Ponton X/P 2.3 ? Installation and Configuration Guide

6.5 Access to the Administration Tool
Advanced Configuration
This section describes how to configure the Ponton XP system so that access to the
Messenger administration tool (or other components) restricted based on IP addresses.
By default only the HttpListener and the SoapListener are open to anyone. All other
components are restricted to only local and private IP addresses. If you try to access
any of these components from a non authorized IP address, you will get an Error 403 –
Access denied.
The authorized IPs are by default
127.0.0.1
192.168.0.0 – 192.168.255.255
10.0.0.0-10.255.255.255
172.16.0.0-172.16.255.255
169.254.0.0-169.254.255.255
Note: Clearly, access restrictions to your Messenger system may also be defined by
means of appropriate firewall settings.
Within the Ponton XP/Tomcat configuration, access is defined by means of so-called
security valves, any number of which may be specified. These security valves can
restrict access from certain addresses/address spaces or to specific components of the
Ponton XP system such as the Messenger, the Listener, the administration tool, the
adapter interface, etc.
The relevant access settings are specified in the Tomcat configuration file
as follows.
[installation root]/tomcat-4.1.27/conf/server.xml
By default you will see the following line at the end of the server.xml:
allow="127\.0\.0\.1,192\.168\..*,10\..*,172\.16\..*,
169\.254\..*"
pattern="/pontonxp/private/.*,/pontonxp/index.*,
/pontonxp/Mess…"
This will restrict the access to Admintool and Adapter-Service to just private IP
networks. The values for allowed IPs and the URI patterns are regular expressions for
maximum flexibility. These expressions have to be separated by commas.
Characters in regular expressions have the following meaning:
. – any character will match
Ponton X/P 2.3 – Installation and Configuration Guide 70