![]() | |
Sun Java System Web Proxy Server User Interface |
The Filters Tab
The Filters tab contains the following pages:
The Restrict URL Filter Access PageThe Restrict URL Filter Access page is used to create and implement a filter.
You can use a filter file that contains a list of URLs to configure what content the Proxy Server retrieves. You can set up a list of URLs the proxy always supports and a list of URLs the proxy never supports. Once you have the file, you can set up the restrictions.
The filter files that the Proxy Server uses are plain text files with lines of URLs in the following pattern:
protocol://host:port/path/filename
You can use regular expressions in each of the three sections: protocol, host:port, and path/filename. For example, if you want to create a URL pattern for all protocols going to the example.com domain, you would have the following line in your file:
.*://.*.example.com
If you want to create your own file without using the Server Manager, you should use the Server Manager pages to create an empty file, and then add your text in that file or replace the file with one containing the regular expressions.
The following elements are displayed:
Select. Click this button after selecting a resource from the drop-down list.
Regular Expression. Specify a regular expression. For more information, see "Understanding Regular Expressions" in the Proxy Server Administration Guide.
Create/Edit Filters Section
Create/Edit. Select New Filter from the drop-down list next to the Create/Edit button. Type a name for the filter file in the text box to the right of the drop-down list and then click the Create/Edit button.
The Filter Editor page appears.
Filter Name. Specify the name of the filter.
Filter Content. Use the scrollable text box to enter URLs and regular expressions of URLs.
OK. Saves your entries and returns to the URL Filter Access Restriction page. The filter file is created in the instance-root/conf_bk directory.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
Once you have a filter file that contains the URLs you want to use, you can set the default access for those URLs.
Choose the template you want to use with the filters. Typically, you will want to create filter files for the entire Proxy Server, but you might want one set of filter files for HTTP, another for FTP, or for any regular expression.
Operate Filters Section
URL Filter To Allow. Select a filter file that contains the URLs you want the Proxy Server to support.
URL Filter To Deny. Select a filter file that contains the URLs to which you want the Proxy Server to deny access.
When Denied, Send. Select the text you want the Proxy Server to return to clients who request a denied URL. You can select one of two options:
OK. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
The Set Content URL Rewriting PageThe Set Content URL Rewriting page is used to create a filter that examines outgoing data and substitutes one string for another.
The following elements are displayed:
Select. Click this button after selecting a resource from the drop-down list.
Regular Expression. Specify a regular expression. For more information, see "Understanding Regular Expressions" in the Proxy Server Administration Guide.
Source Pattern. Specify the source string.
Destination Pattern. Specify the destination string.
MIME Pattern. Specify the content type.
Information. Lists all the URL rewriting patterns that have been set.
Edit. Click this link to edit an existing URL rewriting pattern.
Remove. Click this link to delete an existing URL rewriting pattern. Click OK to confirm deletion.
OK. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
The Set User-Agent Restriction PageThe Set User-Agent Restriction page is used to restrict access to the Proxy Server based on the type and version of the client’ s web browser. For example, you can specify that all proxy server users must use Netscape Navigator 3.0. Restriction occurs based on the user-agent header that all web browsers send to servers when making requests.
The following elements are displayed:
Select. Click this button after selecting a resource from the drop-down list.
Regular Expression. Specify a regular expression. For more information, see "Understanding Regular Expressions" in the Proxy Server Administration Guide.
User-Agent Filter. Click the Allow only User-Agents Matching radio button to restrict access to the Proxy Server.
OK. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
The Set Request Blocking PageThe Set Request Blocking page allows you to block file uploads and other requests based on the upload content type.
The following elements are displayed:
Select. Click this button after selecting a resource from the drop-down list.
Regular Expression. Specify a regular expression. For more information, see "Understanding Regular Expressions" in the Proxy Server Administration Guide.
Request Blocking Based On MIME Type. Click the radio button for the type of request blocking you want. The options include the following:
Choose whether you want to block requests for all clients or for user-agents that match a regular expression you enter.
Click the radio button for the methods for which you want to block requests. The options include the following:
OK. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
The Suppress Outgoing Headers PageThe Suppress Outgoing Headers page is used to configure the Proxy Server to remove outgoing headers from the request (usually for security reasons).
For example, you might want to prevent the From header from going out because it reveals the user’s email address, or you might want to filter out the user-agent header so external servers cannot determine what web browsers your organization uses. You may also want to remove logging or client-related headers that are to be used only in your intranet before a request is forwarded to the Internet.
