Question

民间，

我们在Glassfish4下运行了一个java应用程序。我希望禁用直接访问Glassfish管理服务器，方法是在防火墙级别关闭4848并通过nginx中的location指令访问它（也将SSL卸载到nginx）。

启用asadmin enable-secure-admin后，我可以通过https://foo.domain.com:4848进入管理服务器并正常管理。

但是当我通过asadmin disable-secure-admin禁用安全管理员并使用以下位置块访问

时

    # Reverse proxy to access Glassfish Admin server
    location /Glassfish {
    proxy_set_header               Host $host;
      proxy_set_header               X-Real-IP $remote_addr;
      proxy_set_header               X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header               X-Forwarded-Proto $scheme;
      proxy_max_temp_file_size      0;
      client_max_body_size           10m;
      client_body_buffer_size        128k;
      proxy_send_timeout             90;
      proxy_read_timeout             90;
      proxy_buffering                off;
      proxy_buffer_size              4k;
      proxy_buffers                  4 32k;
      proxy_busy_buffers_size        64k;
      proxy_temp_file_write_size     64k;
      proxy_pass                            http://127.0.0.1:4848;
    }

ala https://foo.domain.com/Glassfish我得到一个空白屏幕，我在nginx错误日志中找到的唯一参考是

2015/10/05 09:13:57 [error] 29429#0: *157 open() "/usr/share/nginx/html/resource/community-theme/images/login-product_name_open.png" failed (2: No such file or directory), client: 104.17.0.4, server: foo.domain.com, request: "GET /resource/community-theme/images/login-product_name_open.png HTTP/1.1", host: "foo.domain.com", referrer: "https://foo.domain.com/Glassfish"

阅读文档并在网上我看到：

必须启用Secure Admin才能远程访问DAS

我试图做的事情根本不可能吗？

编辑：如下所示，是完整的nginx配置。

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log  main;

    #sendfile            off;
    tcp_nopush          on;
    tcp_nodelay         off;
    #keepalive_timeout   65;
    types_hash_max_size 2048;

    # Default HTTP server on 80 port
    server {
        listen       192.168.1.10:80 default_server;
        #listen       [::]:80 default_server;
        server_name  foo-dev.domain.com;
        return 301 https://$host$request_uri;
    }

    # Default HTTPS server on 443 port
    server {
      listen 443;
      server_name foo-dev.domain.com;
      ssl_certificate           /etc/ssl/certs/foo-dev.domain.com.crt;
      ssl_certificate_key       /etc/ssl/certs/foo-dev.domain.com.key;

      ssl on;
      ssl_session_cache  builtin:1000  shared:SSL:10m;
      ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
      ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
      ssl_prefer_server_ciphers on;

      access_log            /var/log/nginx/foo-dev.domain.com.access.ssl.log;
        # Reverse proxy access to foo hospitality service implementation at BC back-end
        location /AppEndPoint {
          proxy_set_header               Host $host;
          proxy_set_header               X-Real-IP $remote_addr;
          proxy_set_header               X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header               X-Forwarded-Proto $scheme;
          proxy_max_temp_file_size      0;
          client_max_body_size           10m;
          client_body_buffer_size        128k;
          proxy_send_timeout             90;
          proxy_read_timeout             90;
          proxy_buffering                off;
          proxy_buffer_size              4k;
          proxy_buffers                  4 32k;
          proxy_busy_buffers_size        64k;
          proxy_temp_file_write_size     64k;
          proxy_pass                            http://foo-dev.domain.com:8080;
        }

        # Reverse proxy to access Glassfish Admin server
         location /Glassfish {
        proxy_set_header               Host $host;
      proxy_set_header               X-Real-IP $remote_addr;
      proxy_set_header               X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header               X-Forwarded-Proto $scheme;
      proxy_max_temp_file_size      0;
      client_max_body_size           10m;
      client_body_buffer_size        128k;
      proxy_send_timeout             90;
      proxy_read_timeout             90;
      proxy_buffering                off;
      proxy_buffer_size              4k;
      proxy_buffers                  4 32k;
      proxy_busy_buffers_size        64k;
      proxy_temp_file_write_size     64k;
      proxy_pass                            http://127.0.0.1:4848;
    }

        # Reverse proxy access to all processed servers by both client and server component
        location /messages {
          alias /integration/archive/app-messages/;
          autoindex on;
          #auth_basic "Integration Team Login";
          #auth_basic_user_file /integration/archive/app-messages/requests/.htpasswd;

        }
   }
}

/ AppEndPoint位置块是Glassfish应用程序服务器，它可以正常工作，它只是/ Glassfish的位置块给我带来了麻烦。

Answer 1

仅更改 https

的 http 的 proxy_pass

location / {
proxy_pass https://localhost:4848;
#proxy_http_version 1.1;
#proxy_set_header Upgrade $http_upgrade;
#proxy_set_header Connection 'upgrade';
#proxy_set_header Host $host;
#proxy_cache_bypass $http_upgrade;
}

无法通过nginx位置和代理传递访问Glassfish4管理控制台

1 个答案: