Detailed set up examples for the webApp.secure performance tests
The detailed examples of configuration and sample scripts we used in our test runs are shown here.
WAProperties.xml
<?xml version="1.0"?>
<webApp.secure-properties version="3.0">
<!--
************************************************************************
<web-server-name>
Name of the server running the Web/application server webApp.secure
is protecting.
This can be in the form of:
1. an internal machine name (i.e. "jupiter", "server")
2. a fully-qualified host name (i.e. "www.webscurity.com",
"www1.webscurity.com")
3. an IP address (i.e. "192.168.0.1")
Example: <web-server-name>www.webscurity.com</web-server-name>
************************************************************************
-->
<web-server-name>webserver</web-server-name>
<!--
************************************************************************
<web-server-port>
TCP port number of the Web/application server webApp.secure is
protecting.
**Note: In production, this would normally be a non-standard TCP port
number that is CLOSED in the network firewall. In test mode,
this would normally be 80.
Example: <web-server-port>8080</web-server-port>
************************************************************************
-->
<web-server-port>80</web-server-port>
<!--
************************************************************************
<listen-ip>
IP address webApp.secure should listen on.
Normally this will be left blank indicating it will be listening on all
available IP addresses.
Example: <listen-ip>192.168.100.23</listen-ip>
************************************************************************
-->
<listen-ip></listen-ip>
<!--
************************************************************************
<listen-port>
TCP port number webApp.secure should listen on.
Normally this will be the standard TCP port 80 for HTTP traffic.
Example: <listen-port>80</listen-port>
************************************************************************
-->
<listen-port>80</listen-port>
<!--
************************************************************************
<host-names>
Fully-qualified "Internet" host name(s) of the Web/application server
webApp.secure is protecting.
Example: <host-names>
<host-name>www.webscurity.com</host-name>
</host-names>
************************************************************************
-->
<host-names>
<host-name></host-name>
</host-names>
<!--
************************************************************************
<hide-server-identity>
Flag to hide server identification information from the client to
prevent banner-grabbing.
**Note: Defaults to "True" and must be explicitly set to "False"
in order to disable hiding the server information.
**Note: Case-sensitive. Will internally set to "True" unless this
field reads "False" (Upper-case 'F', lower case "alse").
Example: <hide-server-identity>True</hide-server-identity>
************************************************************************
-->
<hide-server-identity values="True,False" default="True">True
</hide-server-identity>
<!--
************************************************************************
<site-test>
Flag to indicate webApp.secure is performing a test with a Web site.
When set to True, webApp.secure will replace the client Host: HTTP
header with the value of the <host-name> property (it uses the first
entry if ther are multiple entries).
For example, this allows you to use http://localhost:1111/ in the
browser's address bar to connect to your Web server through
webApp.secure (assuming webApp.secure is running on the localhost and
listening on TCP port 1111).
It is preferred to leave the <site-test> property to False (even while
testing) and modify your local "hosts" file to direct traffic through
webApp.secure.
Example: <site-test>True</site-test>
************************************************************************
-->
<site-test values="True,False" default="False">False</site-test>
<!--
************************************************************************
<http-methods>
List of valid HTTP request methods webApp.secure should honor.
**Note: Defaults to GET, HEAD, and POST only, others must be explicitly
added.
************************************************************************
-->
<http-methods>
<http-method>GET</http-method>
<http-method>HEAD</http-method>
<http-method>POST</http-method>
</http-methods>
<!--
************************************************************************
<entry-points>
List of "entry point" URL's for the Web site. The default is "/", but
one might also define "/index.html" (for example) as well.
While there is no limit to how many entry points can be defined,
generally speaking, the fewer there are, the more secure the site will
be.
An optional "protocol" attribute can be used with the entry-point
element. Setting protocol="https" indicates the entry point should be
accessible over an encrypted link (https). Requests for entry points
identified as https-only over an unencrypted link (http), will
automatically be blocked.
Example:
<entry-points>
<entry-point>/unsecure.php</entry-point>
<entry-point protocol="https">/secure.php</entry-point>
</entry-points>
************************************************************************
-->
<entry-points>
<entry-point>/</entry-point>
<entry-point>/WebSeal_pages/*</entry-point>
<entry-point>/wbtree/*</entry-point>
<entry-point>/PlantsByWebSphere/*</entry-point>
</entry-points>
<!--
************************************************************************
<unprotected-dirs>
List of unrestricted directory paths which are useful to accommodate
URI's dynamically generated by client-side script (JavaScript, VBScript,
etc.). Please refer to the User Guide for complete details and
explanation.
Client requests for resources in these directories are NOT restricted -
i.e. always allowed.
**Note: unprotected-dirs should be used VERY sparingly to maintain
maximum security.
**Note: <unprotected-dir>/</unprotected-dir> should NEVER be defined.
Doing so would give unrestricted access to ALL resources in ALL
directories relative to "/".
An optional "protocol" attribute can be used with the unprotected-dir
element. Setting protocol="https" indicates the unprotected directory
should be accessible over an encrypted link (https). Requests for
unprotected directories identified as https-only over an unencrypted
link (http), will automatically be blocked.
