Produced by Araxis Merge on 10/3/2017 11:15:18 AM Central Daylight Time. See www.araxis.com for information about Merge. This report uses XHTML and CSS2, and is best viewed with a modern standards-compliant browser. For optimum results when printing this report, use landscape orientation and enable printing of background images and colours in your browser.
| # | Location | File | Last Modified |
|---|---|---|---|
| 1 | ehmp.zip\ehmp\ehmp\product\production\mockssoiservlet | proxy_balancer.conf | Tue Jan 10 16:20:50 2017 UTC |
| 2 | ehmp.zip\ehmp\ehmp\product\production\mockssoiservlet | proxy_balancer.conf | Mon Oct 2 19:47:35 2017 UTC |
| Description | Between Files 1 and 2 |
|
|---|---|---|
| Text Blocks | Lines | |
| Unchanged | 8 | 598 |
| Changed | 7 | 14 |
| Inserted | 0 | 0 |
| Removed | 0 | 0 |
| Whitespace | |
|---|---|
| Character case | Differences in character case are significant |
| Line endings | Differences in line endings (CR and LF characters) are ignored |
| CR/LF characters | Not shown in the comparison detail |
No regular expressions were active.
| 1 | #LoadModul e rewrite_ module mod ules/mod_r ewrite.so | |
| 2 | #LoadModul e proxy_ba lancer_mod ule module s/mod_prox y_balancer .so | |
| 3 | ||
| 4 | ## | |
| 5 | ## SSL Vir tual Host Context | |
| 6 | ## | |
| 7 | ||
| 8 | <VirtualHo st *:443> | |
| 9 | ||
| 10 | He ader alway s set Stri ct-Transpo rt-Securit y "max-age =31536000" | |
| 11 | ||
| 12 | <I fModule mo d_autoinde x.c> | |
| 13 | Options -Indexes | |
| 14 | </ IfModule> | |
| 15 | ||
| 16 | # TODO: mod_ gzip inste ad? | |
| 17 | <I fModule mo d_deflate. c> | |
| 18 | # Compre ss HTML, C SS, JavaSc ript, Text , XML and fonts | |
| 19 | AddOutpu tFilterByT ype DEFLAT E applicat ion/javasc ript | |
| 20 | AddOutpu tFilterByT ype DEFLAT E applicat ion/json | |
| 21 | AddOutpu tFilterByT ype DEFLAT E applicat ion/rss+xm l | |
| 22 | AddOutpu tFilterByT ype DEFLAT E applicat ion/vnd.ms -fontobjec t | |
| 23 | AddOutpu tFilterByT ype DEFLAT E applicat ion/x-font | |
| 24 | AddOutpu tFilterByT ype DEFLAT E applicat ion/x-font -opentype | |
| 25 | AddOutpu tFilterByT ype DEFLAT E applicat ion/x-font -otf | |
| 26 | AddOutpu tFilterByT ype DEFLAT E applicat ion/x-font -truetype | |
| 27 | AddOutpu tFilterByT ype DEFLAT E applicat ion/x-font -ttf | |
| 28 | AddOutpu tFilterByT ype DEFLAT E applicat ion/x-java script | |
| 29 | AddOutpu tFilterByT ype DEFLAT E applicat ion/xhtml+ xml | |
| 30 | AddOutpu tFilterByT ype DEFLAT E applicat ion/xml | |
| 31 | AddOutpu tFilterByT ype DEFLAT E font/ope ntype | |
| 32 | AddOutpu tFilterByT ype DEFLAT E font/otf | |
| 33 | AddOutpu tFilterByT ype DEFLAT E font/ttf | |
| 34 | AddOutpu tFilterByT ype DEFLAT E image/sv g+xml | |
| 35 | AddOutpu tFilterByT ype DEFLAT E image/x- icon | |
| 36 | AddOutpu tFilterByT ype DEFLAT E text/css | |
| 37 | AddOutpu tFilterByT ype DEFLAT E text/htm l | |
