Red Hat NETSCAPE DIRECTORY SERVER 6.01 - DEPLOYMENT Installation Guide download pdf (Page 117)

107

Chapter 23

Configuring Pramati Server For Firewalls

Default Socket Factory

The RMI transport layer extends the java.rmi.server.RMISocketFactory class to provide a

default implementation of a socket factory. The implementation provides resources to client and

server sockets, and creates sockets that transparently provide firewall-tunneling mechanism.

Client sockets automatically attempt HTTP connections to hosts that cannot be contacted through

a direct socket. Server sockets automatically detect if a newly accepted connection is an HTTP

POST request, and if so, returns a socket that will expose only the body of the request to the

transport and format its output as an HTTP response.

Client-side sockets having this default behavior are provided by the

java.rmi.server.RMISocketFactory.createSocket method. Server-side sockets having this default

behavior are provided by the java.rmi.server.

Configuring Server for firewalls

Administrators must consider the following points while using Server with firewalls:

• The naming service port will always have to be open.

• HTTP Tunneling drastically reduces performance of network communication and must be

avoided if possible.

To configure Pramati Server or a Cluster node to run behind a firewall:

1 Open the HTTP port. In a typical firewall configuration, this is the default port that is open.

2 Open the Naming service port. This is mandatory if Naming service lookups have to occur from

the client-side.

If HTTP tunneling is used, no other ports need to be open.

3 Open the port on which remote objects are to be exported if HTTP tunneling is not used.

This port is already configured as part of Server. See the tag <export-port> under <server-nodes>

in Server configuration file. The value is by default zero, when it exports remote objects on

random ports. Specifying an unused port here exports all remote objects onto this port. Hence to

enable the client to talk to remote objects behind a firewall, this port must be open.

4 To enable dynamic downloading of stubs to clients across firewalls the class file server port must

also be open. This port can be specified in

server-config.xml under <class-file-server-port>.

By default it is 5020.

Note: If dynamic downloading of the EJB stubs is not required, then there is no need to open this port

across the firewall.

5 The configuration file of Server must have the global IP of the node specified in the tag <host-

ip>. When starting Server, the following command line argument is given to the JVM:

java -Djava.rmi.server.hostname = <GLOBALIP> com.pramati.Server

1 2 ... 112 113 114 115 116 117 118 119 120 121 122 ... 142 143

No comments

Red Hat NETSCAPE DIRECTORY SERVER 6.01 - DEPLOYMENT Installation Guide Page 117