You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Mark Murphy <jm...@gmail.com> on 2014/04/16 19:42:00 UTC
Configuration question
How do I prevent Tomcat 6 from responding to a request to an IP address,
that is I only want my Tomcat server to respond to requests to
www.mydomain.com vs. 10.1.1.1.
Is this possible?
The problem is that our web security scanner is reporting "Web Server Uses
Basic Authentication Without HTTPS", and the infrastructure guys think it
is because Tomcat allows connection to the IP address.
Does this make sense?
Re: Configuration question
Posted by Daniel Mikusa <dm...@gopivotal.com>.
On Apr 16, 2014, at 1:42 PM, Mark Murphy <jm...@gmail.com> wrote:
> How do I prevent Tomcat 6 from responding to a request to an IP address,
> that is I only want my Tomcat server to respond to requests to
> www.mydomain.com vs. 10.1.1.1.
Just an idea, but you could probably do this with a filter or a valve. You could try looking at request.getServerName() (or just the host header) and using that to approve or deny the request.
Tomcat has a valve that you can sub class to make this easier (if you go with a valve).
http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/catalina/valves/RequestFilterValve.java?view=markup
an example of this is the RemoteHostValve.
http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/catalina/valves/RemoteHostValve.java?view=markup
>
> Is this possible?
>
> The problem is that our web security scanner is reporting "Web Server Uses
> Basic Authentication Without HTTPS”,
Is basic auth enabled (look through your application’s web.xml files for "auth-method” set to “BASIC”)? If so, is disabling it an option? If not, you should look at setting a "transport-guarantee” of “CONFIDENTIAL” in web.xml so that the application will redirect to HTTPS (or worst case use a filter like the UrlRewriteFilter to force HTTPS).
> and the infrastructure guys think it is because Tomcat allows connection to the IP address.
I not sure how this is expected to help. I suppose if the scanner was sending requests using the IP address and not the host, you could filter and block those requests. That might trick the scanner into thinking the server is not accepting basic authentication. I’m not sure how it would address the issue mentioned by the scanner though (assuming the scanner is not at fault here).
Dan
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Configuration question
Posted by "Terence M. Bandoian" <te...@tmbsw.com>.
On 4/17/2014 9:01 AM, Mark Murphy wrote:
> Here is the configuration, as you can see the default host is set and the
> IP is not aliased.
>
> in server.xml
> ...
> <Connector port="80" protocol="HTTP/1.1"
> connectionTimeout="20000"
> redirectPort="443" />
> ...
> <Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
> port="443"
> scheme="https" secure="true" SSLEnabled="true"
> keystoreFile="xxxxxxx.keystore"
> keystorePass="xxxxxxx" keyAlias="xxxxxxx"
> clientAuth="false" sslProtocol="TLS" />
> ...
> <Engine name="Catalina" defaultHost="www.torquewrenchrecalibration.com">
> ...
> <Host name="www.torquewrenchrecalibration.com" appBase="webapps"
> unpackWARs="true" autoDeploy="false"
> xmlValidation="false" xmlNamespaceAware="false">
> <Alias>www.torque-wrench-recalibration.com</Alias>
> <Alias>www.myerstorquetracker.com</Alias>
> </Host>
> ...
>
> in web.xml
> ...
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>Entire App</web-resource-name>
> <url-pattern>/*</url-pattern>
> </web-resource-collection>
> <user-data-constraint>
> <transport-guarantee>CONFIDENTIAL</transport-guarantee>
> </user-data-constraint>
> </security-constraint>
> ...
>
>
>
> On Thu, Apr 17, 2014 at 9:42 AM, Jeffrey Janner <Jeffrey.Janner@polydyne.com
>> wrote:
>>> -----Original Message-----
>>> From: Mark Murphy [mailto:jmarkmurphy@gmail.com]
>>> Sent: Wednesday, April 16, 2014 12:42 PM
>>> To: Tomcat Users List
>>> Subject: Configuration question
>>>
>>> How do I prevent Tomcat 6 from responding to a request to an IP
>>> address, that is I only want my Tomcat server to respond to requests to
>>> www.mydomain.com vs. 10.1.1.1.
