![]() | |
Sun Java System Web Proxy Server User Interface |
The Preferences Tab
The Preferences Tab contains the following pages:
The Start/Stop Server PageThe Start/Stop Server page is used to display the current status of the server. You can start or stop the server.
The following elements are displayed:
On. Starts the server so that all listening ports are waiting for client connections.
Off. Shuts the server down and stops all running processes. It may take a few seconds for the server to complete its shut-down process after you shut down the server, and for the status to change to Off.
For more information, see “Starting and Stopping the Proxy Server” in the Proxy Server Administration Guide.
The View Server Settings PageThe View Server Settings page is used to list all the settings for your Proxy Server. This page also informs you if you have unsaved and unapplied changes, in which case you should save the changes and restart the Proxy Server so that it can begin using the new configurations.
There are two types of settings, technical and content. The Proxy Server’s technical settings are from the magnus.conf file, and the content settings are from the obj.conf file. These files are located in the server root directory in the subdirectory called proxy-id/config. For more information about magnus.conf and obj.conf , see “Magnus.conf” and “Obj.conf” in the Sun Java System Web Proxy Server Configuration File Reference.
The following elements are displayed in the Technical Settings section of this page:
Hostname. Displays the URL that clients will use to access your server.
DNS. Displays whether DNS is enabled or disabled.
Security. Displays whether encryption is on or off.
User. Displays the user name under which the server runs.
The server’s content settings depend on how you have configured your server. Typically, the proxy lists all templates, URL mappings, and access control. For individual templates, the View Server Settings page lists the template name, its regular expression, and the settings for the template.
The Restore Configuration PageThe Restore Configuration page is used to view or restore a backup copy of your configuration files (server.xml, magnus.conf, obj.conf, mime types, server.xml.clfilter, magnus.conf.clfilter, obj.conf.clfilter, socks5.conf, bu.conf, icp.conf, parray.pat, parent.pat, proxy-id.acl). The page lists all the previous configurations ordered by date and time.This feature allows you to revert to a previous configuration if you are having trouble with your current configuration. For example, if you make changes to the proxy’s configuration and then the proxy does not work the way you thought it should, you can revert to a previous configuration and then redo your configuration changes.
The following elements are displayed:
Set Number Of Sets Of Backups. Specify the number of backups to display on the Restore Configuration page. Click the Change button.
Restore to date and time. Click this link to restore all the files to their previous configuration on a particular date and time.
View. Click this link to display a listing of the technical and content settings of a particular version. The View Backup page displays. Click the Restore button to revert to the selected version or click the Choose new version button to use the current version.
Restore. Click this link to restore a particular version.
The Configure System Preferences PageThe Configure System Preferences page is used to set up or change the basic aspects of your server. The page allows you to change the server user, the number of processes, listen queue size, proxy timeout, and timeout after interrupt for your Proxy Server. It also allows you to enable DNS, ICP, proxy arrays, and parent arrays.
The following elements are displayed:
Server User. The server user is the user account that the proxy uses.The user name you enter as the Proxy Server user should already exist as a normal user account. The server runs as if it were started by the Proxy Server user specified.
If you want to avoid creating a new user account, you can select an account used by another HTTP server running on the same host, or if you are running a UNIX proxy, you can select the user nobody. However, on some systems the user nobody can own files but cannot run programs, which makes it an unsuitable proxy user name.
Processes. Specifies the number of background processes that are available to service requests. When individual users send requests to the Proxy Server, the proxy uses background processes to service their requests. You can specify the number of processes dedicated to the proxy. These processes are spawned when the server starts and they remain idle until needed.
Listen Queue Size. Specifies the maximum number of pending connections on a listen socket.
Request Throttle Value. Specifies the maximum number of simultaneous transactions the Proxy Server can handle. The default value is 128. Changes to this value can be used to throttle the server, minimizing latencies for transactions that are performed.
Enable DNS? Allows you to enable DNS. A Domain Name Service (DNS) resolves IP addresses into host names. When a web browser connects to your server, the server gets only the IP address of the client, for example, 198.95.251.30. The server does not have the host name information, such as www.example.com. For access logging and access control, the server can resolve the IP address into a host name.
