-1

I have a shiny server listening on port 3838 (Centos 6 Environment). I would like to block direct access to

http://www.mywebsite.com:3838

which reveals the shiny files and directories. Any time I try to block access via htaccess, I end up blocking all access to the site. Is there any way to get this task completed? I would still need the port open internally so the shiny apps could be requested. Sam

1
  • There is very little information to help up assist you with this. Start by posting the output of iptables-save and ss -tunlp | column -t as well as giving a better description of what "internal" means to you in this context (eg, just the local server, or the local network etc?)
    – fukawi2
    Sep 15 '15 at 22:50
2

There are a couple of things you can do, first of all would be read the documentation for the configuration options it could be really helpful.

In the documentation you'll note the directory_index directive.

When enabled, if a directory is requested by the client and an index.html file is not present, a list of the directory contents is created automatically and returned to the client. If this directive is not present in a custom config file, the default behavior is to disable directory indexes. However, it is enabled if no config file is present at all (in other words, the default config file has it enabled).

So it seems that either you have no config file or directory_index has been explicitly enabled. This leads to several potential solutions.

  • Verify the existence of a config file and ensure you are using it.
  • Ensure that the config file (if in use) has directory_index defined correctly.
  • Add an index.html file to the directory (so that there is no need to generate a directory index).
4
  • I am able to use index.html and not show the directory. However, people can still see the iframe src in the shiny app and directly access the source of the file which is in shiny directories. Is there any way to stop this and effectively block anything that goes through mywebsite.com:3838/*? Sep 15 '15 at 7:20
  • See the first two bullet points - there lies the solution.
    – user9517
    Sep 15 '15 at 7:23
  • Hi Lain. I was able to configure the shiny file as you suggested. I have one last issue. I need to do a redirect only if the base url they are requesting does not match www.mywebsite.com/plots. Is there a way to do this? For example if the user types www.mywebsite.com:3838/.../... redirect, but do not redirect if they access from mywebsite.com/plots. Sep 16 '15 at 21:25
  • I would imagine you could do something with the location and redirect directives but as I don't know what as I've never used shiny.
    – user9517
    Sep 16 '15 at 21:35
1

If iptables is acceptable to you, you can block external traffic as follows: If your internal net is 192.168.1.0/24, you could do the following:

iptables -A INPUT -s 192.168.1.0/24 -p tcp -m tcp --dport 3838 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 3838 -j DROP

This first grants access to the port for the internal network, then denies for anyone else. The DROP option causes it to simple drop the packets, causing a timeout for connection requests, if you want to be nicer/more obvious, you can use REJECT instead.

If you only need localhost access to that port, you can substitute 127.0.0.1 for 192.168.1.0/24

8
  • Smiling Dragon, I was able to implement what you stated. However, I may have misstated myself because all of the shiny apps are now broken. I am assuming external access has to be allowed for the server to work; however, direct access should be disallowed. Is this possible? Sep 15 '15 at 5:05
  • 1
    You will also need a rule to allow local access I'm guessing iptables -I INPUT -i lo -j ACCEPT
    – fukawi2
    Sep 15 '15 at 6:12
  • 2
    Without knowing the state of the OP's firewall using -A' is fraught with problems, using -I` is better. A standard C6 firewall will had a DROP everything rule, using -A adds new rules after this. Similarly a standard C6 firewall should already allow all traffic on lo.
    – user9517
    Sep 15 '15 at 6:18
  • 1
    @Iain I would usually agree re -A vs -I but in this case, -A is less likely to break something else. I'm expecting that the OP will incorporate the rules in a sensible fashion (but yeah, assumptions....) Sep 15 '15 at 20:36
  • 1
    @SamKingston - Break it down for us further - lay out exactly what ports you want open and closed depending on where the connection is coming from. If you can define "Internal traffic" and "External traffic" more closely. That said, I see that @Iain is saying in a different answer that your goals are achievable via in-app config. If that is indeed possible, I suspect that would be a vastly better solution (in which case, consider dropping the iptables tag from your question perhaps?) Sep 15 '15 at 20:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.