>>>
>>> Is this possible?
>>>
>> To address the question asked:
>> The easiest way may be to create a dummy <Host> entry with an <Alias>
>> entry for the IP Address. Do not allocate any contexts to the host, or
>> perhaps one that points to an empty directory. Haven't tested it, just a
>> thought.
>> However read rest of answer.
>>
>>> The problem is that our web security scanner is reporting "Web Server
>>> Uses Basic Authentication Without HTTPS", and the infrastructure guys
>>> think it is because Tomcat allows connection to the IP address.
>>>
>>> Does this make sense?
>> No this does not make sense. If the IP isn't returning HTTPS, then your
>> DNS name probably isn't either. Tomcat doesn't care about the supplied
>> name, except to match it to the <Host> entry in server.xml. You didn't
>> post your config, but I'm assuming that the default host is set to
>> www.mydomain.com, and the IP address isn't aliased. If it is not that
>> way, you should either correctly set your default host, or add an <Alias>
>> entry for the IP address to you <Host> config.
>>
>> You'd definitely get this response if your default host was still set at
>> the default of "localhost", instead of your <Host> entry's name value,
>> there was no <Alias> entry for the IP, and the security tester was testing
>> against IP as well as name (though one would expect the report to indicate
>> this).
Is the manager app deployed?
-Terence Bandoian
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Configuration question
Posted by Jeffrey Janner <Je...@PolyDyne.com>.
> -----Original Message-----
> From: Mark Murphy [mailto:jmarkmurphy@gmail.com]
> Sent: Thursday, April 17, 2014 9:01 AM
> To: Tomcat Users List
> Subject: Re: Configuration question
>
> Here is the configuration, as you can see the default host is set and
> the IP is not aliased.
>
> in server.xml
> ...
> <Connector port="80" protocol="HTTP/1.1"
> connectionTimeout="20000"
> redirectPort="443" />
> ...
> <Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
> port="443"
> scheme="https" secure="true" SSLEnabled="true"
> keystoreFile="xxxxxxx.keystore"
> keystorePass="xxxxxxx" keyAlias="xxxxxxx"
> clientAuth="false" sslProtocol="TLS" /> ...
> <Engine name="Catalina"
> defaultHost="www.torquewrenchrecalibration.com">
> ...
> <Host name="www.torquewrenchrecalibration.com" appBase="webapps"
> unpackWARs="true" autoDeploy="false"
> xmlValidation="false" xmlNamespaceAware="false">
> <Alias>www.torque-wrench-recalibration.com</Alias>
> <Alias>www.myerstorquetracker.com</Alias>
> </Host>
> ...
>
> in web.xml
> ...
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>Entire App</web-resource-name>
> <url-pattern>/*</url-pattern>
> </web-resource-collection>
> <user-data-constraint>
> <transport-guarantee>CONFIDENTIAL</transport-guarantee>
> </user-data-constraint>
> </security-constraint>
> ...
>
>
>
Well, with that configuration, any traffic sent to your IP address will be directed to your default host, i.e. your app, so that settles the question about the IP or DNS name generating the "error" on the WSS. Both should return the same result. So, either the WSS doesn't know what it's talking about, or you're not getting the message because of the connection to your login page. I don't see any reference to any Tomcat-initiated authentication defined here, so perhaps it’s a problem with the WSS, or as Terrence pointed out, do you have the "manager" app deployed? By default, it uses Basic Auth and non-SSL. You might need to spruce up the security on it a bit.
Jeff
Re: [OT] Configuration question
Posted by Mark Murphy <jm...@gmail.com>.
No frameworks, no standard configurations, it is so bad that the only way
to deploy changes is to manually find the file that needs replacing, and
replace it. I can't even use a war file to deploy. If I was in charge, I
would probably rewrite even if it was still Java, though I might be able to
keep some of the components.
On Thu, Apr 17, 2014 at 11:44 AM, Christopher Schultz <
chris@christopherschultz.net> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Mark,
>
> On 4/17/14, 11:01 AM, Mark Murphy wrote:
> > Yes, I inherited this mess part time when the original developer
> > left, and am trying to keep it alive, and fix problems as they
> > arise. There are a lot of issues, some cosmetic, and others not so
> > much. The current staff is planning to rewrite using an environment
> > that they are more familiar with, probably .NET. In the meantime I
> > need to keep this thing on life support.
>
> Ugh, that's too bad. I've seen that kind of thing happen many times: a
> new group comes in and re-writes everything, rather than getting a
> group of people who can do a better job with what they've got.
>
> It doesn't matter to me that Java is being abandoned for .NET -- .NET
> is a great environment as I understand -- but the fact that a whole
> lot of work is being trashed just seems like a waste.
>
> Then again, if the pages are that bad, perhaps the code is just as awful.
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIcBAEBCAAGBQJTT/bxAAoJEBzwKT+lPKRYwesP/izl1jMic5+HMr9zv3TVoPCq
> NAoAyGtJWA3trXte3M6y2ap5plBec/HEFVTyVQO1a5cJxd2aEBy3X5oEg5FQgDCx
> EmPB+pi4JWcEH/UGJwQBiRtzyu6mrJJZPzPNm60J2ipBUCaII+iVKoU49it5iwBL
> a2BRus1xR1SvBHm9svEOPDqwebCnLFhzdUn1+HMUmR3B9aMM4Dt6vtnR8ugATUhB
> HBfOcX0ulHhKC5eAsD2E0UYxp/Ys2uA93gVoX/LSTza/i3vKJrjlEMNer6Ep6AbN
> 6UCvnjQF80b4+MK2ssLrcqpKbm1R+d5jt0YnO20xcV63zwP+UqwfYjtRn/srIodW
> 1SZa3mZFEGFKlVxkPpsBFYFu5KJa/FY4T4WGNdIXTYkS5MplROFtJr/p8yP/gglb
> MqOLfLoEhp6jHZpZF2YsbchYfe9yPbFJj/SMxUwO8SAKUqwEUXae8q9bg6cB0HWX
> Be5q8pq1bOqxnAnOltZ0nN9BWT1fTwfXpDq628a0VTa9M0WVsCD93GKuJ6JOmqhi
> XeiSpUq5GFOCx71IlOISeia0CinIq3FF6R8SSGPBm9uKvGrXYzErmXzsxB5JYyVZ
> FqmRhy6aMww5cjPlzOcAoZPsHIb49yTpAemLg4bV7ymveu6FlEyrSKqKbhnHgpLg
> jR1JHs5U9nCukAbk2e4t
> =1HT+
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: [OT] Configuration question
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Mark,
On 4/17/14, 11:01 AM, Mark Murphy wrote:
> Yes, I inherited this mess part time when the original developer
> left, and am trying to keep it alive, and fix problems as they
> arise. There are a lot of issues, some cosmetic, and others not so
> much. The current staff is planning to rewrite using an environment
> that they are more familiar with, probably .NET. In the meantime I
> need to keep this thing on life support.
Ugh, that's too bad. I've seen that kind of thing happen many times: a
new group comes in and re-writes everything, rather than getting a
group of people who can do a better job with what they've got.
It doesn't matter to me that Java is being abandoned for .NET -- .NET
is a great environment as I understand -- but the fact that a whole
lot of work is being trashed just seems like a waste.
Then again, if the pages are that bad, perhaps the code is just as awful.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJTT/bxAAoJEBzwKT+lPKRYwesP/izl1jMic5+HMr9zv3TVoPCq
NAoAyGtJWA3trXte3M6y2ap5plBec/HEFVTyVQO1a5cJxd2aEBy3X5oEg5FQgDCx
EmPB+pi4JWcEH/UGJwQBiRtzyu6mrJJZPzPNm60J2ipBUCaII+iVKoU49it5iwBL
a2BRus1xR1SvBHm9svEOPDqwebCnLFhzdUn1+HMUmR3B9aMM4Dt6vtnR8ugATUhB
HBfOcX0ulHhKC5eAsD2E0UYxp/Ys2uA93gVoX/LSTza/i3vKJrjlEMNer6Ep6AbN
6UCvnjQF80b4+MK2ssLrcqpKbm1R+d5jt0YnO20xcV63zwP+UqwfYjtRn/srIodW
1SZa3mZFEGFKlVxkPpsBFYFu5KJa/FY4T4WGNdIXTYkS5MplROFtJr/p8yP/gglb
MqOLfLoEhp6jHZpZF2YsbchYfe9yPbFJj/SMxUwO8SAKUqwEUXae8q9bg6cB0HWX
Be5q8pq1bOqxnAnOltZ0nN9BWT1fTwfXpDq628a0VTa9M0WVsCD93GKuJ6JOmqhi
XeiSpUq5GFOCx71IlOISeia0CinIq3FF6R8SSGPBm9uKvGrXYzErmXzsxB5JYyVZ
FqmRhy6aMww5cjPlzOcAoZPsHIb49yTpAemLg4bV7ymveu6FlEyrSKqKbhnHgpLg
jR1JHs5U9nCukAbk2e4t
=1HT+
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [OT] Configuration question
Posted by Mark Murphy <jm...@gmail.com>.
Yes, I inherited this mess part time when the original developer left, and
am trying to keep it alive, and fix problems as they arise. There are a lot
of issues, some cosmetic, and others not so much. The current staff is
planning to rewrite using an environment that they are more familiar with,
probably .NET. In the meantime I need to keep this thing on life support.
On Thu, Apr 17, 2014 at 10:40 AM, Christopher Schultz <
chris@christopherschultz.net> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Mark,
>
> On 4/17/14, 10:01 AM, Mark Murphy wrote:
> > Here is the configuration, as you can see the default host is set
> > and the IP is not aliased.
> >
> > in server.xml ... <Connector port="80" protocol="HTTP/1.1"
> > connectionTimeout="20000" redirectPort="443" /> ... <Connector
> > protocol="org.apache.coyote.http11.Http11NioProtocol" port="443"
> > scheme="https" secure="true" SSLEnabled="true"
> > keystoreFile="xxxxxxx.keystore" keystorePass="xxxxxxx"
> > keyAlias="xxxxxxx" clientAuth="false" sslProtocol="TLS" /> ...
> > <Engine name="Catalina"
> > defaultHost="www.torquewrenchrecalibration.com"> ... <Host
> > name="www.torquewrenchrecalibration.com" appBase="webapps"
>
>
> Just for the heck of it, I visited this site. The markup there is
> horrendous. It's not well-formed, does not conform to the HTML spec,
> and has a bunch of totally superfluous Javascript.
>
> Did your security vendor complain that the server responds with
> "Server: Apache-Coyote/1.1"? They often do, even though it makes no
> difference whatsoever IMHO.
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIcBAEBCAAGBQJTT+fyAAoJEBzwKT+lPKRY6qsP/RfClbLB57VT7G5eyDaCeMQI
> WeuTRi1du39GP3C1zSgqy7iz2ifgM740znKLi7hFkOSAA/Sb0G3iN2gPg/IX7uku
> ItGNi0GRYa+k6NqXuwxegGGdUSvMqD2dkmohutJMAC+ANXtOXELO29GLYT5dJk+V
> ROH3f0wci73t1jMgf/zuhWiHLyB32jlC2tHXRLhnD+yofMWS3iz4/5pcRk7JRm9f
> NjdndQK/mV15P2ZrFMBRaK29bd591VtWZIvCvXnp3RzYesjfDAEqnp6kGZrq+zBe
> sbWhigh7Lz1d0O7vjGMc2PMqq+uLckxfNRRcbsmve9qfezNgwLxGh20AiK57Bda3
> 3X5RUlGUh6KgkRuXqFa0BOzsEt3GcpyFDGoTWDwszA5P2l2mkx+n2cq1fGTEk69k
> kZjC9i2CbeZ4Bj1gTVGpMP/lpB0QH/TNVVhaaqt19RrFWWrknzVOjcrDvbfDL/du
> KYTAfMWJvezdXErLULddczDZ+Yk9hHfllNHg2+DEtmT7Q2DSEf8gYLn1lDgw3Hha
> PfirjJAVIQ+i4vpa7zFrDuzvtX33KnEfDx+6Jtif+4XbHBqhD7dPUsW0Vzvcl9o2
> 6SEcvxscqgiWTRYTJZ/jZ7GGY3MdJknYzMJolZ4Jx8qqWMxSYT0M3Xg7H+6+gEvf
> uW/+8ke4TsnxZPwWGqkT
> =jhbr
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: [OT] Configuration question
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Mark,
On 4/17/14, 10:01 AM, Mark Murphy wrote:
> Here is the configuration, as you can see the default host is set
> and the IP is not aliased.
>
> in server.xml ... <Connector port="80" protocol="HTTP/1.1"
> connectionTimeout="20000" redirectPort="443" /> ... <Connector
> protocol="org.apache.coyote.http11.Http11NioProtocol" port="443"
> scheme="https" secure="true" SSLEnabled="true"
> keystoreFile="xxxxxxx.keystore" keystorePass="xxxxxxx"
> keyAlias="xxxxxxx" clientAuth="false" sslProtocol="TLS" /> ...
> <Engine name="Catalina"
> defaultHost="www.torquewrenchrecalibration.com"> ... <Host
> name="www.torquewrenchrecalibration.com" appBase="webapps"
Just for the heck of it, I visited this site. The markup there is
horrendous. It's not well-formed, does not conform to the HTML spec,
and has a bunch of totally superfluous Javascript.
Did your security vendor complain that the server responds with
"Server: Apache-Coyote/1.1"? They often do, even though it makes no
difference whatsoever IMHO.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJTT+fyAAoJEBzwKT+lPKRY6qsP/RfClbLB57VT7G5eyDaCeMQI
WeuTRi1du39GP3C1zSgqy7iz2ifgM740znKLi7hFkOSAA/Sb0G3iN2gPg/IX7uku
ItGNi0GRYa+k6NqXuwxegGGdUSvMqD2dkmohutJMAC+ANXtOXELO29GLYT5dJk+V
ROH3f0wci73t1jMgf/zuhWiHLyB32jlC2tHXRLhnD+yofMWS3iz4/5pcRk7JRm9f
NjdndQK/mV15P2ZrFMBRaK29bd591VtWZIvCvXnp3RzYesjfDAEqnp6kGZrq+zBe
sbWhigh7Lz1d0O7vjGMc2PMqq+uLckxfNRRcbsmve9qfezNgwLxGh20AiK57Bda3
3X5RUlGUh6KgkRuXqFa0BOzsEt3GcpyFDGoTWDwszA5P2l2mkx+n2cq1fGTEk69k
kZjC9i2CbeZ4Bj1gTVGpMP/lpB0QH/TNVVhaaqt19RrFWWrknzVOjcrDvbfDL/du
KYTAfMWJvezdXErLULddczDZ+Yk9hHfllNHg2+DEtmT7Q2DSEf8gYLn1lDgw3Hha
PfirjJAVIQ+i4vpa7zFrDuzvtX33KnEfDx+6Jtif+4XbHBqhD7dPUsW0Vzvcl9o2
6SEcvxscqgiWTRYTJZ/jZ7GGY3MdJknYzMJolZ4Jx8qqWMxSYT0M3Xg7H+6+gEvf
uW/+8ke4TsnxZPwWGqkT
=jhbr
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Configuration question
Posted by Mark Murphy <jm...@gmail.com>.
Here is the configuration, as you can see the default host is set and the
IP is not aliased.
in server.xml
...
<Connector port="80" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="443" />
...
