Resources Protected Introduction to Security in Oracle Web Cache

Configuring Security 5-7

5.2 Configuring Password Security

Before submitting invalidation and statistics monitoring requests, establish secure passwords for sending the requests. The invalidator account is an administrator authorized to send invalidation requests. The invalidator account sends HTTP POST requests to invalidate objects in the cache. The administrator account is the Oracle Web Cache administrator authorized to log in to Oracle Web Cache Manager and make configuration changes through that interface. This administrator is also authorized to send statistic monitoring requests to the Oracle Web Cache statistics monitoring port. If after monitoring metrics from Fusion Middleware Control you need additional performance metrics, you can access the statistic monitoring port with the administrator account to view detailed performance metrics. See Section 8.4 . The default password for these accounts is the password you supplied in the Web Cache Administrator page of the Oracle Universal Installer. Before you begin configuration, change the passwords for these accounts to a secure password. You must perform this configuration in Fusion Middleware Control. To establish secure passwords for the invalidator and monitor accounts: 1. Navigate to the Web Cache Home page in Fusion Middleware Control. See Section 2.6.2 .

2. From the Web Cache menu, select Administration Passwords.

The Passwords page displays.

3. In the New Password field, enter a new password, keeping the following

restrictions in mind: ■ Passwords must be between 5 and 30 characters. ■ At least one character must be a number. ■ Passwords can contain only alphanumeric and underscore _ characters. ■ Passwords must begin with an alphabetic character. Passwords cannot begin with a number, the underscore _, the dollar sign , or the number sign . ■ Passwords cannot be Oracle reserved words. The Oracle Database SQL Reference lists the reserved words.

4. In the Confirm Password field, reenter the new password to confirm you entered

the password correctly.

5. Click Apply.

6. Restart Oracle Web Cache. See Section 2.13 . If Oracle Web Cache is not restarted, you may encounter an error when accessing some Fusion Middleware Control pages.

5.3 Configuring Access Control

By default, the computer on which you installed Oracle Web Cache is the trusted host. You can change the trusted subnet or trusted host from which administration, invalidation, and statistics monitoring requests can take place. To specify if some or all of the traffic to an application is restricted to use HTTPS: 5-8 Oracle Fusion Middleware Administrators Guide for Oracle Web Cache

1. From Oracle Web Cache Manager, in the navigator frame, select Properties

Security . See Section 2.7.2 . The Security page appears.

2. In the Security page, click Change Trusted Subnets under the Current Trusted

Subnets. The Change Trusted Subnets dialog box appears. 3. Select an option: All subnets: Allows requests from all computers in all the subnets in the network. This machine only: Allows requests from only this computer. Enter list of IP addresses: Allows requests from all IP addresses you enter in a comma-delimited list. You can enter IP addresses in using these format: – Complete IP address in dot notation, including the network number, subnet address, and unique host number Example: 10.1.0.0 – Networknetmask pair for subnet restriction through masking Example: 10.1.0.0255.255.0.0 allows all the hosts in the 10.1 subnet access. – Networknnn Classless Inter-Domain Routing CIDR specification to require nnn bits from high end to match Example: 10.1.0.016 allows all the hosts in the 10.1 subnet access. This example is similar to the networknetmask example, except the netmask consists of nnn high-order 1 bits.

4. Click Submit.

5. Restart Oracle Web Cache using opmnctl. See Section 2.13.1 .

5.4 Configuring Oracle Web Cache for HTTPS Requests

To provide more security for your Web site, you can configure Oracle Web Cache to receive HTTPS protocol client requests and send HTTPS requests to the origin server. HTTPS uses SSL to encrypt and decrypt user page requests as well as the pages that are returned by the Oracle Web Cache and origin servers. You can also configure Oracle Web Cache to send traffic to the origin server through an HTTPS listening port. To configure HTTPS support for Oracle Web Cache, perform these tasks: ■ Section 5.4.1, Task 1: Create Wallets ■ Section 5.4.2, Task 2: Configure an HTTPS Listening Port ■ Section 5.4.3, Task 3: Configure SSL Settings for Oracle Web Cache Connections to Origin Servers ■ Section 5.4.4, Task 4: Configure a Site to Require HTTPS Requests ■ Section 5.4.5, Task 5: Restart Oracle Web Cache ■ Section 5.4.5, Task 5: Restart Oracle Web Cache ■ Section 5.4.6, Task 6: Perform Additional Configuration for Oracle WebLogic Servers