Enable ICP? Allows you to enable the Internet Cache Protocol (ICP) which is a message-passing protocol that allows caches to communicate with one another. Caches can use ICP to send queries and replies about the existence of cached URLs and about the best locations from which to retrieve those URLs. For more information on ICP, see “Routing Through ICP Neighborhoods” in the Proxy Server Administration Guide.
Enable Proxy Array? A proxy array is an array of proxies serving as one cache for the purposes of distributed caching. If you enable the proxy array option, it means that the Proxy Server you are configuring is a member of a proxy array, and that all other members in the array are its siblings. For more information on using proxy arrays, see “Routing through Proxy Arrays” in the Proxy Server Administration Guide.
Enable Parent Array? A parent array is a proxy array through which a proxy or proxy array is routed. So, if a proxy routes through an upstream proxy array before accessing a remote server, the upstream proxy array is considered the parent array. For more information on using parent arrays with your Proxy Server, see “Routing Through a Parent Array” in the Proxy Server Administration Guide.
Proxy Timeout. The proxy timeout is the maximum time between successive network data packets from the remote server before the Proxy Server times out the request. The default value for proxy timeout is five minutes.
Timeout After Interrupt. The default value for proxy timeout is 15 seconds.
OK. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
The Tune Proxy PageThe Tune Proxy page allows you to change the default parameters to tune your Proxy Server’s performance.
The following elements are displayed:
FTP Listing Width. You may want to modify the width of FTP listings to better suit your needs. Increasing listing width allows longer file names and thus reduces file name truncation. The default width is 80 characters.
OK. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
The Add Listen Socket PageThe Add Listen Socket page is used to add a listen socket. The server must accept the request through a listen socket before it can process a request.
The following elements are displayed:
Listen Socket ID. Specify the internal name for the listen socket. You cannot change this name after the listen socket has been created.
IP Address. Specify the IP address of the listen socket. Can be in dotted-pair or IPv6 notation. Can also be 0.0.0.0, any, ANY or INADDR_ANY (all IP addresses).
Port. Specify the port number to create the listen socket on. Legal values are 1 - 65535. On UNIX, creating sockets that listen on ports 1 - 1024 requires superuser privileges. Configure an SSL listen socket to listen on port 443.
Server Name. Specify the server name to be used in the host name section of any URLs the server sends to the client. This affects URLs that the server automatically generates but does not affect the URLs for directories and files stored in the server. This name should be the alias name if your server uses an alias.
Security. From the drop-down list, specify whether security should be enabled or disabled for the listen socket.
OK. Saves your changes and opens The Edit Listen Sockets Page.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
The Edit Listen Sockets PageThe Edit Listen Sockets page is used to edit listen socket settings. For more information about listen sockets, see "Creating and Managing Listen Sockets" in the Proxy Server Administration Guide.
The following elements are displayed:
New. Click to create a new listen socket. The Add Listen Socket Page displays.
Configured Sockets. This table displays information about existing listen sockets.
IP Address. The IP address of the listen socket. Can be in dotted-pair or IPv6 notation. Can also be 0.0.0.0, any, or ANY or INADDR_ANY (all IP addresses).
Port. The port number to create the listen socket on. Legal values are 1-65535. On UNIX, creating sockets that listen on ports 1-1024 requires superuser privileges. Configure an SSL listen socket to listen on port 443.
Security. Displays whether security is enabled or disabled for the listen socket.
OK. Saves your changes.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
If you are editing listen socket settings, after clicking the listen socket ID you will be presented with another Edit Listen Socket page. The following elements are displayed:
- General
- Listen Socket ID. The internal name for the listen socket. You cannot change this name after a listen socket has been created.
- IP Address. The IP address of the listen socket. This can be in dotted-pair or IPv6 notation. Can also be 0.0.0.0, any, or ANY or INADDR_ANY (all IP addresses).
