Configuring jetty to accept connections from only certain IP addresses

jettysolr

I am using the jetty that is shipped with Apache Solr to run Solr. I would like to configure jetty such that it only accepts connections from certain IP addresses. I know I can bind jetty to 127.0.0.1 to only accept connections from the localhost:

<Set name="host"><SystemProperty name="jetty.host" default="127.0.0.1" /></Set>

But how I do set it so that it can accept connections from certain non-localhost IP addresses as well?

Best Answer

You can use the IPAccessHandler that is in jetty 7, 8 and 9

http://download.eclipse.org/jetty/stable-9/apidocs/org/eclipse/jetty/server/handler/IPAccessHandler.html

you would wire this up in the handler chain so that it is executed before anything else in the handler chains

[edit] also look at the jetty-ipaccess.xml file under $jetty.home/etc

http://git.eclipse.org/c/jetty/org.eclipse.jetty.project.git/tree/jetty-server/src/main/config/etc/jetty-ipaccess.xml

Related Solutions

Jetty – Virtualhosting – SSL Certificates

Did you read the Jetty documentation?

Glassfish does it by attaching the certificates to the HTTP(S) listeners, which are then in turn bound to a server instance.

According to the documentation, the way Jetty does it is pretty similar:
http://docs.codehaus.org/display/JETTY/Virtual+hosts

You simply configure your vhosts (make them IP based, SSL is negotiated before host headers are ever sent), and then add multiple connectors, one per IP/HTTPS connector. Each can have its own trust/keystore with the SSL certificate in them.

https://web.archive.org/web/20150509123728/http://docs.codehaus.org/display/JETTY/Ssl+Connector+Guide
newer: https://www.eclipse.org/jetty/documentation/current/configuring-ssl.html

Simply add a connector per certificate. There's no way around it, SSL requires a dedicated IP address, so one connector per SSL site you wish to serve.

According to this document:
https://www.eclipse.org/jetty/documentation/9.4.x/configuring-connectors.html

The "host" directive for connectors will allow you to bind them to a specific address, thus solving your problem.

Hope this helps.

Configuring Jetty to accept connections from all hosts on Ubuntu Lucid

Found it! You need: -

JETTY_HOST=0.0.0.0

to listen to other hosts. So a minimal /etc/default/jetty file includes: -

JAVA_HOME=/usr/lib/jvm/java-1.5.0-sun
NO_START=0
JETTY_HOST=0.0.0.0
JETTY_PORT=8080

Best Answer

Related Solutions

Jetty – Virtualhosting – SSL Certificates

Configuring Jetty to accept connections from all hosts on Ubuntu Lucid

Related Topic