| 38 | AddOutpu tFilterByT ype DEFLAT E text/jav ascript | |
| 39 | AddOutpu tFilterByT ype DEFLAT E text/pla in | |
| 40 | AddOutpu tFilterByT ype DEFLAT E text/xml | |
| 41 | ||
| 42 | # Remove browser b ugs (only needed for really ol d browsers ) | |
| 43 | BrowserM atch ^Mozi lla/4 gzip -only-text /html | |
| 44 | BrowserM atch ^Mozi lla/4\.0[6 78] no-gzi p | |
| 45 | BrowserM atch \bMSI E !no-gzip !gzip-onl y-text/htm l | |
| 46 | Header a ppend Vary User-Agen t | |
| 47 | </ IfModule> | |
| 48 | ||
| 49 | # Configure proxy-bala ncer | |
| 50 | Pr oxyRequest s off | |
| 51 | ||
| 52 | Se rverName w eb.vistaco re.us | |
| 53 | ||
| 54 | <P roxy balan cer://web- cluster> | |
| 55 | BalancerMe mber http: // IP | |
| 56 | # Se curity "te chnically we aren't blocking | |
| 57 | # an yone but t his the pl ace to mak e those | |
| 58 | # ch ages | |
| 59 | Orde r Deny,All ow | |
| 60 | Deny from none | |
| 61 | Allo w from all | |
| 62 | ||
| 63 | # Lo ad Balance r Settings for ehmp static web | |
| 64 | # We will be c onfiguring a simple Round | |
| 65 | # Ro bin style load balan cer. This means | |
| 66 | # th at all web heads take an equal share of | |
| 67 | # of the load. | |
| 68 | # st ickysessio n=JSESSION ID | |
| 69 | ProxySet l bmethod=by requests s tickysessi on=JSESSIO NID | |
| 70 | ||
| 71 | </ Proxy> | |
| 72 | ||
| 73 | <P roxy balan cer://rdk- cluster> | |
| 74 | BalancerMe mber http: // IP | |
| 75 | ||
| 76 | # Se curity "te chnically we aren't blocking | |
| 77 | # an yone but t his the pl ace to mak e those | |
| 78 | # ch ages | |
| 79 | Orde r Deny,All ow | |
| 80 | Deny from none | |
| 81 | Allo w from all | |
| 82 | ||
| 83 | # Lo ad Balance r Settings | |
| 84 | # We will be c onfiguring a simple Round | |
| 85 | # Ro bin style load balan cer. This means | |
| 86 | # th at all web heads take an equal share of | |
| 87 | # of the load. | |
| 88 | # st ickysessio n=JSESSION ID | |
| 89 | ProxySet l bmethod=by requests s tickysessi on=JSESSIO NID | |
| 90 | ||
| 91 | </ Proxy> | |
| 92 | ||
| 93 | <P roxy balan cer://writ e-back-clu ster> | |
| 94 | BalancerMe mber http: // IP | |
| 95 | ||
| 96 | # Se curity "te chnically we aren't blocking | |
| 97 | # an yone but t his the pl ace to mak e those | |
| 98 | # ch ages | |
| 99 | Orde r Deny,All ow | |
| 100 | Deny from none | |
| 101 | Allo w from all | |
| 102 | ||
| 103 | # Lo ad Balance r Settings | |
| 104 | # We will be c onfiguring a simple Round | |
| 105 | # Ro bin style load balan cer. This means | |
| 106 | # th at all web heads take an equal share of | |
| 107 | # of the load. | |
| 108 | # st ickysessio n=JSESSION ID | |
| 109 | ProxySet l bmethod=by requests s tickysessi on=JSESSIO NID | |
| 110 | ||
| 111 | </ Proxy> | |
| 112 | ||
| 113 | <P roxy balan cer://pick -list-clus ter> | |
| 114 | BalancerMe mber http: // IP | |
| 115 | ||
| 116 | # Se curity "te chnically we aren't blocking | |