- Port. The port number on which to create the listen socket. Legal values are 1-65535. On UNIX, creating sockets that listen on ports 1-1024 requires superuser privileges. Configure an SSL listen socket to listen on port 443.
- Server Name. The default server for this listen socket.
- Security
If security is disabled, only the following parameter is displayed:
If security is enabled, the following parameters are displayed:
- Security. Enables or disables security for the listen socket selected.
- Server Certificate Name. Select an installed certificate from the drop-down list to use for this listen socket.
- Client Authentication. Specifies whether client authentication is required on this listen socket. This is Optional by default.
- SSL Version 2. Enables or disables SSL Version 2. This is disabled by default.
- SSL Version 2 Ciphers. Lists all ciphers within this suite. Select the ciphers you want to enable for the listen socket you are editing by checking or unchecking the boxes. The default versions will be unchecked.
- SSL Version 3. Enables or disables SSL Version 3. This is enabled by default.
- TLS. Enables or disables TLS, the Transport Layer Security protocol for encrypted communication. This is enabled by default.
- TLS Rollback. Enables or disables TLS Rollback. Note that disabling TLS Rollback leaves connections vulnerable to version rollback attacks. This is enabled by default.
- SSL Version 3 and TLS Ciphers. Lists all ciphers within this suite. Select the ciphers you want to enable for the listen socket you are editing by checking or unchecking the boxes. The default versions will be checked.
- Advanced
- Number Of Acceptor Threads. The number of acceptor threads for the listen socket. The recommended value is the number of processors in the machine. The default is 1, legal values are 1-1024.
- Protocol Family. The socket family type. Legal values are inet, inet6, and nca. Use the value inet6 for IPv6 listen sockets. Specify nca to make use of the SolarisTM Network Cache and Accelerator.
OK. Saves your changes and returns to the previous Edit Listen Sockets page.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
The Select Directory Services PageThe Select Directory Services page lists all directory services for the specified proxy server instance. The page allows you to select the directory services to use with a specific proxy server instance.
For more information, see The Configure Directory Service Page.
The following elements are displayed:
Directory Services. Lists the directory services for the specified proxy server instance. Select a directory service by highlighting it in the list.
OK. Saves your changes. Click Apply after saving your changes to allow the changes to take effect.
Reset. Erases your changes and resets the elements in the page to the values they contained before your changes.
The Create/Edit MIME Types PageMulti-purpose Internet Mail Extension (MIME) types control what types of multimedia files your mail system supports. MIME types also specify what file extensions belong to certain server file types, for example, to designate what files are CGI programs. One MIME types file, mime.types, exists by default on the server.
The Create/Edit MIME Types page allows you to map a file extension with a file type.
The following elements are displayed:
Category. Specify the category of the MIME type. Choose from the following options:
- Type. MIME standard set of identifiers for content. MIME is a standard identifier that defines the type of media content and its format so that the heterogeneous client or server applications can interpret the multimedia content that they exchange. The MIME types file contains the default MIME types definitions that will be used for the server.
- Enc. A response header field sent with compressed documents in addition to a document’s MIME type. It indicates to the client browser the response data has been compressed or modified by a filter, so that the client can decompress the response data before presenting it to the user.
- Lang. A language encoding header field specifying the language of the document.
Content-Type. Specify the nature of the file. For example, the file could be text, video, and so forth. The receiving client such as Netscape Navigator uses the header string to determine how to handle the file, for example, by starting a separate application or using a plug-in application.
File Suffix. Specify all the file suffixes that will be associated with the content type. To specify more than one extension, separate the entries with a comma. File extensions must be unique; do not map one file extension to two MIME types.
New. Click this button to add a new mime type.
Edit. Click this link to edit the MIME details. Click the Change MIME Type button to save the modifications you made.
Remove. Click this link to delete a MIME type.
The Administer Access Control PageThe Administer Access Control page allows you to manage access control lists (ACLs). ACLs allow you to control which clients can access your server. ACLs can screen out certain users, groups, or hosts to either allow or deny access to part of your server, and set up authentication so that only valid users and groups can access part of the server.
