A tomcat server that is run as root (i.e. web app using port 80) needs access to an NFS share to store uploaded files, which the root account does not have access to. Unsurprisingly, when the web application attempts to store a file, a permission exception is thrown.
Can I mount the share as a non-root user, so that the web server is able to access the share without permissions issues?
I'm in the middle of securing an OSX server that is the target of hundreds of automated requests per second from Chinese, Russian and US servers (see: Recovering a server from being an open relay).
I've used ipfw to set up rules that exclude all but local IP requests (i.e. 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
What is the difference between setting up ipfw rules, and implementing similar rules in hosts.allow/hosts.deny?
As I understand it, the hosts files affect tcp-wrapped services (so may not be as holistic as ipfw). Would that also mean that they come after the firewall (so no point in using both)?
One of our Mac Pro machines running Apache was inadvertently acting as a forward proxy with a public IP, after some organisation proxy rules changed.
Consequently it was discovered by spammers and since then has been hammered on all sorts of ports by all sorts of IP addresses.
I've locked down the Apache proxy settings, and set up highly restrictive ipfw rules to deny all access outside our private network (using NoobProof) .
Is there anything else I should do to secure the server, or reduce the amount of requests coming through?
My team uses the machine for a number of applications, so it would be good to minimise downtime, and still allow them to access the same URL if I need to change the IP address.