This feature does not affect headers that are specially handled or generated by the proxy itself or that are necessary to make the protocol work properly (such as If-Modified-Since and Forwarded).
Although it is not possible to stop the forwarded header from originating from a proxy, this is not a security problem. The remote server can detect the connecting proxy host from the connection. In a proxy chain, a forwarded header coming from an inner proxy can be suppressed by an outer proxy. Setting your servers up this way is recommended when you do not want to have the inner proxy or client host name revealed to the remote server.
The following elements are displayed:
Suppress Headers. Enter a comma separated list of request headers you want to suppress. For example, to suppress the From and User-Agent headers, type from,user-agent in the text field. The headers you type are not case-sensitive.
OK. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
The Set MIME Filters PageThe Set MIME Filters page is used to configure the Proxy Server to block certain files that match a MIME type. For example, you could set up your Proxy Server to block any executable or binary files so that any clients using your Proxy Server can’t download a possible computer virus.
You can combine filtering MIME types with templates, so that only certain MIME types are blocked for specific URLs. For example, you could block executables coming from any computer in the .edu domain.
The following elements are displayed:
Select. Click this button after selecting a resource from the drop-down list.
Regular Expression. Specify a regular expression. For more information, see "Understanding Regular Expressions" in the Proxy Server Administration Guide.
MIME Filter Details. Lists all the MIME filters that are set.
Current Filter. Enter a regular expression that matches the MIME types you want to block. For example, to filter out all applications, you could type (application/.*) for the regular expression. This is faster than checking each MIME type for every application type.
MIME Filter Details. Lists the details of all the MIME filters.
Select All. Click this button to select all the MIME types listed in the MIME Filters table.
Deselect All. Click this button to deselect all the MIME types listed in the MIME Filters table.
Block? Select the check box for the MIME types you want to filter. When a client attempts to access a file that is blocked, the Proxy Server returns a "403 Forbidden" message.
OK. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
The Set HTML Tag Filters PageThe Set HTML Tag Filters page allows you specify HTML tags you want to filter out before passing the file to the client. This feature lets you filter out objects such as Java applets and JavaScript code embedded in the HTML file.
To filter HTML tags, you specify the beginning and ending HTML tags if present. For example, the IMG tag does not have an end tag.Then the proxy substitutes blanks for all text and objects in those tags before sending the file to the client.
Note
The proxy stores the original (unedited) file in the cache, if the proxy is configured to cache that resource.
The following elements are displayed:
Select. Click this button after selecting a resource from the drop-down list.
Regular Expression. Specify a regular expression. For more information, see "Understanding Regular Expressions" in the Proxy Server Administration Guide.
Tag Filters. Lists all the HTML tag filters that are set if the filter check box is selected. New tag filters can also be added.
Filter? Select the filter check box for any of the default HTML tags you want to filter. These are the default tags:
- APPLET usually surrounds Java applets.
- SCRIPT indicates the start of JavaScript code.
- IMG specifies an inline image file.
- You can enter any HTML tags you want to filter. Type the beginning and ending HTML tags. For example, to filter out forms, you could type FORM in the Start Tag box (the HTML tags are not case-sensitive) and /FORM in the End Tag box. If the tag you want to filter does not have an end tag, such as OBJECT and IMG, you can leave the End Tag box empty.
OK. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.
You need to save and apply your changes and restart the proxy before the filtering will begin.
The Compress Content on Demand PageThe Compress Content on Demand page allows you to dynamically compress the requested resource.
The following elements are displayed:
Select. Click this button after selecting a resource from the drop-down list.
Regular Expression. Specify a regular expression. For more information, see "Understanding Regular Expressions" in the Proxy Server Administration Guide.
Activate Compress Content On Demand? Specify whether the server should serve precompressed content for the selected resource. The choices are:
Insert Vary Header. Specify whether to insert a Vary: Accept-encoding header. The choices are:
Fragment Size. Specify the memory fragment size in bytes to be used by the compression library (zlib ) to control the rate of compression (the amount to compress at one time). The default value is 8096.
Compression Level. Use the drop-down list to specify the level of compression. Choose NONE or a value between 1 and 9. The value 1 yields the best speed while the value 9 yields the best compression. A middle value provides a compromise between speed and compression.
OK. Saves your entries.
Reset. Erases your changes and resets the elements in the page to the values that they contained before your changes.