The following elements are displayed:
Select A Resource
Displays all the resources that use ACLs to restrict access. An ACL can be any uniform resource identifier (URI). The URI in the ACLs list may be a directory, file name, or an alias to a resource such as a CGI script or servlet.
Select. Click this button after selecting a resource from the drop-down list.
Regular Expression. Specify a regular expression. For more information, see "Understanding Regular Expressions" in the Proxy Server Administration Guide.
Edit. Edits the access control list for the selected resource.
Select An Existing ACL
Specifies an ACL from the list of all the ACLs enabled for the server. Even if an ACL exists, if you have not enabled it, it will not appear in this list.
Existing ACL. Specifies a resource to manage.
Edit. Edits the selected access control list.
Type In The ACL Name
ACL Name. Specifies a resource to manage.
Edit. Edits the selected access control list.
Access Control Rules for PageThe Access Control Rules for Page is divided into two frames that set the access control rules. If the resource you chose already has access control, the rules will appear in the top frame.
The following elements are displayed:
Upper Frame
The upper frame displays access control rules representing each configurable setting as a link. When you click on a link, the page divides into two frames, and you can use the Lower Frame to set the access control rules. For more information, see Setting the Action in the Proxy Server Administration Guide.
The following elements are displayed in the upper frame:
Action
Specifies whether to deny or allow access to the users, groups, or hosts.
Users/Groups
Allows you to specify user and group authentication when you click the word anyone. The bottom frame allows you to configure User-Group authentication. By default, no users or groups outside of the group admin can access Administration Server resources. For more information, see "Specifying Users and Groups" in the Proxy Server Administration Guide.
From Host
Allows you to specify the computers you want to include in the rule when you click the word anyplace. In the bottom frame, you can enter wildcard patterns of host names or IP addresses to allow or deny. For more information, see "Specifying the From Host" in the Proxy Server Administration Guide.
Rights
Allows you to specify access rights to files and directories on your web site. In addition to allowing or denying all access rights, you can specify a rule that allows or denies partial access rights. For example, you can give people read-only access rights to your files, so they can view the information but not change the files. This is particularly useful when you use the web publishing feature to publish documents. For more information, see "Setting Access Rights" in the Proxy Server Administration Guide.
Extra
Allows you to specify a customized ACL entry. This is useful if you use the access control API to customize ACLs. For more information, see "Writing Customized Expressions" in the Proxy Server Administration Guide.
Continue
Specifies that the next line in the access control rule chain is evaluated before the server determines if the user is allowed access. When creating multiple lines in an access control entry, work from the most general restrictions to the most specific ones.
Trash Can Icon
Deletes the corresponding line from the access control rules.
Access Control Is On
Specifies whether access control is enabled.
New Line
Adds a default ACL rule to the bottom row of the table.
To swap an access control restriction with the access control restriction preceding it, click the up arrow figure. To swap an access control restriction with the access control restriction after it, click the down arrow figure.
Response When Denied
Specifies the response a user sees when denied access. You can create a different message for each access control object. By default, the user is sent the following message: "FORBIDDEN. Your client is not allowed access to the restricted object."
Submit. Saves your entries.
Revert. Erases your changes and resets the elements in the page to the values that they contained before your changes.
Lower Frame
The lower frame allows you to configure access control rules for the ACL in the Upper Frame.
The following elements are displayed in the lower frame:
Allow/Deny
Allow. Allows the user, group, or host access.
Deny. Denies the user, group, or host access.
Update. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
User/Group
For more information, see "Specifying Users and Groups" in the Proxy Server Administration Guide.
Anyone (No Authentication). Allows everyone access to the resource. No authentication is required.
Authenticated People Only. Allows only authenticated users and groups to access the resource. Choose from the following options:
Prompt For Authentication. Allows you to specify message text that appears in the authentication dialog box. You can use this text to describe what the user needs to enter. Depending on the operating system, the user will see approximately the first 40 characters of the prompt. Netscape Navigator and Netscape Communicator cache the user name and password and associate them with the prompt text. This means that if the user accesses areas (files and directories) of the server that have the same prompt, the user will not have to retype user names and passwords. Conversely, if you want to force users to reauthenticate for various areas, you must change the prompt for the ACL on that resource.
