Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have had my new web application online for just about a week and have seen a host of attacks run against it already. Of all the attacks that I have logged, 75% of them are using the IP address of the server and not the domain name. Can I configure tomcat to listen to www.mydomain.com and mydomain.com (through an alias) such that all other requests are dropped?

What does tomcat normally do with unmatched requests?

I simply want to only server content to legitimate traffic request.getServerName().indexOf("mydomain.com") >= 0.

I can write a servlet filter no problem, just don't want to add extra junk that is already implemented and just needs enabled/configured.

Can I do that with Tomcat?

http://tomcat.apache.org/tomcat-6.0-doc/config/host.html

I remember that with Apache, you can set a default virtual host, but I don't ever remember dropping requests that didn't match any of the virtual hosts listed in the configuration.

Thanks, Walter

share|improve this question

2 Answers 2

up vote 1 down vote accepted

I would highly recommend placing Apache in front of your Tomcat, so you can do the filtering there. Tomcat doesn't really have the same flexibility that Apache does, unless you code it yourself. You might find this blog entry useful for connecting Apache and Tomcat.

share|improve this answer
    
David, Thanks for your reply - The underlying framework supports caching and compression out of the box. As for compression, I have a servlet filter that handles compression for those items. Page caching is automatically handled as well, and fragments for those pages can be cached. I think I'll simply write the filter myself, it can easily be enabled disabled with a switch (@Install(false)). Walter –  Walter White Oct 20 '09 at 12:29

As described in the linked document, create two different hosts. One empty or with a static index page, the second one as named host for your website. Now define the empty one as "defaultHost". This way everyone not using the name of your website, will be placed into the minimal host, causing no harm? Or use some redirect code to move them to your www.website.com addressed host.

Just one question, as I agree with David to use a webserver in front of tomcat, how do you do logging of requests and the analysis of these requests with software like etracker or urchin?

regards, Marcus

share|improve this answer
    
Well, Jetty and Tomcat both log requests. Additionally, servlet filters allow you to intercept all requests before the servlet or whatever else processes them. So with that idea/concept in mind, you are free to capture as much or little as you like. Opensymphony has a few servlet filters that log traffic. Jetty actually has the most useful servlet filters that come packaged with Jetty, QoSFilter, IncludableGzipFilter. –  Walter White Nov 4 '09 at 13:36
    
I don't use JavaScript trackers for several reasons. 1. They are client-side and susceptible to forgery. 2. They impact the page loading time since it requires an additional request in order to track. The only information I'm losing by not using Urchin or whatever is client-side stuff I don't care too much about (at least at this point in time). The screen size, window size, etc. –  Walter White Nov 4 '09 at 13:38
    
Additionally, running another server will consume more resources and require more configuration. At this point, I'm operating under the assumption that for the system I'm running, that I'd see better performance straight from Jetty with all caching being handled by Jetty/JBoss Seam/Hibernate than running a proxy in front of that. I might re-evaluate that assumption later by running load tests and letting the results speak for themselves. So far, I am pleasantly surprised with Jetty's performance. –  Walter White Nov 4 '09 at 13:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.