.php,/cache/global/img/ Gs.gif, CONNECT check.best-proxies.ru:80, and so on, and later by searching these access IP is the address of the port scan, in order to prevent these IP scanning, further ensure the security and stability of the server, you can configure the Tomcat Server.xml restricts access to some IP.

1123.249.27.191--[04/apr/2016:00:18:33 +0800]"Get/80 http/1.0" 404 5762185.25.151.159--[04/apr/2016:00:36:39 +0800]"get/testproxy.php http/1.1" 404 5763172.82.166.210--[04/apr/2016:02:01:49 +0800]"Get/cache/global/img/gs.gif http/1.1" 404 576495.213.187.189--[04/apr/2016:02:03:05 +0800]"CONNECT check.best-proxies.ru:80 http/1.1" 400 -591.196.50.33--[04/apr/2016:03:26:23 +0800]"get/testproxy.php http/1.1" 404 5766123.249.27.193--[04/apr/2016:03:51:22 +0800]"Get/80 http/1.0" 404 5767213.246.45.128--[04/apr/2016:08:11:22 +0800]"Get/cache/global/img/gs.gif http/1.1" 404 576
View Logs

Configuration:

Locate the Conf/server.xml at the root of the TOMCAT server and add a property className to the <Host> node with the value "Org.apache.catalina.valves.RemoteAddrValve" of <Valve> nodes:

 1  <  valve  classname  = "Org.apache.catalina.valves.RemoteAddrValve"   allow  = ""  2  = "123.249.27.19[1-3]|115.239.228.1[4-6]|169.54.233.1 (1[6-9]|2[0-6]) |62.138.2. (209|12 (2|3) |21 (3|4)) |123.151. (149.222|42.61) |61.147. (121.73|103.119|247.85) |115.239.228.202|112.74.206.117 " 3  denystatus  = "403"  />  

Where the Allow attribute can be configured to access the whitelist, the Deny property can be configured to access the blacklist and both support regular expressions. The value of the Deny property in the code above is a regular expression in my server log for the IP address of the port scan, which is very long but simple to write. A list of IP addresses for port scanning is attached here: http://antivirus.neu.edu.cn/scan/list.php

The Denystatus property value of 403 means: When IP access in Deny, 403 of the status code is returned, that is, no access rights.

The modification completes after saving the Server.xml file to restart the server, when the black list of IP again access to see the effect, the returned status code is 403:

123.249.27.192-- [04/apr/2016:21:29:53 +0800] "get/80 http/1.0" 403-

  

This is the end of the configuration, but personally think there should be another way, but did not try, that is, by configuring the Tomcat server only through the domain name access, not allowed through the IP access, is also a way to avoid port scanning, do not know that is right. Attach reference to disable IP access:

1.http://www.iyunv.com/thread-42853-1-1.html

2.http://blog.csdn.net/tangdc88/article/details/17283617

Done.

[WebServer] Tomcat Configuration Access Restrictions: Access whitelist and access blacklist

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.