Chapter 17. Security

system.dosfilter.enable

Set to Y (default) or N to enable/disable the Denial of Service Filter.

system.dosfilter.delay-msec

Delay (in milliseconds) that is applied to all requests over the rate limit system.dosfilter.max-requests-per-sec, before they are considered at all. -1 means just reject request, 0 means no delay (throttled), otherwise it is the delay. Default: 100.

system.dosfilter.max-idle-tracker-msec

Maximum amount of time (in milliseconds) to keep track of request rates for a connection, before deciding that the user has gone away, and discarding it. Default: 30000.

system.dosfilter.max-request-msec

Maximum amount of time (in milliseconds) to allow the request to process. Default: 30000.

system.dosfilter.max-requests-per-sec

Maximum number of requests from a connection per second. Requests in excess of this are first delayed, then throttled. Default: 75.

system.dosfilter.throttle-msec

Amount of time (in milliseconds) to async wait for semaphore. Default: 30000.

system.dosfilter.throttled-requests

Number of requests over the rate limit able to be considered at once. Default: 5.

system.dosfilter.too-many-code

HTTP status code to send if there are too many requests. Default: 429 (too many requests). 503 (service unavailable) is another option.

system.dosfilter.whitelist

Comma-separated list of host names, IPv4 addresses in decimal notation A.B.C.D, and canonical (non-compressed) IPv6 addresses that will not be rate limited. IPv4 CIDR notation A.B.C.D/M is supported, IPv6 CIDR notation is not.

Note: localhost , 127.0.0.1 and 0:0:0:0:0:0:0:1 are implicitly whitelisted.

system.dosfilter.warn-interval.applog.mins

Interval (minutes) within which filter events are totaled and written as warning in the Application Log. The expiration of the interval is triggered by a filter event. Default: 5.

system.dosfilter.warn-interval.webapp.secs

Interval (seconds) within which filter events are totaled and send as Real-time Activity warning with popup message to the Admin Web App. Default: 60.

system.inetfilter.enable

Set to Y or N (default) to enable/disable the Inet Access Filter.

system.inetfilter.whitelist

A list of comma-separated list of IPv4/6 addresses, individual or in CIDR notation that are allowed access. Requests from remote addresses that do not match the whitelist are denied with HTTP error code 403.

Note: 127.0.0.1 and 0:0:0:0:0:0:0:1 are implicitly whitelisted.

system.inetfilter.whitelist.empty-allow-all

Set to Y (default) or N to enable/disable empty white list to be treated as "match all".

If N, an empty whitelist means that only 127.0.0.1 and 0:0:0:0:0:0:0:1 are allowed.

system.inetfilter.blacklist

A list of comma-separated IPv4/6 addresses, individual or in CIDR notation. Requests from remote addresses that match the list are denied with HTTP error code 403.

Black list entries are always applied, so that even if an entry matches the white list, a black list entry will override it.

Note: 127.0.0.1 and 0:0:0:0:0:0:0:1 are not allowed on the list.

system.inetfilter.warn-interval.applog.mins

Interval (minutes) within which denied requests are totaled and written as warning in the Application Log. The expiration of the interval is triggered by a InetAccessFilter event. Default: 5.

system.inetfilter.warn-interval.webapp.secs

Interval (seconds) within which denied requests are totaled and send as Real-time Activity warning with popup message to the Admin Web App. Default: 60.