Example:
<unprotected-dirs>
<unprotected-dir>/unsecure/*.jpg</unprotected-dir>
<unprotected-di protocol="https">/secure/*.gif</unprotected-dir>
</unprotected-dirs>
************************************************************************
-->
<unprotected-dirs>
<unprotected-dir></unprotected-dir>
</unprotected-dirs>
<!--
************************************************************************
<smtp-alert>
Setup for SMTP alerts. Please refer to the User Guide for complete
details and explanation.
Example:
<smtp-alert>
<enable>True</enable>
<server>mail.mycompany.com</server>
<port>25</server>
<subject>webApp.secure alert message</subject>
<from>Primary Web Server</from>
<recipients>
<recipient>admin@mycompany.com</recipient>
</recipients>
<user-id>myUserID@mycompany.com</user-id>
<password>myPassword123</password>
</smtp-alert>
************************************************************************
-->
<smtp-alert>
<enable values="True,False" default="False">False</enable>
<server></server>
<port default="25">25</port>
<subject>webApp.secure alert message</subject>
<from></from>
<recipients>
<recipient></recipient>
</recipients>
<user-id></user-id>
<password></password>
</smtp-alert>
<!--
************************************************************************
<http-alert>
Setup for HTTP alerts. Please refer to the User Guide for complete
details and explanation.
Example:
<http-alert>
<enable>True</enable>
<server>192.168.0.2</server>
<port>8080</server>
<action>/cgi-bin/alert.cgi</action>
<from>Primary Web Server</from>
</http-alert>
************************************************************************
-->
<http-alert>
<enable>False</enable>
<server></server>
<port>80</port>
<action></action>
<from></from>
</http-alert>
<!--
************************************************************************
<net-alert>
Setup parameters for network alerts. Please refer to the User Guide for
complete details and explanations.
Example:
<net-alert>
<enable>True</enable>
<recipients>
<recipient>Admin</recipient>
</recipients>
</net-alert>
************************************************************************
-->
<net-alert>
<enable values="True,False" default="True">True</enable>
<recipients>
<recipient></recipient>
</recipients>
</net-alert>
<!--
************************************************************************
<ssl>
Setup parameters for secure sockets layer (SSL). Please refer to the
User Guide for complete details and explanations.
************************************************************************
-->
<ssl>
<enable values="True,False" default="False">True</enable>
<prompt-passphrase values="True,False" default="False">False</prompt-passphrase>
<listen-ip></listen-ip>
<listen-port default="443">443</listen-port>
<cert-file>/usr/local/wa/cert/watest.crt</cert-file>
<cert-key-file>/usr/local/wa/cert/watest.key</cert-key-file>
<ca-cert-file></ca-cert-file>
<random-file></random-file>
<encrypt-to-web-server values="True,False" default="True">False
</encrypt-to-web-server>
<web-server-port default="443">443</web-server-port>
<allow-SSLv2 values="True,False" default="False">False</allow-SSLv2>
</ssl>
<!--
************************************************************************
<max-connections>
Maximum number of simultaneous requests webApp.secure will serve.
************************************************************************
-->
<max-connections values="0 to max-integer" default="5000">5000</max-connections>
<!--
************************************************************************
<max-listen-queue>
Maximum number of pending connections webApp.secure will queue.
************************************************************************
-->
<max-listen-queue default="511">511</max-listen-queue>
<!--
************************************************************************
<keep-alive-timeout>
Number of seconds to wait for a subsequent request before webApp.secure
closes the connection.
************************************************************************
-->
<keep-alive-timeout default="15">15</keep-alive-timeout>
<!--
************************************************************************
<log-request-headers>
List of HTTP request headers webApp.secure will log - regardless of
log_level (see the User Guide for details regarding the log_level
setting).
Example:
<log-request-headers>
<log-request-header>Referer:</log-request-header>
</log-request-headers>
************************************************************************
-->
<log-request-headers>
<log-request-header></log-request-header>
</log-request-headers>
<!--
************************************************************************
<log-response-headers>
List of HTTP response headers webApp.secure will log - regardless of
log_level (see the User Guide for details regarding the log_level
setting).
Example:
<log-response-headers>
<log-response-header>Connection:</log-response-header>
<log-response-header>Set-cookie:</log-response-header>
</log-response-headers>
************************************************************************
-->
<log-response-headers>
<log-response-header></log-response-header>
</log-response-headers>
<!--
************************************************************************
<form-validation>
Setup parameters for HTML form validation. Please refer to the User
Guide for complete details and explanations.
************************************************************************
-->
<form-validation>
<enable values="True,False" default="True">True</enable>
<release-on-submit values="True,False" default="False">False</release-on-submit>
<action-required values="True,False" default="True">True</action-required>
</form-validation>
<!--
************************************************************************
<cookie-validation>
Setup parameters for HTTP cookie validation. Please refer to the User
Guide for complete details and explanations.
************************************************************************
-->
<cookie-validation>
<enable values="True,False" default="True">True</enable>
<strict values="True,False" default="False">False</strict>
</cookie-validation>
<!--
************************************************************************
<special-character-filters>
List of special characters for webApp.secure to filter for given input
field types.