Authentication Methods. Specifies the method the server uses when getting authentication information from the client.
- Default uses the default method you specify in the obj.conf file, or "Basic" if there is no setting in obj.conf. If you check Default, the ACL rule does not specify a method in the ACL file. Default is the best choice because you can easily change the methods for all ACLs by editing one line in the obj.conf file.
- Basic uses the HTTP method to get authentication information from the client. The user name and password are only encrypted if encryption is turned on for the server.
- SSL uses the client certificate to authenticate the user. If you use this method, SSL must be turned on for the server. If you have encryption on, you can combine Basic and SSL methods.
- Digest allows the user to authenticate based on username and password without sending the username and password as cleartext.
- Other uses a custom method you create using the access control API.
Authentication Database. Allows you to select a database that the server uses to authenticate users. The default setting means the server looks for users and groups in an LDAP directory. However, you can configure individual ACLs to use different databases. You can specify different databases and LDAP directories in the file server_root/userdb/dbswitch.conf. Then, you can choose the database you want to use in the ACL by selecting it in the drop-down list. If you use the access control API to use a custom database (for example, to use an Oracle or Informix database), you can type the name of the database in the "Other" field in the User/Group window.
Update. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
From Host
For more information, see "Specifying the From Host" in the Proxy Server Administration Guide.
Any place. Allows any machine access to the resource.
Only from. Allows only the specified host names or IP address to access the resource. You specify this restriction by using wildcard patterns that match the machines’ host names or IP addresses. For example, to allow or deny all computers in a specific domain, you would enter a wildcard pattern that matches all hosts from that domain, such as *.example.com.
Update. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
Access Rights
For more information, see "Setting Access Rights" in the Proxy Server Administration Guide.
All Access Rights. Allows the user, group, or host all access rights: read, write, execute, delete, list, and info.
Only the Following Rights. Allows the user, group, or host only the selected access rights. Choose from the following:
- Read. Allows a user view a file. Read access right includes the HTTP methods GET, HEAD, POST, and INDEX.
- Write. Allows a user change or delete a file. Write access right includes the HTTP methods PUT, DELETE, MKDIR, RMDIR, and MOVE. To delete a file, a user must have both write and delete privileges.
- Execute. Allows a user to execute server-side applications, such as CGI programs and Java applets.
- Delete. Allows a user who also has write privileges to delete a file or directory.
- List. Allows a user to get directory information. The user can get a list of the files in that directory. This applies to Web Publisher and to directories that do not contain an index.html file.
- Info. Allows a user to get headers (http_head method).
Update. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
Customized Expressions
Customize Expressions. Allows you to enter custom expressions for an ACL in the text box. You can use this feature if you are familiar with the syntax and structure of ACL files. For more information on customized expressions, see "Writing Customized Expressions" and "ACL File Syntax" in the Proxy Server Administration Guide.
Update. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
Access Deny Response
Respond with the Default File (Redirection Off). The following message is sent: "FORBIDDEN. Your client is not allowed access to the restricted object."
Respond with the Following URL: (Redirection On). When selected, allows you to create a different message for each ACL. Enter the absolute path of a URL or a relative URI.
Update. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
The Configure ACL Cache PageThe Configure ACL Cache page is used to enable or disable the proxy authentication cache, set the proxy authentication cache directory, configure the cache table size, and set the entry expiration time.
The following elements are displayed:
Proxy Auth Caching. You can enable or disable the proxy authentication cache.
Proxy Auth User Cache Size. Select the number of users in the User Cache. The default size is 200.
Proxy Auth Group Cache Size. Select the number of group IDs that can be cached for a single UID/cache entry. The default size is 4.
Proxy Auth Cache Expiration. Select the number of seconds before cache entries expire. Each time an entry in the cache is referenced, its age is calculated and checked against this value. The entry is not used if its age is greater than or equal to the Proxy Auth Cache Expiration value. If this value is set to 0, the cache is turned off.
