29、Tomcat只允許指定域名訪問,禁用IP地址訪問,防止惡意解析


1.1、測試環境說明:

Linux版本:7.6

IP地址:10.11.220.123/24

Tomcat版本:tomcat-8.5.37(端口號為8080)

Jdk版本:1.8.0_202


1.2、配置tomcat server.xml 文件(Engine組件,標紅的部分是需要修改的內容):

<Engine name="Catalina" defaultHost="VirtualHost">

<!-- 設置默認虛擬主機域名,指向虛假的虛擬目錄 -->


<!--For clustering, please take a look at documentation at:

/docs/cluster-howto.html (simple how to)

/docs/config/cluster.html (reference documentation) -->

<!--

<Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>

-->


<!-- Use the LockOutRealm to prevent attempts to guess user passwords

via a brute-force attack -->

<Realm className="org.apache.catalina.realm.LockOutRealm">

<!-- This Realm uses the UserDatabase configured in the global JNDI

resources under the key "UserDatabase". Any edits

that are performed against this UserDatabase are immediately

available for use by the Realm. -->

<Realm className="org.apache.catalina.realm.UserDatabaseRealm"

resourceName="UserDatabase"/>

</Realm>


<Host name="www.tomcat8080.com" appBase="webapps"

unpackWARs="true" autoDeploy="true">

<!-- 真實使用的虛擬目錄,域名也是你指定的域名 -->


<!-- SingleSignOn valve, share authentication between web applications

Documentation at: /docs/config/valve.html -->

<!--

<Valve className="org.apache.catalina.authenticator.SingleSignOn" />

-->


<!-- Access log processes all example.

Documentation at: /docs/config/valve.html

Note: The pattern used is equivalent to using pattern="common" -->

<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"

prefix="localhost_access_log" suffix=".txt"

pattern="%h %l %u %t &quot;%r&quot; %s %b" />

<!-- <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="127.0.0.1" deny=""/> -->

</Host>


<Host name="VirtualHost" appBase="VirtualHostDir"

unpackWARs="true" autoDeploy="true">

</Host>

<!-- 建立一個虛假的虛擬目錄VirtualHostDir,這個目錄是不存在的,當訪問IP地址或其他域名,將被轉向到訪問這個虛擬空目錄上。VirtualHostDir目錄如果不存在會自動創建 -->


</Engine>


提示:tomcat在啟動的情況下修改server.xml 文件后需要重啟tomcat實例使配置生效。


1.3、測試:

1、創建tomcat測試文件:


2、在widows電腦的C:\Windows\System32\drivers\etc\hosts文件中添加解析記錄如下:

10.11.220.123 www.tomcat8080.com


3、在瀏覽器中使用域名訪問(可以正常訪問):

www.tomcat8080.com:8080


4、在瀏覽器中使用ip地址訪問(無法進行訪問):

10.11.220.123:8080



免責聲明!

本站轉載的文章為個人學習借鑒使用,本站對版權不負任何法律責任。如果侵犯了您的隱私權益,請聯系本站郵箱yoyou2525@163.com刪除。



 
粵ICP備18138465號   © 2018-2025 CODEPRJ.COM