| 117 | # an yone but t his the pl ace to mak e those | |
| 118 | # ch ages | |
| 119 | Orde r Deny,All ow | |
| 120 | Deny from none | |
| 121 | Allo w from all | |
| 122 | ||
| 123 | # Lo ad Balance r Settings | |
| 124 | # We will be c onfiguring a simple Round | |
| 125 | # Ro bin style load balan cer. This means | |
| 126 | # th at all web heads take an equal share of | |
| 127 | # of the load. | |
| 128 | # st ickysessio n=JSESSION ID | |
| 129 | ProxySet l bmethod=by requests s tickysessi on=JSESSIO NID | |
| 130 | ||
| 131 | </ Proxy> | |
| 132 | ||
| 133 | # allow acce ss to the uri's repr esenting e ach compon ent | |
| 134 | <L ocation /w rite-pick- list> | |
| 135 | Orde r deny,all ow | |
| 136 | Allo w from all | |
| 137 | </ Location> | |
| 138 | <L ocation /w rite-healt h-data> | |
| 139 | Orde r deny,all ow | |
| 140 | Allo w from all | |
| 141 | </ Location> | |
| 142 | <L ocation /r esource> | |
| 143 | Orde r deny,all ow | |
| 144 | Allo w from all | |
| 145 | </ Location> | |
| 146 | <L ocation /> | |
| 147 | Orde r deny,all ow | |
| 148 | Allo w from all | |
| 149 | </ Location> | |
| 150 | ||
| 151 | ||
| 152 | # Point of B alance | |
| 153 | # This setti ng will al low to exp licitly na me the | |
| 154 | # the locati on in the site that we want to be | |
| 155 | # balanced, in this ex ample we w ill balanc e "/" | |
| 156 | # or everyth ing in the site. | |
| 157 | ||
| 158 | Pr oxyPass /b alancer-ma nager ! | |
| 159 | ||
| 160 | Pr oxyPass /r esource/wr ite-pick-l ist balanc er://pick- list-clust er/resourc e/write-pi ck-list | |
| 161 | ||
| 162 | Pr oxyPass /r esource/wr ite-health -data bala ncer://wri te-back-cl uster/reso urce/write -health-da ta | |
| 163 | ||
| 164 | # traffic to rdk | |
| 165 | Pr oxyPass /r esource ba lancer://r dk-cluster /resource | |
| 166 | ||
| 167 | # mockssoi endpoint | |
| 168 | ProxyPass /mockssoi http:// IP /mockssoi | |
| 169 | ||
| 170 | # send the r est to sta tic ehmp w eb | |
| 171 | Pr oxyPass / balancer:/ /web-clust er/ | |
| 172 | ||
| 173 | ||
| 174 | # check fo r mockssoi cookie | |
| 175 | # if not f ound send to mocksso i login | |
| 176 | # else add headers f rom cookie then cont inue to eh mp web | |
| 177 | ||
| 178 | RewriteEng ine On | |
| 179 | ||
| 180 | RewriteCon d %{HTTP_C OOKIE} !^. *mockssoi. *$ [NC] | |
| 181 | RewriteRul e ^/$ http s:// IP /mockssoi/ ?TARGET=ht tps:// IP [NC,L] | |
| 182 | ||
| 183 | RewriteCon d %{HTTP_C OOKIE} \\" firstname\ \":\\"(.*? )\\" | |
| 184 | RewriteRul e . - [E=F IRSTNAME:% 1] | |
| 185 | RequestHea der set FI RSTNAME "% {FIRSTNAME }e" env=FI RSTNAME | |
| 186 | ||
| 187 | RewriteCon d %{HTTP_C OOKIE} \\" lastname\\ ":\\"(.*?) \\" | |
| 188 | RewriteRul e . - [E=L ASTNAME:%1 ] | |
| 189 | RequestHea der set LA STNAME "%{ LASTNAME}e " env=LAST NAME | |
| 190 | ||
| 191 | RewriteCon d %{HTTP_C OOKIE} \\" role\\":\\ "(.*?)\\" | |