If you use a large number for this value, you may need to restart the Proxy Server when you make changes to the LDAP entries. For example, if this value is set to 120 seconds, the Proxy Server might be out of sync with the LDAP server for as long as 2 minutes. If your LDAP entries are not likely to change often, use a large number. The default expiration value is 2 minutes.
OK. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
The Configure DNS Cache PageThe Configure DNS Cache page is used to enable or disable DNS caching, specify the DNS cache directory, set the size of the DNS cache, specify the number of semaphores to protect the shared memory file, and set the expiration of DNS cache entries.
The following elements are displayed:
DNS Caching. Enables or disables DNS caching.
DNS Cache Size. Select the number of entries that can be stored in the DNS cache. The default size is 1024.
DNS Cache Expiration. The Proxy Server purges DNS cache entries from the cache when it reaches a pre-set expiration time. The default DNS expiration time is 20 minutes.
Negative DNS Caching. Enables or disables caching of errors when the host name is not found.
OK. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
The Configure DNS Subdomains PageThe Configure DNS Subdomains page is used to set the levels of subdomains the proxy will traverse to resolve the host name.
Some URLs contain host names with many levels of subdomains. It can take the Proxy Server a long time to do DNS checks if the first DNS server cannot resolve the host name. You can set the number of levels that the Proxy Server will check before returning a "host not found" message to the client.
For example, if the client requests http://www.sj.ca.example.com/index.html, it could take a long time for the proxy to resolve that host into an IP address because it might have to go through four DNS servers to get the IP address for the host computer. You can configure the Proxy Server to quit looking up an IP address if the proxy has to use more than a certain number of DNS servers, because these lookups can take up a lot of time.
The following elements are displayed:
Select. Click this button after selecting the resource from the drop-down list.
Regular Expression. Specify a regular expression. For more information, see "Understanding Regular Expressions" in the Proxy Server Administration Guide.
Local Subdomain Depth. Select the level of sub-domains that the proxy will traverse to resolve the host name.
OK. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
The Configure HTTP Client PageThe Configure HTTP Client page is used to enable keep-alives on your Proxy Server.
The proxy supports HTTP keep-alive packets. The proxy, by default, does not use keep-alive connections, but for some systems, using the keep-alive feature can improve the proxy’s performance. Keep-alives are a TCP/IP feature that keeps a connection open after the request is complete, so that the client can quickly reuse the open connection.
In normal client-server transactions on the web, the client can make several connections to the server that requests multiple documents. For example, if the client requests a web page that has several graphic images, the client needs to make separate requests for each graphic file. Reestablishing connections is time consuming.
The following elements are displayed:
Select. Click this button after selecting the resource from the drop-down list. Select a HTTP or HTTPS resource to configure keep-alives on your Proxy Server.
Regular Expression. Specify a regular expression. For more information, see "Understanding Regular Expressions" in the Proxy Server Administration Guide.
Configure HTTP Client. The options include the following:
- Keep Alive. You can specify whether the HTTP client should use persistent connections by clicking the appropriate option.
- Keep Alive Timeout. Specify the maximum number of seconds to keep a persistent connection open. The default value is 29.
- Persistent Connection Reuse. You can specify whether the HTTP client can reuse existing persistent connections for all types of requests by selecting the appropriate option. The default value is off and does not allow persistent connections to be reused for non-GET requests nor for requests with a body.
- HTTP Version String. Specify the HTTP protocol version string. You should not specify this parameter unless you encounter specific protocol interoperability problems.
- Proxy Agent Header. Specify the Proxy Server product name and version.
Configure SSL Client. The options include the following:
OK. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
The Set Cipher Size PageThe Set Cipher Size page is used to set stronger ciphers.
The following elements are displayed:
Select. Click this button after selecting a resource from the drop-down list.
Regular Expression. Specify a regular expression. For more information, see "Understanding Regular Expressions" in the Proxy Server Administration Guide.
Key Size Restriction. Select one of the following secret key sizes to be required for access:
Reject Access With File. Enter the file location of the message used to reject access.
OK. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.