IT-Administrators and Web 2.0 Developers are always working under pressure, and there’s lack of time to find all the security vulnerabilies in the used software products, Open Source as well as commercial products. In times, where most of the attacks against Web 2.0 apps are within the HTTP / HTTPS Protocol e.g. SQL-Injection, Cross Site Scripting and so on, its important, that the installation of Web Stack components are secure by default.

An example: A basic rule for a secure web configuration since over a decade is the have directory listings switched off in web servers and app servers.

What about glassfish 2.0 and security, are there any concerns?

Back to the directory listing example.

The Glassfish default is to have directory listings on and you have to modify the

glassfish/domains/domain1/config/default-web.xml

to have a secure glassfish configuration, as also mentioned by hobione.

Another thing are the default HTTP headers from glassfish. They’re too noisy by default, they’re tellling everyone in the web, which version of glassfish you’re using:

Server: Sun Java System Application Server 9.1

X-Powered-By:Servlet/2.5

So my suggestion for the glassfish project members is to modify

these defaults to a secure ones, this means

• Directory Listing “off”
• HTTP Header at least without any software version information

Click here to view the embedded video.

We hope, that the Sun Webstack project will bring us precompiled, optimized and up to date apache httpd, php, mongrel Versions with security relevant updates, soon. Maybe future Solaris 10 Updates (U5) will bring newer version of these main Web2.0 components that we do not have to compile, test, distribute, patch the components on our own.

What’s new about the Ultrasparc T2 Processor?

• 2nd generation CMT (Chip Multi-Threading) processor
• 8 Sparc Cores, 4MB shared L2 cache; Supports concurrent execution of 64 threads
• 2x UltraSparc T1′s throughput performance
• 10x UltraSparc T1′s improvement in Floating Point throughput performance
• Two 10G Ethernet ports on chip

Hope to see some SPECjAppServer2004 results for Niagara2 servers with Glassfish oder Bea Weblogic, soon.

• Accelerator Cache
• Performance and stability improvements
• Out-of-box Java support for Servlets 2.5, JSP 2.1, JSF 1.2
• Support for Java SE 5.0 and 6
• Support for NetBeans IDE 5.0, 5.5, and 5.5.1
• Administration interface support for FastCGI

More in the Release Notes, you can download it here.

• One Sun T2000, One 1,2Ghz T1, 8 Cores: 521,42 JOPS
• Three Sun X4100, each two 2,6Ghz AMD Opteron, 4Cores: 720,56 JOPS

compared to Bea Weblogic 9.0:

• One Sun T2000, One 1,2Ghz T1, 8 Cores: 615,64 JOPS

Looking forward to see Glassfish V2 SPECjAPPServer2004 benchmarks for Servers with AMD Opteron, Intel Woodcrest Clovertown and Niagara2 …

A couple of the interesting ones:

• Glassfish Application Server (have to check the version)
• Sun Studio 12
• PostgreSQL 8.2.4
• Apache 2.2.3 (have to check if mod_ldap is already compiled…)
• and many more…

Full detailed what’s new pdf.

Hope to have these packages with Solaris 10 for production, soon. With Solaris 10, we’ re still on apache 2.0.x..
Tomcat and mysql bundled with Solaris 10 are also quite a bit too old for web2.0 projects, which we have in production today.

Currenty, I don’t findy any VMware images to download, only the usual setup DVD download.

• Add new user and group (e.g. glassfish) to /etc/passwd /and /etc/group
• install latest jdk
• install glassfish
• setup and install start/stop scripts (smf on Solaris10)
• install glassfish apache 2.2 ajp integration (example1 example2 example3)
• configure glassfish logfile rotation
• tune glassfish because default settings are not suitable for production ( a lot of parameters!)
• harden glassfish because default security settings are not strong and secure enough
• deploy jdbc configuration (jars + settings)
• write scripts to integrate glassfish in your monitoring framework
• write scripts to integrate glassfish in your deployment framework (e.g. Sun N1 SPS)
• and of of course, this list is not complete

Nowadays, we have at least three (virtual) servers for each customer project. One for development, one for test and ond for production. This means to install and modify glassfish at least three times. But often, we also have hardware based load balancing in projects, that means to have at least two strings of glassfish for dev/test/prod or six installations alltogether!

Looking at the new glassfish V2 feature called application server usage profiles shows, that the three offered profiles (“developer”, “cluster”, “enterprise”) still leaking real production settings. A simple “production” or production-cluster profile would be nice. The production profiles should have tuned values (at least the parameters mentioned in the Sun Java System Application Server 9.1 PerformanceTuning Guide beginning on page 50) which makes it easier to setup glassfish for admins. The mentioned enterprise profile might be not the best for high traffic web 2.0 production web sites.

How do we do this job with other app servers? For a couple of customers, we’re using the Bea Weblogic Application Server. And we’re using the Sun N1 SPS Bea Weblogic module to install and configure Weblogic. N1 SPS also uses the possibility to run the WebLogic Scripting Tool (WLST) , which is a BEA tool for scripting the configuration of BEA WebLogic. WLST is a command-line scripting interface to monitor and manage BEA WebLogic Server instances and domains. The WLST scripting environment is based on the Java scripting interpreter, Jython.

Someting like this (GFST) would be cool to have for glassfish, too.

UPDATE: Also see gfwiki.