**Note: Default character set includes <>"';() for ALL HTML form
text data entry field types.
************************************************************************
-->
<special-character-filters>
<char-set field-type="TEXT"><>"';()</char-set>
<char-set field-type="TEXTAREA"><>"';()</char-set>
<char-set field-type="PASSWORD"><>"';()</char-set>
</special-character-filters>
<!--
************************************************************************
<activity-flush-count>
Number of lines to write to the activity log file before flushing. To
maintain the integrity of the activity log file, it will be flushed
(actually closed and re-opened) every <activity-flush-count> OR 30
seconds (whichever comes first). Setting this value too low has a
significant negative impact on performance. Setting it too high may
compromise the integrity of the log file in the event of a system
failure.
************************************************************************
-->
<activity-flush-count values="0 to max-integer" default="1000">1000
</activity-flush-count>
<!--
************************************************************************
<form-cleanup>
Setup parameters for form IUG cleanup. Over time, there will be form
IUG's stored in memory that will likely never be needed - i.e. a
particular form will never be submitted by a user and therefore never
need validation.
************************************************************************
-->
<form-cleanup>
<enable values="True,False" default="False">True</enable>
<seconds></seconds>
<minutes></minutes>
<hours></hours>
<days>15</days>
</form-cleanup>
<!--
************************************************************************
<cookie-cleanup>
Setup parameters for cookie IUG cleanup.
************************************************************************
-->
<cookie-cleanup>
<enable values="True,False" default="False">True</enable>
<seconds></seconds>
<minutes></minutes>
<hours></hours>
<days>15</days>
</cookie-cleanup>
<!--
************************************************************************
<w3c-extended-log-file>
Definition block for W3C extended form logging. Please see the User
Guide for complete details.
************************************************************************
-->
<w3c-extended-log-file>
<enable values="True,False" default="False">False</enable>
<truncate values="True,False" default="False">False</truncate>
<!-- Directory path for log files (directory-only - not file name) -->
<log-file-directory></log-file-directory>
<!-- The amount of time that should pass before a new log file is started. -->
<!-- To disable rollover, set all intervals to False. -->
<rollover-period>
<Hourly>True</Hourly>
<Daily>False</Daily>
<Weekly>False</Weekly>
<Monthly>False</Monthly>
</rollover-period>
<!-- W3C extended fields to include in each line of the log file. -->
<fields>
<field>date</field>
<field>time</field>
<field>c-ip</field>
<field>cs-method</field>
<field>cs-uri</field>
<field>cs-uri-stem</field>
<field>cs-uri-query</field>
<field>s-status</field>
<field>sc-bytes</field>
</fields>
</w3c-extended-log-file>
<!--
************************************************************************
<syslog>
Definition block for system logging (UNIX syslog/Windows EventLog).
When <enable> is "True", all error and select informational messages
will be logged to the UNIX syslog (if available) or Windows EventLog.
Setting the value of <enable> to "False" will disable all logging to
the syslog or EventLog, with the exception of startup errors.
************************************************************************
-->
<syslog>
<enable values="True,False" default="True">True</enable>
</syslog>
<!--
************************************************************************
<passive-mode>
Flag to indicate webApp.secure is running in "passive mode". When
<passive-mode> is "True", all malicious activity will be identified,
logged, and alerted, but allowed to pass through. When <passive-mode> is
"False", all malicious activity identified will be logged, alerted, and
blocked.
Example: <passive-mode>True</passive-mode>
************************************************************************
-->
<passive-mode values="True,False" default="False">False</passive-mode>
<!--
************************************************************************
<remote-admin>
Definition block for remote administration setup. These settings define
how (if) remote administration will be done via a standard Web browser.
Please refer to the User Guide for complete details.
************************************************************************
-->
<remote-admin>
<enable values="True,False" default="True">True</enable>
<listen-ip></listen-ip>
<listen-port>8020</listen-port>
<password>21232f297a57a5a743894a0e4a801fc3</password>
<client-ips>
<client-ip></client-ip>
</client-ips>
<allow-SSLv2 values="True,False" default="False">False</allow-SSLv2>
</remote-admin>
<!--
************************************************************************
<process-javascript>
Flag to indicate webApp.secure should process JavaScript.
Example: <process-javascript>True</process-javascript>
************************************************************************
-->
<process-javascript values="True,False" default="True">True</process-javascript>
<!--
************************************************************************
<strict-https>
Flag to indicate webApp.secure should strictly enforce https URL's.
Example: <strict-https>True</strict-https>
************************************************************************
-->
<strict-https values="True,False" default="True">True</strict-https>
<!--
************************************************************************
<client-ip-header>
Flag to indicate webApp.secure should send the client IP address in the
WA-Client-IP: custom HTTP header.
Example: <client-ip-header>True</client-ip-header>
************************************************************************
-->
<client-ip-header values="True,False" default="True">True</client-ip-header>
</webApp.secure-properties>
<!-- Copyright (C) 2002 webScurity Inc. -->