reliable and secure circabccirca-support.eu/docs/maintain a reliable and secure... ·...
TRANSCRIPT
![Page 1: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/1.jpg)
circa-support.eucirca-support.euReliable and secure CIRCABC
nidbs CIRCABCConference
23.04.2010Jan Büren
![Page 2: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/2.jpg)
circa-support.euTactical Overview, Sir!
✔ CIRCABC architecture
✔ Network analysis
✔ Management pitfalls
✔ Recommendations
✔ Optional Stuff
![Page 3: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/3.jpg)
circa-support.euSimplify it: components
Alfresco 3 Stable community
CIRCABC 3.2
![Page 4: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/4.jpg)
circa-support.euStill simple: deliver pretty pages
Browser
Alfresco 3 Stable community
CIRCABC 3.2
http
TOMCAT
FILESDATA-BASE
![Page 5: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/5.jpg)
circa-support.eu
Alfresco 3 Stable community
CIRCABC 3.2
TOMCAT
All Gaul is occupied by romans http
http
Browser
CIFSCIFS
FTPFTP
![Page 6: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/6.jpg)
circa-support.euexternal port scan
FTPFTPCIFSCIFS
RMIRMIHTTPHTTP
![Page 7: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/7.jpg)
circa-support.euHow hard do they knock?
CIFS-Interface:CIFS-Interface:10 seconds 10 seconds 11 unsuccessful logins11 unsuccessful logins
![Page 8: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/8.jpg)
circa-support.euThey knock with dictionaries!
User does not exist, billgates
User does not exist, Administrador'
User does not exist, serveur ftp
User does not exist, box1
User does not exist, Administrada
User does not exist, Administrateur
User does not exist, DiVX
![Page 9: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/9.jpg)
circa-support.euThe knock with force!
350202 login attempts350202 login attempts
Installation: 20.3.2009First attack: 26.4.2009Last attack: 01.2.2010
![Page 10: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/10.jpg)
circa-support.euTomcat on / off – internal ports
![Page 11: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/11.jpg)
circa-support.eu(RMI?) + (RTFM!) == JMX
JMX: Java Management Extensions
jmx:rmi:localhost:50500
![Page 12: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/12.jpg)
circa-support.euSpeak friend and Enter
ControlRulechange_asap
![Page 13: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/13.jpg)
circa-support.eu
JMX tools can (...)stop, re-configure andrestart subsystems without shutting down Alfresco.
Alfresco 3.2 JMX monitoring
CIFS enabled true
![Page 14: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/14.jpg)
circa-support.euLuckily, I couldn't make it ...
http://jared.ottleys.net/alfresco/tunneling-debug-and-jmx-for-alfresco
![Page 15: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/15.jpg)
circa-support.euMore default (http) entry points
✔ JBOSS Administration
✔ Tomcat Administration
✔ Hidden admin URLs
![Page 16: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/16.jpg)
circa-support.euSimple advice: just pretty pages
● Disable CIFS / FTP
● Disable Tomcat Admin
● Bind services on localhost
● Change default passwords
Alfresco 3 Stable community
CIRCABC 3.2
TOMCAThttp
Browser
![Page 17: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/17.jpg)
circa-support.euadvanced advice: proxy it!
Alfresco 3 Stable community
CIRCABC 3.2
TOMCAT
Http 8180
Browser
Reverseproxy
https 443
CIFSFTPJMX
![Page 18: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/18.jpg)
circa-support.euCombine simple and advanced
Alfresco 3 Stable community
CIRCABC 3.2
TOMCAT
Http 8180
Browser
Reverseproxy
https 443
![Page 19: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/19.jpg)
circa-support.eudon't do what they told ya!
Please use your distribution´s package:
![Page 20: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/20.jpg)
circa-support.euThings I didn`t manage ...
● Disabling JMX● Bind JMX __ONLY__ localhost● Use jconsole with CIRCABC
… if you can, write to: [email protected]
![Page 21: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/21.jpg)
circa-support.eu
Quotations were taken from:
● Rage against the machine● Lord of the Rings
Legal issues
Pretty Pictures from:
● freebsd-image-gallery.netcode.pl● kendgame.bridigum.com
![Page 22: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/22.jpg)
circa-support.eu
Alfresco 3 Stable community
CIRCABC 3.2
TOMCAT
CONTENTFILESDATA-
BASE
Backup considerations
HIBERNATE LUCENE
INDEXFILES
![Page 23: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/23.jpg)
circa-support.euCold backup
● STOP CIRCABC
● DATABASE DUMP
● BACKUP FILES AND DUMPS
● START CIRCABC
![Page 24: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/24.jpg)
circa-support.euHot backup
● DATABASE DUMP
● BACKUP FILES (EXCEPT LUCENE-INDEXES!) AND DUMPS
![Page 25: Reliable and secure CIRCABCcirca-support.eu/docs/Maintain a reliable and secure... · 2010-08-26 · circa-support.eu Alfresco 3 Stable community CIRCABC 3.2 TOMCAT All Gaul is occupied](https://reader034.vdocument.in/reader034/viewer/2022042404/5f1bcbb9b740b64ae67d5027/html5/thumbnails/25.jpg)
circa-support.euIncremental backup considerations
● USE checksums● Do not RELY on size or timestamp