Documentation Home
> Oracle iPlanet Web Proxy Server 4.0.14 Administration Guide
Oracle iPlanet Web Proxy Server 4.0.14 Administration Guide
Book Information
Index
A
B
C
D
E
F
G
H
I
J
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Preface
Chapter 1 Introducing iPlanet Web Proxy Server
About Proxy Server
New in This Release
Getting Started
Administration Server Overview
To Access the Administration Server
Server Manager Overview
To Access the Server Manager
Configuration Files
Regular Expressions
Chapter 2 Administering Proxy Server
Starting the Administration Server
To Start the Administration Server on UNIX or Linux
To Start the Administration Server on Windows
Stopping the Administration Server
To Stop the Administration Server on UNIX or Linux
To Stop the Administration Server on Windows
Running Multiple Proxy Servers
To Install multiple server instances
Removing a Server Instance
To Remove a Server Instance
Migrating From Proxy Server 3.6
Chapter 3 Setting Administration Preferences
Creating and Managing Listen Sockets
To Add Listen Sockets
To Edit Listen Sockets
To Delete Listen Sockets
Changing Superuser Settings
To Change Superuser Settings for the Administration Server
To Change the Superuser Password
Allowing Multiple Administrators
To Enable Distributed Administration
Specifying Log File Options
Viewing Log Files
Access Log File
To View the Access Log File
Error Log File
To View the Error Log File
Using Directory Services
Restricting Server Access
SNMP Master Agent Settings
Chapter 4 Managing Users and Groups
Accessing Information About Users and Groups
About Directory Services
LDAP Directory Services
Key File Directory Services
Digest File Directory Services
Configuring Directory Services
To Create Directory Services
To Edit Directory Services
Understanding Distinguished Names (DNs)
Using LDIF
Creating Users
Creating Users in LDAP-based Authentication Databases
Guidelines for Creating LDAP-based User Entries
Directory Server User Entries
Creating LDAP-Based User Entries
To Create Users in LDAP-based Authentication Databases
Creating Users in Key File Authentication Databases
To Create Users in Key File Authentication Databases
Creating Users in Digest File Authentication Databases
To Create Users in Digest File Authentication Databases
Managing Users
Finding User Information
Building Custom Search Queries
To find user information
Editing User Information
To Edit User Entries
Managing User Passwords
To Change or Create User Passwords
Renaming Users
To Rename User Entries
Removing Users
To Remove User Entries
Creating Groups
About Static Groups
Guidelines for Creating Static Groups
To Create Static Groups
About Dynamic Groups
How Dynamic Groups Are Implemented
Dynamic Group Impact on Server Performance
Guidelines for Creating Dynamic Groups
Creating Dynamic Groups
To Create Dynamic Groups
Managing Groups
Finding Group Entries
To Find Group Entries
Find All Groups Whose
Editing Group Entries
To Edit Group Entries
Adding Group Members
To Add Members to a Group
Adding Groups to the Group Members List
Removing Entries From the Group Members List
To Remove Entries From the Group Members List
Managing Owners
Managing See Alsos
Renaming Groups
To Rename Groups
Removing Groups
To Remove Groups
Creating Organizational Units
To Create Organizational Units
Managing Organizational Units
Finding Organizational Units
To find organizational units
Find All Units Whose
Editing Organizational Unit Attributes
To Edit Organizational Unit Entries
Renaming Organizational Units
To Rename Organizational Units
Removing Organizational Units
To Delete Organizational Units
Chapter 5 Using Certificates and Keys
Securing Administration Server Access
Certificate-based Authentication
Creating a Trust Database
To Create a Trust Database
Using password.conf
Starting an SSL-Enabled Server Automatically
To start an SSL-Enabled Server Automatically
Using Sun Crypto Accelerator Keystore
To Configure Proxy Server to Use Sun Crypto Accelerator
To Enable the Sun Crypto Accelerator 4000 Board for Proxy Server
Requesting and Installing a VeriSign Certificate
To Request a VeriSign Certificate
To Iinstall a VeriSign Certificate
Requesting and Installing Other Server Certificates
Required CA Information
Requesting Other Server Certificates
To Request Other Server Certificates
Installing Other Server Certificates
To Install Other Server Certificates
Migrating Certificates From Previous Versions
To Migrate a Certificate
Using the Built-in Root Certificate Module
Managing Certificates
To Manage Certificates
Installing and Managing CRLs and CKLs
To Install CRLs or CKLs
To Manage CRLs and CKLs
Setting Security Preferences
SSL and TLS Protocols
Using SSL to Communicate With LDAP
To enable LDAP with SSL connection on your Administration Server
Tunneling SSL Through the Proxy Server
Configuring SSL Tunneling
To configure SSL tunneling
Technical Details for SSL Tunneling
Enabling Security for Listen Sockets
Turning Security On
To Turn Security on When Creating Listen Sockets
To Turn Security on When Editing Listen Sockets
Selecting Server Certificates for Listen Sockets
To Select a Server Certificate for a Listen Socket
Selecting Ciphers
To Enable SSL and TLS
Configuring Security Globally
SSLSessionTimeout
SSLCacheEntries
SSL3SessionTimeout
To Set Values for SSL Configuration File Directives
Using External Encryption Modules
Installing the PKCS #11 Module
Using the Tool modutil to Install PKCS #11 Modules
To Install PKCS #11 modules using the Tool modutil
Exporting with the tool pk12util
To Export a Certificate and Key From an Internal Database
To Import a Certificate and Key Into an Internal or External PKCS #11 Module
Starting the Server With an External Certificate
To Select the Certificate Name for a Listen Socket
FIPS-140 Standard
To Enable FIPS-140
Setting Client Security Requirements
Requiring Client Authentication
To Require Client Authentication
Client Authentication in a Reverse Proxy
Setting Up Client Authentication in a Reverse Proxy
To Configure the Proxy-Authenticates-Client Scenario
To Configure the Content Server-Authenticates-Proxy Scenario
To Configure the Proxy-Authenticates-Client and Content Server-Authenticates-Proxy scenario
Mapping Client Certificates to LDAP
Using the certmap.conf File
Creating Custom Properties
Sample Mappings
Example #1 certmap.conf File With Only One Default Mapping
Example #2 certmap.conf File With Two Mappings
Example #3 Searching the LDAP Database
Setting Stronger Ciphers
To Set Stronger Ciphers
Other Security Considerations
Limiting Physical Access
Limiting Administration Access
Choosing Strong Passwords
Creating Hard-to-Crack Passwords
Changing Passwords or PINs
To Change the Trust Database/Key-Pair File Password
Limiting Other Applications on the Server
UNIX and Linux
Windows
Preventing Clients From Caching SSL Files
Limiting Ports
Knowing Your Server’s Limits
Chapter 6 Managing Server Clusters
About Server Clusters
Guidelines for Using Clusters
Setting Up Clusters
Adding Servers to a Cluster
To Add Remote Servers to a Cluster
Modifying Server Information
To Modify Information About Servers in a Cluster
Removing Servers from a Cluster
To remove servers from a cluster
Controlling Server Clusters
To Control Servers in a Cluster
Chapter 7 Configuring Server Preferences
Starting the Proxy Server
To Start the Proxy Server From the Administration Interface
To Start the Proxy Server on UNIX or Linux
To Start the Proxy Server on Windows
Starting SSL-Enabled Servers
Stopping the Proxy Server
To Stop the Proxy Server From the Administration Interface
To Stop the Proxy Server on UNIX or Linux
To Stop the Proxy Server on Windows
Restarting the Proxy Server
Restarting the Server UNIX or Linux
To Restart the Proxy Server From the Command Line
To Restart the Server Using inittab
To Restart the Server Using System RC Scripts
Restarting the Server Windows
To Restart the Server on Windows
Setting the Termination Timeout
Viewing Server Settings
To View the Settings for the Proxy Server
Viewing and Restoring Backups of Configuration Files
To View a Previous Configuration
To Restore a Backup Copy of Your Configuration Files
To Set the Number of Backups Displayed
Configuring System Preferences
To Modify the System Preferences
Tuning the Proxy Server
To Change the Default Tuning Parameters
Adding and Editing Listen Sockets
To Add Listen Sockets
To Edit Listen Sockets
To Delete Listen Sockets
Selecting Directory Services
To Select a Directory Service
MIME Types
Creating a MIME Type
To Create a MIME Type
To Edit a MIME Type
To Remove a MIME Type
Administering Access Control
To Manage Access Control Lists
Configuring the ACL Cache
To Configure the ACL Cache
Understanding DNS Caching
Configuring the DNS Cache
To Configure the DNS Cache
Configuring DNS Subdomains
To Set the Levels of Subdomains For Proxy Lookup
Configuring HTTP Keep-Alive
To Configure HTTP Keep-Alive
Chapter 8 Controlling Access to Your Server
What Is Access Control?
Access Control for User-Group
Default Authentication
Basic Authentication
SSL Authentication
Digest Authentication
Installing the Digest Authentication Plug-in
Installing the Digest Authentication Plug-in on UNIX
To Install the Digest Authentication Plug-in on UNIX
Installing the Digest Authentication Plug-in on Windows
To Install the Digest Authentication Plug-in on Windows
Setting Oracle Directory Server Enterprise Edition to Use the DES Algorithm
To Set Directory Server to Use the DES algorithm
Other Authentication
Access Control for Host-IP
Using Access Control Files
Configuring the ACL User Cache
Controlling Access With Client Certificates
How Access Control Works
Setting Access Control
Setting Access Control Globally
To Set Access Control for All Servers
Setting Access Control for a Server Instance
To Set Access Control for a Server Instance
Selecting Access Control Options
Setting the Action
Specifying Users and Groups
Specifying the From Host
Restricting Access to Programs
Setting Access Rights
Writing Customized Expressions
Turning Access Control Off
Responding When Access Is Denied
To Change the Access Denied Message
Limiting Access to Areas of Your Server
Restricting Access to the Entire Server
To Restrict Access to the Entire Server
Restricting Access to a Directory
To Restrict Access to Directories
Restricting Access to a File Type
To Restrict Access to File Types
Restricting Access Based on Time of Day
To Restrict Access Based on Time of Day
Restricting Access Based on Security
To Restrict Access Based on Security
Securing Access to Resources
Securing Access to Server Instances
Enabling IP-Based Access Control
To Enable IP-Based Access Control
Creating ACLs for File-Based Authentication
Creating ACLs for Directory Services Based on File Authentication
To Create ACLs for Directory Services Based on File Authentication
Creating ACLs for Directory Services Based on Digest Authentication
To Create ACLs for Directory Services Based on Digest Authentication
Chapter 9 Using Log Files
About Log Files
Logging on UNIX and Windows Platforms
Default Error Logging
Logging Using syslog
Log Levels
Archiving Log Files
Internal-Daemon Log Rotation
Scheduler-based Log Rotation
Setting Access Log Preferences
To Set the Access Log Preferences for the Administration Server
Setting Access Log Preferences for the Server Instance
To Set the Access Log Preferences for the Server Instance
Easy Cookie Logging
Setting Error Logging Options
To Set the Error Logging Options
Configuring the LOG Element
Viewing Access Log Files
Viewing Error Log Files
Working With the Log Analyzer
Transfer Time Distribution Report
Data Flow Report
Status Code Report
Requests and Connections Report
Cache Performance Report
Client Cache
Proxy Cache
Proxy Cache Hits Combined
Direct Transactions
Transfer Time Report
Hourly Activity Report
To Run the Log Analyzer From the Server Manager
To Run the Log Analyzer From the Command Line
Viewing Events (Windows)
To Use the Event Viewer
Chapter 10 Monitoring Servers
Monitoring the Server Using Statistics
Processing Proxy Server Statistics
Restricting Access to the stats-xml Output
Enabling Statistics
To Enable Statistics From the Server Manager
To Enable Statistics Using stats-xml
Using Statistics
Displaying Statistics in the Server Manager
To Access statistics
Monitoring Current Activity Using the perfdump Utility
Enabling the perfdump Utility
To Enable the perfdump SAF
Sample perfdump Output
Restricting Access to the perfdump Output
Using Performance Buckets
Configuration
Performance Report
SNMP Basics
Management Information Base
Setting Up SNMP
Using a Proxy SNMP Agent (UNIX)
Installing the Proxy SNMP Agent
To install the Proxy SNMP Agent
Starting the Proxy SNMP Agent
Restarting the Native SNMP Daemon
Reconfiguring the SNMP Native Agent
Installing the SNMP Master Agent
To Install the Master SNMP Agent
Enabling and Starting the SNMP Master Agent
Starting the Master Agent on Another Port
To Manually Start the Master Agent on Another Port
Manually Configuring the SNMP Master Agent
To Configure the Master SNMP Agent Manually
Editing the Master Agent CONFIG File
To configure the master SNMP agent manually
Defining sysContact and sysLocation Variables
Configuring the SNMP Subagent
To Configure the SNMP Subagent
Starting the SNMP Master Agent
To Start the SNMP Master Agent Manually
To start the SNMP Master Agent Using the Administration Server
Configuring the SNMP Master Agent
Configuring the Community String
Configuring Trap Destinations
Enabling the Subagent
Understanding SNMP Messages
Chapter 11 Proxying and Routing URLs
Enabling/Disabling Proxying for a Resource
To Enable Proxying for a Resource
Routing Through Another Proxy
Configuring Routing for a Resource
To Configure Routing for a Resource
Chaining Proxy Servers
To Route Through Another Proxy Server
Routing Through a SOCKS Server
To Route Through a SOCKS server
Next Steps
Forwarding the Client IP Address to the Server
To Configure the Proxy to Send Client IP Addresses
Allowing Clients to Check IP Address
To Check the Java IP Address
Client Autoconfiguration
Setting the Network Connectivity Mode
To Change the Running Mode for the Proxy Server
Changing the Default FTP Transfer Mode
To Set the FTP Mode
Specifying the SOCKS Name Server IP Address
To Specify the SOCKS Name Server IP Address
Configuring HTTP Request Load Balancing
To Configure HTTP Request Load Balancing
Managing URLs and URL Mappings
Creating and Modifying URL Mappings
To create a URL mapping
To Change Your Existing Mappings
To Remove a Mapping
Redirecting URLs
To Redirect One or More URLs
Chapter 12 Caching
How Caching Works
Understanding the Cache Structure
Distributing Files in the Cache
Setting Cache Specifics
To Set Cache Specifics
Creating a Cache Working Directory
Setting Cache Size
Caching HTTP Documents
Setting the HTTP Cache Refresh Interval
Setting the HTTP Cache Expiration Policy
Reporting HTTP Accesses to the Remote Server
Caching FTP and Gopher Documents
Creating and Modifying a Cache
To Add Cache Partitions
To Modify Cache Partitions
Setting Cache Capacity
To set the cache capacity
Managing Cache Sections
To Manage Cache Sections
Setting the Garbage Collection Preferences
Scheduling Garbage Collection
To Set Garbage Collection
Configuring the Cache
To Configure the Cache
Caching Configuration Elements
Setting the Cache Default
Caching Pages That Require Authentication
Caching Queries
Setting Minimum and Maximum Cache File Sizes
Setting the Up-to-date Checking Policy
Setting Expiration Policy
Setting Cache Behavior for Client Interruptions
Behavior on Failure to Connect to Server
Caching Local Hosts
To Enable the Caching of Local Hosts
Configuring the File Cache
To Configure the File Cache
Viewing the URL Database
To View the URLs in the Database
To Cause Cached URLs to Expire or Remove the Cached URLs
Using Cache Batch Updates
Creating Batch Updates
To Create a Batch Update
Editing or Deleting Batch Update Configurations
To edit or delete a batch update configuration
To Delete a Batch Update Configuration
Using the Cache Command-Line Interface
To Run the Command-Line Utilities
Building the Cache Directory Structure
Managing the Cache URL List
Managing Cache Garbage Collection
Managing Batch Updates
Using the Internet Cache Protocol (ICP)
Routing Through ICP Neighborhoods
Setting Up ICP
To Add Parent or Sibling Proxies to an ICP Neighborhood
To Edit a Configuration in an ICP Neighborhood
To Remove Proxies from an ICP Neighborhood
To Configure the Local Proxy Server in Your ICP Neighborhood
To Enable ICP
To Enable Routing Through an ICP Neighborhood
Using Proxy Arrays
Routing Through Proxy Arrays
Creating a Proxy Array Member List
To Create a Proxy Array Member List
Editing Proxy Array Member List Information
To Edit Member List Information
Deleting Proxy Array Members
To Delete Members of a Proxy Array
Configuring Proxy Array Members
To Configure Each Member of the Proxy Array
Enabling Routing Through a Proxy Array
To Enable Routing Through a Proxy Array
Enabling or Disabling a Proxy Array
To Enable or Disable a Proxy Array
Redirecting Requests in a Proxy Array
Generating a PAC File From a PAT File
To manually generate a PAC file from a PAT file
To Automatically Generate a PAC File
Routing Through Parent Arrays
To Route Through a Parent Array
Viewing Parent Array Information
To View Parent Array Information
Chapter 13 Filtering Content Through the Proxy
Filtering URLs
Creating a Filter File of URLs
To Create a Filter File
Setting Default Access for a Filter File
To Set Default Access for a Filter File
Content URL Rewriting
To Create a URL Rewriting Pattern
To Edit a URL Rewriting Pattern
To Delete a URL Rewriting Pattern
Restricting Access to Specific Web Browsers
To Restrict Access to the Proxy Based on the Client’s Web Browser
Blocking Requests
To block requests based on MIME type
Suppressing Outgoing Headers
To Suppress Outgoing Headers
Filtering by MIME Type
To Filter by MIME Type
Filtering by HTML Tags
To Filter out HTML Tags
Configuring the Server for Content Compression
Configuring the Server to Compress Content on Demand
To Configure Your Server to Compress Content on Demand
Chapter 14 Using a Reverse Proxy
How Reverse Proxying Works
Proxy as a Stand-in for a Server
Secure Reverse Proxying
Proxying for Load Balancing
Setting up a Reverse Proxy
To Create Regular or Reverse Mapping
Setting Up a Secure Reverse Proxy
Secure Client-to-Proxy
To Set Up a Secure Client-to-Proxy Mapping
To Set Up a Secure Proxy-to-Content Server Mapping
To Set up Secure Client-to-Proxy and Secure Proxy-to-Content Server
Disabling the Forward Proxying Feature in a Reverse Proxy Setup
Virtual Multihosting in Reverse Proxy
Functional Details of Virtual Multihosting
To Configure Virtual Multihosting
Notes about Virtual Multihosting
