Table of Contents

Block Remote Access to Management Web Apps

Introduction

It may be desireable to block access to the Jubilant Management and Jubilant Log web apps from a remote location (non-localhost). This article takes the reader through the steps to only allow access to /fjmanage and /fjterm from the local machine via http://localhost or http://127.0.0.1.

Note

These steps may disconnect Jubilant end-users. It is recommended to carry out these steps out-of-hours.

Please note it is easy to copy code block text into the clipboard. Hover the mouse over the block and select the copy icon at the top right.

Install Security Feature

These steps install the IIS "IP and Domain Restrictions" security feature.

  1. Connect to the Jubilant server via Remote Desktop.
  2. Press the Windows Start button, and type:
server
  1. Select the Server Manager application.
  2. Wait for the bar at the top of Server Manager to stop pulsing.
  3. On the menu at the top right, select Manage -> Add Roles and Features.
  4. Click the [Next >] button three times to arrive at the Select server roles step.
  5. Expand the tree Web Server (IIS) -> Web Server -> Security.
  6. Locate the IP and Domain Restrictions check box, and tick it.

IIS Feature: IP and Domain Restrictions

  1. Press [Next >] until the [Install] button appears.
  2. Press the [Install] button and wait for the install to complete.
  3. Press the [Close] button once the install has completed.
  4. Close the Server Manager.

Configure Security

FJLog

  1. Connect to the Jubilant server via Remote Desktop.
  2. Press the Windows Start button, and type:
iis
  1. Select the Internet Information Services (IIS) Manager application.
  2. Expand the tree {Machine Name} -> Sites -> Default Web Site1.
  3. Under Default Web Site left-click on fjlog.
  4. On the right-hand side of the IIS Manager (Features view), double click on the IP Address and Domain Restrictions feature icon.
  5. At the very right-hand side, under Actions, select Edit Feature Settings....
  6. Set Access for unspecified clients to Deny.
  7. Set Deny Action Type to Forbidden.

IIS Manager IP Address and Domain Restrictions Feature Settings

  1. Press the [OK] button.
  2. At the very right-hand side, under Actions, select Add Allow Entry....
  3. Select Specific IP address.
  4. Enter the IP address:
127.0.0.1
  1. Press the [OK] button.
  2. At the very right-hand side, under Actions, select Add Allow Entry....
  3. Select Specific IP address.
  4. Enter the IP address:
::1
  1. Press the [OK] button.
  2. The IP Address and Domain Restrictions window will look like this:

IIS Manager IP Address and Domain Restrictions Feature Final Settings

  1. Close the Internet Information Services (IIS) Manager application.

FJManage

These steps are the same as FJLog above, except the fjmanage folder is selected in step 5.

  1. Connect to the Jubilant server via Remote Desktop.
  2. Press the Windows Start button, and type:
iis
  1. Select the Internet Information Services (IIS) Manager application.
  2. Expand the tree {Machine Name} -> Sites -> Default Web Site2.
  3. Under Default Web Site left-click on fjmanage.
  4. On the right-hand side of the IIS Manager (Features view), double click on the IP Address and Domain Restrictions feature icon.
  5. At the very right-hand side, under Actions, select Edit Feature Settings....
  6. Set Access for unspecified clients to Deny.
  7. Set Deny Action Type to Forbidden.
  8. Press the [OK] button.
  9. At the very right-hand side, under Actions, select Add Allow Entry....
  10. Select Specific IP address.
  11. Enter the IP address:
127.0.0.1
  1. Press the [OK] button.
  2. At the very right-hand side, under Actions, select Add Allow Entry....
  3. Select Specific IP address.
  4. Enter the IP address:
::1
  1. Press the [OK] button.
  2. Close the Internet Information Services (IIS) Manager application.

Validation

The configuration changes can be validated by browsing to the web apps.

When remote desktop-ed into the Jubilant server, the following URLs will correctly connect and make the web app available:

  1. http://localhost/fjlog
  2. http://localhost/fjmanage
  3. http://127.0.0.1/fjlog
  4. http://127.0.0.1/fjmanage

...and if IPv6 is enabled:

  1. http://[::1]/fjlog
  2. http://[::1]/fjmanage

From any location, using the non-local IP address (unique server IP or DNS resolvable name that does not resolve 127.0.0.1, ::1 or aliased to localhost) will result in a Forbidden message.

FJLog Access Forbidden with Non-Local IP

Footnotes

  1. This may be different if the Jubilant fjlog web app was installed on a non-default web site.↩

  2. This may be different if the Jubilant fjmanage web app was installed on a non-default web site.↩