| 192 | RewriteRul e . - [E=R OLE:%1] | |
| 193 | RequestHea der set RO LE "%{ROLE }e" env=RO LE | |
| 194 | ||
| 195 | RewriteCon d %{HTTP_C OOKIE} \\" site\\":\\ "(.*?)\\" | |
| 196 | RewriteRul e . - [E=S ITE:%1] | |
| 197 | RequestHea der set SI TE "%{SITE }e" env=SI TE | |
| 198 | ||
| 199 | RewriteCon d %{HTTP_C OOKIE} \\" duz\\":\\" (.*?)\\" | |
| 200 | RewriteRul e . - [E=D UZ:%1] | |
| 201 | RequestHea der set DU Z "%{DUZ}e " env=DUZ | |
| 202 | ||
| 203 | RewriteCon d %{HTTP_C OOKIE} \\" adEmail\\" :\\"(.*?)\ \" | |
| 204 | RewriteRul e . - [E=A DEMAIL:%1] | |
| 205 | RequestHea der set AD EMAIL "%{A DEMAIL}e" env=ADEMAI L | |
| 206 | ||
| 207 | RewriteCon d %{HTTP_C OOKIE} \\" adDomain\\ ":\\"(.*?) \\" | |
| 208 | RewriteRul e . - [E=A DDOMAIN:%1 ] | |
| 209 | RequestHea der set AD DOMAIN "%{ ADDOMAIN}e " env=ADDO MAIN | |
| 210 | ||
| 211 | RewriteCon d %{HTTP_C OOKIE} \\" adUpn\\":\ \"(.*?)\\" | |
| 212 | RewriteRul e . - [E=A DUPN:%1] | |
| 213 | RequestHea der set AD UPN "%{ADU PN}e" env= ADUPN | |
| 214 | ||
| 215 | RewriteCon d %{HTTP_C OOKIE} \\" adSamAccou ntName\\": \\"(.*?)\\ " | |
| 216 | RewriteRul e . - [E=A DSAMACCOUN TNAME:%1] | |
| 217 | RequestHea der set AD SAMACCOUNT NAME "%{AD SAMACCOUNT NAME}e" en v=ADSAMACC OUNTNAME | |
| 218 | ||
| 219 | RewriteCon d %{HTTP_C OOKIE} \\" uid\\":\\" (.*?)\\" | |
| 220 | RewriteRul e . - [E=U ID:%1] | |
| 221 | RequestHea der set VA UID "%{UID }e" env=UI D | |
| 222 | ||
| 223 | RewriteCon d %{HTTP_C OOKIE} \\" username\\ ":\\"(.*?) \\" | |
| 224 | RewriteRul e . - [E=U SERNAME:%1 ] | |
| 225 | RequestHea der set AC CESSCODE " %{USERNAME }e" env=US ERNAME | |
| 226 | ||
| 227 | RewriteCon d %{HTTP_C OOKIE} \\" pwd\\":\\" (.*?)\\" | |
| 228 | RewriteRul e . - [E=P WD:%1] | |
| 229 | RequestHea der set VE RIFYCODE " %{PWD}e" e nv=PWD | |
| 230 | ||
| 231 | RewriteCon d %{HTTP_C OOKIE} \\" vistaId\\" :\\"(.*?)\ \" | |
| 232 | RewriteRul e . - [E=V ISTAID:%1] | |
| 233 | RequestHea der set VI STAID "%{V ISTAID}e" env=VISTAI D | |
| 234 | ||
| 235 | # if no VI STAID goto new page | |
| 236 | RewriteCon d %{HTTP_C OOKIE} ^.* mockssoi.* $ [NC] | |
| 237 | RewriteCon d %{ENV:VI STAID} ^$ | |
| 238 | RewriteCon d %{QUERY_ STRING} !^ code=NV$ [ NC] | |
| 239 | RewriteRul e ^/$ http s:// IP /?code=NV [NC,L] | |
| 240 | ||
| 241 | ||
| 242 | <I fModule mo d_headers. c> | |
| 243 | Head er always edit Set-C ookie ^(.* )$ "$1; Se cure" | |
| 244 | Head er edit Se t-Cookie ^ (.*)$ "$1; Secure" | |
| 245 | </ IfModule> | |
| 246 | ||
| 247 | # SSL Virtua lHost dire ctives | |
| 248 | ||
| 249 | Do cumentRoot /var/www | |
| 250 | ||
| 251 | # mod_nss ca n log to s eparate lo g files, y ou can cho ose to do that if yo u'd like | |
| 252 | # LogLevel i s not inhe rited from httpd.con f. | |
| 253 | Er rorLog log s/ssl_erro r_log | |
| 254 | Tr ansferLog logs/ssl_a ccess_log | |
| 255 | Lo gLevel war n | |