Chapter 15 Using SOCKS
About SOCKS
Using the Bundled SOCKS v5 Server
To use the SOCKS
About socks5.conf
Authentication
Access Control
Logging
Tuning
Starting and Stopping the SOCKS v5 Server
To Start and Stop the SOCKS Server From the Server Manager
To Start and Stop the SOCKS Server From the Command Line
Configuring the SOCKS v5 Server
To Configure the SOCKS Server
Configuring SOCKS v5 Authentication Entries
To Create SOCKS Authentication Entries
To Edit Authentication Entries
To Delete Authentication Entries
To Move Authentication Entries
Configuring SOCKS v5 Connection Entries
To Create Connection Entries
To Edit Connection Entries
To Delete Connection Entries
To Move Connection Entries
Configuring SOCKS v5 Server Chaining
To Configure SOCKS Server Chaining
Configuring Routing Entries
To Create Routing Entries
To Create Proxy Routing Entries
To Edit Routing Entries
To Delete Routing Entries
To Move Routing Entries
Chapter 16 Managing Templates and Resources
About Templates
Understanding Regular Expressions
Understanding Wildcard Patterns
Working With Templates
To Create a Template
To Apply a Template
To Remove a Template
To Edit a Template
Removing Resources
To Remove a Resource
Chapter 17 Using the Client Autoconfiguration File
Understanding Autoconfiguration Files
What the Autoconfiguration File Does
Accessing the Proxy as a Web Server
Using PAC Files With a Reverse Proxy
Using Server Manager Pages to Create Autoconfiguration Files
To Create an Autoconfiguration File using The Server Manager
Creating Autoconfiguration Files Manually
FindProxyForURL() Function
JavaScript Functions and Environment
Hostname-Based Functions
dnsDomainIs()(host, domain)
Parameters
Return Values
Examples
isInNet()(host, pattern, mask)
Parameters:
Return Values
Examples
isPlainhost name()(host)
Parameters
Return Values
Example
isResolvable()(host)
Parameters
Return Values
Example
localHostOrDomainIs()(host, hostdom)
Parameters
Return Values
Examples
Utility Functions
dnsDomainLevels()(host)
Parameters
Return Value
Examples
dnsResolve()(host)
Parameters
Return Value
Example
myIpAddress()()
Return Value
Example:
URL/Host-Name-Based Condition
shExpMatch()(str, shexp)
Parameters
Returns Values
Examples
Time-Based Conditions
dateRange() (day, month, year...)
Parameters
Examples
timeRange (hour, minute, second...)
Parameters:
Returns Values
Examples:
weekdayRange()(wd1, wd2, gmt)
Parameters
Examples
Function Examples
Example 1: Proxy All Servers Except Local Hosts
Example 2: Proxy Local Servers Outside the Firewall
Example 3: Proxy Only Unresolved Hosts
Example 4: Connect Directly to a Subnet
Example 5: Balance Proxy Load With dnsDomainIs()()
Example 6: Balance Proxy Load With shExpMatch()()
Example 7: Proxying a Specific Protocol
Chapter 18 ACL File Syntax
About ACL Files and ACL File Syntax
Authentication Statements
Authorization Statements
Writing Authorization Statements
Hierarchy of Authorization Statements
Attribute Expressions
Operators for Expressions
Default ACL File
General Syntax Items
Referencing ACL Files in the obj.conf File
Chapter 19 Tuning Server Performance
General Performance Considerations
Access Logging
ACL Cache Tuning
Buffer Size
Connection Timeout
Errors Log Level
Security Requirements
Solaris File System Caching
Timeout Values
init-proxy() SAF (obj.conf File)
http-client-config() SAF (obj.conf File)
KeepAliveTimeout() SAF (magnus.conf File)
Up-to-Date Checks
Last-Modified Factor
DNS Settings
Number of Threads
Inbound Connection Pool
FTP Listing Width
Cache Architecture
Cache Batch Update
Garbage Collection
gc hi margin percent Variable
gc lo margin percent Variable
gc extra margin percentVariable
gc leave fs full percent Variable
Solaris Performance Tuning
© 2010, Oracle Corporation and/or its affiliates