Mailing-List: contact user-help@ofbiz.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@ofbiz.apache.org
Received-SPF: pass (nike.apache.org: domain of r.ted.byers@gmail.com
 designates 209.85.212.172 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CANEMTSL0M=3z23ygXkDN2QjGqAdiFDDQQYCxs16vpR2Ch9BS5A@mail.gmail.com>
References: 
 <CAOTG1hW4VckVYRevacfnbusLXE9gt9hca2pYdBkfBujVHDtg9w@mail.gmail.com>
	<CANEMTS+UChf-3cR7HyHTZSCp4NN+_WQJK02jFfgHa6ZU8b-MDQ@mail.gmail.com>
	<CAOTG1hWgRTrWHHfMhKv7nnV=4pWa7CZzAxMhKCL5aNkqtKL36w@mail.gmail.com>
	<CANEMTSL0M=3z23ygXkDN2QjGqAdiFDDQQYCxs16vpR2Ch9BS5A@mail.gmail.com>
Date: Sat, 9 Mar 2013 12:49:21 -0500
Message-ID: 
 <CAOTG1hWLMdfq4kY4b9TkhXMM4WzrfkfjNom=2OON2zfYtjq-GQ@mail.gmail.com>
Subject: Re: accessing ofbiz only over SSL/TLS using Apache's httpd server
From: Ted Byers <r.ted.byers@gmail.com>
To: user@ofbiz.apache.org
Content-Type: text/plain; charset=ISO-8859-1

Thanks Mike,

On Sat, Mar 9, 2013 at 12:38 PM, Mike <mz4wheeler@gmail.com> wrote:
> There are a couple of ways to do it, each of which requires you to really
> know apache the AJP module:
>
> On a running ofbiz system, there is this "runtime" directory:
>
> ls /opt/ofbiz.1104/runtime/catalina/work/default-server/0.0.0.0#
>
> accounting  bizznesstime  droppingcrumbs  example googlecheckout multiflex
> ordermgr tempfiles workeffort ap bluelight     ebay exampleext  hhfacility
> myportal osafe_theme  tomahawk  ar catalog ebaystore facility humanres
> oagis partymgr   assetmaint cmssite ecommerce flatgrey iCalendar
> manufacturing  ofbiz projectmgr webpos content images marketing
>  ofbizsetup  webslinge birt googlebase  ismgr  minimal  sfa webtools
>
> These are all reserved paths that ofbiz creates when started, so you can
> create a bunch of <Location>...</Location> tags for each of the above
> --or-- you can also just use: (with out /Location tags).
>
> proxyPass /catalog ajp://127.0.0.1:8009/catalog
> proxyPass /cmssite ajp://127.0.0.1:8009/cmssite
> proxyPass /content ajp://127.0.0.1:8009/content
>
> However, just looking at the shear amount of mount points that ofbiz
> exposes by default it is crazy to expose all of them on the internet.  You
> can probably lock down the external facing mounts that you really need
> (like /ecommerce) and just access the backend via a direct connection to
> port 8080/8443, only from your LAN.
>

Would I not be able to handle the security implications of exposing
some selection of mounts for the back end by requiring client side
certificates for them.  If so, I know how to add support or a
requirement, for client side certificates in Apache's httpd server,
but what about the application server OFBiz lives in?

Thanks,

Ted