Working with SSL
The SSL protocol provides several features that enable secure transmission
of Web traffic. These features include data encryption, server authentication,
and message integrity.
You can enable secure communication from web clients to the NetFlow Analyzer
server using SSL.
 |
The steps provided describe how to enable SSL functionality and generate
certificates only. Depending on your network configuration and security
needs, you may need to consult outside documentation. For advanced configuration
concerns, please refer to the SSL resources at http://www.apache.org
and http://www.modssl.org
|
Stop the server, if it is running, and follow the steps below to enable SSL
support:
Generating a valid certificate
- Generate the encryption certificate and name it as server.keystore
- Copy the generated server.keystore file to the <NetFlowAnalyzer_Home>/server/default/conf
directory
Disabling HTTP
When you have enabled SSL, HTTP will continue to be enabled on the web server
port (default 8080). To disable HTTP follow the steps below:
- Edit the server.xml file present in <NetFlowAnalyzer_Home>/server/default/deploy/jbossweb-tomcat50.sar
directory.
- Comment out the HTTP connection parameters, by placing the <!--
tag before, and the -->
tag after the following lines:
<!-- A HTTP/1.1 Connector
on port 8080 -->
<Connector port="8080" address="${jboss.bind.address}"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" redirectPort="8443" acceptCount="100"
connectionTimeout="20000" disableUploadTimeout="true"/>
|
Enabling SSL
- In the same file, enable the HTTPS connection parameters, by removing the
<!-- tag before, and the
--> tag after the following
lines:
<!-- SSL/TLS Connector
configuration using the admin devl guide keystore
<Connector port="8443" address="${jboss.bind.address}"
maxThreads="100" minSpareThreads="5" maxSpareThreads="15"
scheme="https" secure="true" clientAuth="false"
keystoreFile="${jboss.server.home.dir}/conf/chap8.keystore"
keystorePass="rmi+ssl" sslProtocol = "TLS" />
--> |
- Replace the default values for the following parameters as follows:
Default Value |
New Value |
keystoreFile=
"${jboss.server.home.dir}/conf/chap8.keystore |
keystoreFile=
"${jboss.server.home.dir}/conf/server.keystore |
keystorePass="rmi+ssl" |
keystorePass="pqsecured" |
Changing the web server port
- Edit the sample-bindings.xml file present in <NetFlowAnalyzer_Home>/server/default/conf
directory
- Replace the default values for the following parameters as follows:
Default Value |
New Value |
<xsl:variable name="portHttps"
select="$port + 363"/>
|
<xsl:variable name="portHttps"
select="8443"/> |
</delegate-config>
<binding port="8080"/>
</service-config> |
</delegate-config>
<binding port="8443"/>
</service-config> |
Verifying SSL Setup
- Restart the NetFlow Analyzer server
- Verify that the following message appears:
Server
started.
Please
connect your client at http://localhost:8443
- Connect to the server from a web browser by typing https://<hostname>:8443
where <hostname> is the machine where the server is running
|