Configuring Certificate Revocation Lists CRLs

Configuring Security 5-17

5.6 Configuring HTTP Request Header Size

By default, Oracle Web Cache provides the following limits for HTTP request header field: ■ 819000 bytes for the total sum of all HTTP request header fields in requests Oracle recommends setting the header size to a lower value than the default to ensure security and prevent denial-of-service attacks from malicious clients. If the length of the request is larger than the allowed limit,Oracle Web Cache sends an error to the client and reports the error 11356 to the event log: Total request header length exceeds configured maximum. A forbidden error response is returned to the client. ■ 8152 bytes for an individual HTTP request header field Oracle recommends setting the individual header size based on how large an application sets HTTP requests header fields. If the length of the request is larger than the allowed limit, Oracle Web Cache sends an error to the client and reports the error 11355 to the event log: Single request header length exceeds configured maximum. A forbidden error response is returned to the client. To modify the default header limits:

1. From Oracle Web Cache Manager, in the navigator frame, select Properties

Security . See Section 2.7.2 . The Security page appears.

2. In the HTTP Request Header Limits section of the Security page, click Edit.

The HTTP Request Header Limits dialog box appears.

3. In the Maximum combined header size in bytes field, specify the total sum of all

HTTP request header fields in requests. Specify a limit of at least 4096 bytes 4 KB.

4. In the Maximum individual header size in bytes field, specify the allowed length

limit of an individual HTTP request header fields. Specify a limit of at least 256 bytes.

5. Click Submit, and then click Apply Changes.

6. Restart Oracle Web Cache. See Section 2.13 .

5.7 Ensuring That ClientIP Headers Are Valid

A client, such as a browser, can send information about its IP address in a header in a request. However, because a client could use a false IP address in the header, allowing a cache to forward that information to another cache or to the origin server can be a potential security problem. By default, Oracle Web Cache removes any IP header information forwarded from a client and replaces it with a header that contains the correct IP address of the client. In this case, a client can be a browser or another cache in a hierarchy. In a cache hierarchy, Oracle Web Cache must be able to preserve the information that is forwarded from one cache to another in the hierarchy or from a cache to the origin server. To configure these settings: 5-18 Oracle Fusion Middleware Administrators Guide for Oracle Web Cache

1. From Oracle Web Cache Manager, in the navigator frame, select Properties

Security . See Section 2.7.2 . 2. In the Security Header Configuration section of the Security page, check the value of the Accept client IP addresses encoded in ClientIP headers field. If the value is NO, Oracle Web Cache removes any ClientIP request-header forwarded from the client and replaces it with a header that contains the correct IP address. If the value is YES, Oracle Web Cache accepts the header received from the client and can forward it to another cache or the origin server.

3. If the settings do not match the following information, click Edit and change the

settings in the Security Header Configuration dialog: – For a simple configuration, the value should be NO. – In a cache cluster, the value should be NO for all cluster members. – In a distributed cache hierarchy, for the remote cache, the value should be NO. – In a distributed cache hierarchy, for a central cache that receives requests only from other caches, the value should be YES. If the central cache receives requests from both browsers and other caches in the hierarchy, Oracle Web Cache cannot distinguish which is a browser and which is another cache. In this case, if you specify YES, a false IP address could potentially be forwarded from a browser. However, correct information would be forwarded from another cache. If you specify NO, a false IP address could not be forwarded from a browser. However, the information forwarded from another cache would contain the IP address of the cache, not of the original client.

4. Click Submit, and then click Apply Changes.

5. Restart Oracle Web Cache. See Section 2.13 .

5.8 Configuring Support for Caching Secured Content

You can configure Oracle Web Cache to support caching content that is secured by Oracle Single Sign-On authentication with no other authorization requirements. To enable this setting in Oracle Web Cache Manager:

1. From Oracle Web Cache Manager, in the navigator frame, select Origin Servers,

Sites, and Load Balancing Site Definitions. See Section 2.7.2 .

2. Select a configured site and click Edit ShowEdit Site.

3. In the For Site dialog, in the Attributes section, select the type of authentication

required for requested objects: ■ Oracle Single Sign-On: Select to require authentication through Oracle Single Sign-On. Oracle Web Cache requires a valid Oracle Single Sign-On cookie to serve requests. ■ None: Select to not require any authentication.

4. Click Submit.

5. Restart Oracle Web Cache. See Section 2.13 . Configuring Security 5-19

5.9 Running webcached with Root Privilege

On UNIX, you must configure webcached to run with root privilege in the following cases: ■ Privileged port numbers less than 1024 are being used for Oracle Web Cache listening ports. ■ There are more than 1,024 file descriptors being used for connections to Oracle Web Cache. ■ The current opmnctl user does not match the configured process identity user in the Process Identity page Properties Process Identity of Oracle Web Cache Manager. This section contains the following topics: ■ Section 5.9.1, Configuring Process Identity ■ Section 5.9.2, Configuring Root Privilege for Privileged Ports and More than 1,024 File Descriptors ■ Section 5.9.3, Configuring Root Privilege for the Current User ■ Section 5.9.4, Reverting Permissions Back to Installation State

5.9.1 Configuring Process Identity

By default, the user that performed the installation is the owner of Oracle Web Cache processes. This user can execute opmnctl commands. Users that belong to the same group ID of the user that performed installation can also execute opmnctl commands. If the current opmnctl user does not match the configured user in the Process Identity page of Oracle Web Cache Manager, the Oracle Web Cache webcached executable must run as root. If the webcached executable is not able to run as root, error events are reported to the event log file, and Oracle Web Cache fails to start. To change the user ID and group ID for the Oracle Web Cache processes on UNIX:

1. From Oracle Web Cache Manager, in the navigator frame, select Properties

Process Identity . See Section 2.7.2 . The Process Identity page appears.

2. Select the cache for which you want to modify settings, and then click Change

IDs. The Change Process Identity dialog box appears.

3. Enter the new user in the User ID field and the group ID of the user in the Group

ID field.

4. Click Submit.

5. Use the webcache_setuser.sh script as follows to change file and directory ownership: webcache_setuser.sh setidentity user_ID where user_ID is the user you specified in the User ID field of the Process Identity page. The setidentity command changes the ownership of the following files and directories to the new user ID: ■ webcache.xml configuration file in: