Disabling RMI and firewall issues

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

georgesm

Hi

My goal is to set-up alfresco (3.2r) on my box (Ubuntu 9.10) so that's only accessible though https.
I don't need nor want FTP, SMB, cifs, RMI etc connectivity. 
I ftped the archived and unzipped in /opt/alfresco.

My configuration is the following :
apache + mod_jk + tomcat.

Apache config

<VirtualHost *:80>
        ServerName www.mysite.com
        DocumentRoot /home/www
        <Location /phpmyadmin>
                RewriteEngine on
                RewriteCond %{HTTPS} off
        RewriteRule ^(.*)$ https://www.mysite.com/phpmyadmin [R]
        </Location>
        <Location /share>
                RewriteEngine on
                RewriteCond %{HTTPS} off
                RewriteRule ^(.*)$ https://www.mysite.com/share/ [R]
        </Location>
        <Location /alfresco>
                RewriteEngine on
                RewriteCond %{HTTPS} off
                RewriteRule ^(.*)$ https://www.mysite.com/alfresco/ [R]
        </Location>
</VirtualHost>

<VirtualHost *:443>
        ServerName www.mysite.com
        DocumentRoot /home/www
        SSLEngine on
        SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP

        SSLCertificateFile    /etc/apache2/ssl/cert
        SSLCertificateKeyFile /etc/apache2/ssl/key
        SSLCACertificateFile  /etc/apache2/ssl/chain
        JkMount /alfresco worker1
        JkMount /alfresco/* worker1
        JkMount /share worker1
        JkMount /share/* worker1
        SetEnvIf User-Agent ".*MSIE.*" \
                         nokeepalive ssl-unclean-shutdown \
                         downgrade-1.0 force-response-1.0
</VirtualHost>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

mod_jk workers.properties

workers.tomcat_home=/opt/alfresco/tomcat
workers.java_home=/usr/lib/jvm/java-6-sun
ps=/
worker.list=worker1
worker.worker1.port=8009
worker.worker1.host=localhost
worker.worker1.type=ajp13
worker.worker1.lbfactor=1
‍‍‍‍‍‍‍‍‍‍

server.xml (hopefully relevant extracts)

    <Connector port="8080" protocol="HTTP/1.1" URIEncoding="UTF-8"
       connectionTimeout="20000"
       redirectPort="8443" />
 <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
‍‍‍‍‍‍

Through apache I redirect, on port 80, all requests to alfresco to port 443 where apache uses mod_jk to communicate with tomcat.
So far, so good : https works fine.

Now alfresco is available on port 8080 (which I don't want).
If in the server.xml file I disable the port 8080 connection (and still use mod_jk) alfresco won't start.
So I left it as it is: the site is available on http through port 8080 and on https through the regular port.

I thought I could prevent that by disabling accessibility to port 8080 with iptables (rejecting all incoming traffic on port 8080).
If the iptables rule is set BEFORE I run the "alfresco.sh start" command, alfresco won't start (it can't acquire the port).
If I wait about 80s or so and  alfresco is running,  I can block port 8080.

I thought I could modify the alfresco.sh script to flush or load iptables, but since alfresco launches the "real" startup scripts (that I do want to break) I am always out of sync.

So here are my (stupid  ?) questions :

• How do I have alfresco only available through https, coexisting peacefully with apache ?
• I have already managed to disable cifs and ftp (setting ftp/cifs.enabled=false in alfresco-global-properties). What should I do to disable the last rmi connectivity ?
• What would be a smart way to protect ports 8009 and 8100 (ie ajp and ooffice) ?
• How does one configure a firewall with alfresco (sub-question, Am I doing this completly the wrong way??)

Thank you,

Georges

dangruhn

I am looking for the same thing.

A related thread doesn't discuss this either (http://forums.alfresco.com/en/viewtopic.php?f=9&t=8965). One poster says Explorer and Share are both working, but I think that 8080 is still open for this.

I can disable 8080 access via my external access firewall, but I would like to have internal folks only use 8443 also.