3

In server.xml, at the Connector I specify proxyPort as 80.

Here's the xinetd service:

service http
{
        socket_type     = stream
        protocol        = tcp
        user            = tomcat6
        wait            = no
        bind            = 0.0.0.0
        port            = 80
        redirect        = 127.0.0.1 8080
        disable         = no
        flags           = REUSE
        log_type        = FILE /var/log/xinetd_http_access.log
        log_on_success  -= PID HOST DURATION EXIT

        per_source      = UNLIMITED
        instances       = UNLIMITED
}

Still, in the access logs of Tomcat I see lines like the following:

127.0.0.1 - - [17/Aug/2012:00:23:23 +0300] "GET / HTTP/1.1" 200 1975
127.0.0.1 - - [17/Aug/2012:00:23:23 +0300] "GET /_static/css/global.css HTTP/1.1" 304 -

Any ideas?

Poni
  • 305
  • 3
  • 13

2 Answers2

0

Can xinetd pass an X-FORWARDED-FOR HTTP header?

If tomcat is behind a reverse proxy (e.g. nginx) that passes X-FORWARDED-FOR, i.e.:

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

Then you can set in your tomcat server.xml for the AccessLogValve: 

pattern="%{X-Forwarded-For}i %l %u %t %r %s %b %{User-Agent}i %{Referer}i"

And you will get the originating IP address of the client in the access log.

Cheers

quanta
  • 50,327
  • 19
  • 152
  • 213
HTTP500
  • 4,827
  • 4
  • 22
  • 31
  • I guess I wasn't clear: There's xinetd (port 80). It forwards connections to Tomcat (port 8080). That's it. – Poni Aug 16 '12 at 21:53
  • 1
    @Poni, Well if you want more than port redirection then you probably need to run a reverse proxy... – HTTP500 Aug 16 '12 at 21:58
  • Yea, got nginx. Will probably use that, eventually. Was just curious, maybe someone knows better you know. – Poni Aug 16 '12 at 22:01
0

Nope, nothing can be done. You cannot do this with xinetd. It appeared working for me, but then I realize that most of the IP addresses in the log are still 127.0.0.1.

I finally managed to get Tomcat running as (mostly) restricted user using jsvc with the --user option. It is also possible with iptables.

h22
  • 234
  • 2
  • 9