| 256 | ||
| 257 | # SSL Engi ne Switch: | |
| 258 | # Enable/D isable SSL for this virtual ho st. | |
| 259 | NS SEngine on | |
| 260 | ||
| 261 | # FIPS mod e Switch: | |
| 262 | # Enable/D isable FIP S mode | |
| 263 | NS SFips on | |
| 264 | ||
| 265 | # SSL Ciph er Suite: | |
| 266 | # List the c iphers tha t the clie nt is perm itted to n egotiate. | |
| 267 | # See the mo d_nss docu mentation for a comp lete list. | |
| 268 | ||
| 269 | # SSL 3 ciph ers. SSL 2 is disabl ed by defa ult. | |
| 270 | NS SCipherSui te -rsa_rc 4_128_md5, -rsa_rc4_1 28_sha,+rs a_3des_sha ,-rsa_des_ sha,-rsa_r c4_40_md5, -rsa_rc2_4 0_md5,-rsa _null_md5, -rsa_null_ sha,+fips_ 3des_sha,- fips_des_s ha,-fortez za,-fortez za_rc4_128 _sha,-fort ezza_null, -rsa_des_5 6_sha,-rsa _rc4_56_sh a,+rsa_aes _128_sha,+ rsa_aes_25 6_sha | |
| 271 | ||
| 272 | # SSL Prot ocol: | |
| 273 | # Cryptogr aphic prot ocols that provide c ommunicati on securit y. | |
| 274 | # NSS hand les the sp ecified pr otocols as "ranges", and autom atically | |
| 275 | # negotiat es the use of the st rongest pr otocol for a connect ion starti ng | |
| 276 | # with the maximum s pecified p rotocol an d downgrad ing as nec essary to the | |
| 277 | # minimum specified protocol t hat can be used betw een two pr ocesses. | |
| 278 | # Since al l protocol ranges ar e complete ly inclusi ve, and no protocol in the | |
| 279 | # middle o f a range may be exc luded, the entry "NS SProtocol SSLv3,TLSv 1.1" | |
| 280 | # is ident ical to th e entry "N SSProtocol SSLv3,TLS v1.0,TLSv1 .1". | |
| 281 | NS SProtocol TLSv1.0,TL Sv1.1 | |
| 282 | ||
| 283 | # SSL Cert ificate Ni ckname: | |
| 284 | # The nick name of th e RSA serv er certifi cate you a re going t o use. | |
| 285 | NS SNickname Server-Cer t | |
| 286 | ||
| 287 | # Server C ertificate Database: | |
| 288 | # The NSS security d atabase di rectory th at holds t he certifi cates and | |
| 289 | # keys. Th e database consists of 3 files : cert8.db , key3.db and secmod .db. | |
| 290 | # Provide the direct ory that t hese files exist. | |
| 291 | NS SCertifica teDatabase /etc/http d/ssl | |
| 292 | ||
| 293 | # Database Prefix: | |
| 294 | # In order to be abl e to store multiple NSS databa ses in one directory | |
| 295 | # they nee d unique n ames. This option se ts the dat abase pref ix used fo r | |
| 296 | # cert8.db and key3. db. | |
| 297 | #N SSDBPrefix my-prefix - | |
| 298 | ||
| 299 | # Per-Serv er Logging : | |
| 300 | # The home of a cust om SSL log file. Use this when you want a | |
| 301 | # compact non-error SSL logfil e on a vir tual host basis. | |
| 302 | Cu stomLog lo gs/ssl_req uest_log \ | |
| 303 | "% t %h %{SSL _PROTOCOL} x %{SSL_CI PHER}x \"% r\" %b" | |
| 304 | ||
| 305 | </VirtualH ost> | |
| 306 |
Araxis Merge (but not the data content of this report) is Copyright © 1993-2016 Araxis Ltd (www.araxis.com). All rights reserved.