<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
port="443"
scheme="https" secure="true" SSLEnabled="true"
keystoreFile="xxxxxxx.keystore"
keystorePass="xxxxxxx" keyAlias="xxxxxxx"
clientAuth="false" sslProtocol="TLS" />
...
<Engine name="Catalina" defaultHost="www.torquewrenchrecalibration.com">
...
<Host name="www.torquewrenchrecalibration.com" appBase="webapps"
unpackWARs="true" autoDeploy="false"
xmlValidation="false" xmlNamespaceAware="false">
<Alias>www.torque-wrench-recalibration.com</Alias>
<Alias>www.myerstorquetracker.com</Alias>
</Host>
...
in web.xml
...
<security-constraint>
<web-resource-collection>
<web-resource-name>Entire App</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
...
On Thu, Apr 17, 2014 at 9:42 AM, Jeffrey Janner <Jeffrey.Janner@polydyne.com
> wrote:
> > -----Original Message-----
> > From: Mark Murphy [mailto:jmarkmurphy@gmail.com]
> > Sent: Wednesday, April 16, 2014 12:42 PM
> > To: Tomcat Users List
> > Subject: Configuration question
> >
> > How do I prevent Tomcat 6 from responding to a request to an IP
> > address, that is I only want my Tomcat server to respond to requests to
> > www.mydomain.com vs. 10.1.1.1.
> >
> > Is this possible?
> >
> To address the question asked:
> The easiest way may be to create a dummy <Host> entry with an <Alias>
> entry for the IP Address. Do not allocate any contexts to the host, or
> perhaps one that points to an empty directory. Haven't tested it, just a
> thought.
> However read rest of answer.
>
> > The problem is that our web security scanner is reporting "Web Server
> > Uses Basic Authentication Without HTTPS", and the infrastructure guys
> > think it is because Tomcat allows connection to the IP address.
> >
> > Does this make sense?
> No this does not make sense. If the IP isn't returning HTTPS, then your
> DNS name probably isn't either. Tomcat doesn't care about the supplied
> name, except to match it to the <Host> entry in server.xml. You didn't
> post your config, but I'm assuming that the default host is set to
> www.mydomain.com, and the IP address isn't aliased. If it is not that
> way, you should either correctly set your default host, or add an <Alias>
> entry for the IP address to you <Host> config.
>
> You'd definitely get this response if your default host was still set at
> the default of "localhost", instead of your <Host> entry's name value,
> there was no <Alias> entry for the IP, and the security tester was testing
> against IP as well as name (though one would expect the report to indicate
> this).
>
RE: Configuration question
Posted by Jeffrey Janner <Je...@PolyDyne.com>.
> -----Original Message-----
> From: Mark Murphy [mailto:jmarkmurphy@gmail.com]
> Sent: Wednesday, April 16, 2014 12:42 PM
> To: Tomcat Users List
> Subject: Configuration question
>
> How do I prevent Tomcat 6 from responding to a request to an IP
> address, that is I only want my Tomcat server to respond to requests to
> www.mydomain.com vs. 10.1.1.1.
>
> Is this possible?
>
To address the question asked:
The easiest way may be to create a dummy <Host> entry with an <Alias> entry for the IP Address. Do not allocate any contexts to the host, or perhaps one that points to an empty directory. Haven't tested it, just a thought.
However read rest of answer.
> The problem is that our web security scanner is reporting "Web Server
> Uses Basic Authentication Without HTTPS", and the infrastructure guys
> think it is because Tomcat allows connection to the IP address.
>
> Does this make sense?
No this does not make sense. If the IP isn't returning HTTPS, then your DNS name probably isn't either. Tomcat doesn't care about the supplied name, except to match it to the <Host> entry in server.xml. You didn't post your config, but I'm assuming that the default host is set to www.mydomain.com, and the IP address isn't aliased. If it is not that way, you should either correctly set your default host, or add an <Alias> entry for the IP address to you <Host> config.
You'd definitely get this response if your default host was still set at the default of "localhost", instead of your <Host> entry's name value, there was no <Alias> entry for the IP, and the security tester was testing against IP as well as name (though one would expect the report to indicate this).