users@glassfish.java.net

Re: Glassfish gem - restricting access by IP or hostname

From: <glassfish_at_javadesktop.org>
Date: Fri, 09 Oct 2009 13:39:59 PDT

Hi,

I have always found it better to restrict the listeners (http-listener-1 and httper-listener-2) to 127.0.0.1 and let Apache listen on the main incoming IP address and then proxy the appropriate requests across.

As far as I know there is no functionality matching your requirements in glassfish, although you could easily achieve what you want in Apache.

Also, don't forget about the other ports such ad 4848 and the RMI ports. These are all open as well and you will need to decide what address they should be listening to, in development I tend to leave them open on the main IP but in production I restrict all these to 127.0.0.1 and use ssh and X-Forwarding to access the console, etc.

Glassfish is really developer friendly in being like this out of the box, but sometimes I wish it was more restrictive so I don't have to hunt for all the ports that should be blocked or restricted to localhost when I install it.
[Message sent by forum member 'arshadm' (arshadm_at_compuvision.co.uk)]

http://forums.java.net/jive/thread.jspa?messageID=367462