Clere Principal Software Engineer / Red Hat What I will cover ● Proxy what and why. ● Protocols – AJP – HTTP/HTTPS (1.1) – HTTP/2 (H2 and H2C) – Others proxy and Other protocols (web-socket etc) ● translations 10/12/22 5 AJP ● When – Easy TLS/SSL forwarding ● Limitations – No upgrade – Header size – No encryption – Limited “authentication” (secret) ● mod_proxy_ajp and mod_jk 10/12/22 6 ) – HTTP if you trust your intranet. (really?) ● Other reasons: – HTTP is more developed than AJP 10/12/22 7 Comparations mod_jk / mod_proxy 4KiB.bin 8KiB.bin 16KiB.bin 32KiB.bin 64KiB.bin

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 587 10.59 Apache Module mod proxy ajp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 611 10.60 Apache Module mod The new MOD PROXY BALANCER module provides load balancing services for MOD PROXY. The new MOD PROXY AJP module adds support for the Apache JServ Protocol version 1.3 used by Apache Tomcat2. Regular Expression provided by MOD PROXY. The proxying capabilities for AJP13, CONNECT, FTP, HTTP and the balancer are provided by the separate modules MOD PROXY AJP, MOD PROXY CONNECT, MOD PROXY FTP, MOD PROXY HTTP and

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 709 10.76 Apache Module mod proxy ajp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 735 10.77 Apache Module mod The new MOD PROXY BALANCER module provides load balancing services for MOD PROXY. The new MOD PROXY AJP module adds support for the Apache JServ Protocol version 1.3 used by Apache Tomcat3. Regular Expression information.) • one or more proxy scheme, or protocol, modules: Protocol Module AJP13 (Apache JServe Protocol version 1.3) MOD PROXY AJP CONNECT (for SSL) MOD PROXY CONNECT FastCGI MOD PROXY FCGI ftp MOD PROXY

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 708 10.76 Apache Module mod proxy ajp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 734 10.77 Apache Module mod The new MOD PROXY BALANCER module provides load balancing services for MOD PROXY. The new MOD PROXY AJP module adds support for the Apache JServ Protocol version 1.3 used by Apache Tomcat3. Regular Expression information.) • one or more proxy scheme, or protocol, modules: Protocol Module AJP13 (Apache JServe Protocol version 1.3) MOD PROXY AJP CONNECT (for SSL) MOD PROXY CONNECT FastCGI MOD PROXY FCGI ftp MOD PROXY

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 778 10.80 Apache Module mod proxy ajp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 805 10.81 Apache Module mod The new MOD PROXY BALANCER module provides load balancing services for MOD PROXY. The new MOD PROXY AJP module adds support for the Apache JServ Protocol version 1.3 used by Apache Tomcat3. Regular Expression information.) • one or more proxy scheme, or protocol, modules: Protocol Module AJP13 (Apache JServe Protocol version 1.3) MOD PROXY AJP CONNECT (for SSL) MOD PROXY CONNECT FastCGI MOD PROXY FCGI ftp MOD PROXY

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 768 10.79 Apache Module mod proxy ajp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 795 10.80 Apache Module mod The new MOD PROXY BALANCER module provides load balancing services for MOD PROXY. The new MOD PROXY AJP module adds support for the Apache JServ Protocol version 1.3 used by Apache Tomcat3. Regular Expression information.) • one or more proxy scheme, or protocol, modules: Protocol Module AJP13 (Apache JServe Protocol version 1.3) MOD PROXY AJP CONNECT (for SSL) MOD PROXY CONNECT FastCGI MOD PROXY FCGI ftp MOD PROXY

部署webshell Tomcat CVE-2016-8735 CVE-2017-12615 [ readonly 实际设为 true的情况较少,稍鸡肋 ] CVE-2020-1938 [ AJP协议漏洞, 直接把8009端⼝暴露在外⽹的不太多,稍鸡肋 ] 控制台弱⼝令,部署webshelll [ 注: 7.x版本后,默认加了防爆机制 ] Jekins CVE-2018-1999002

more. 5.2.1. Changing default ports By default Tomcat runs a HTTP connector on port 8080 and an AJP connector on port 8009. You might want to change those default ports to avoid conflict with another connectionTimeout="20000" redirectPort="8443" /> ... 5.2.2. Changing JVM used By default Tomcat will run preferably with OpenJDK

tests | Included testing tools | Advanced topics • Deployment: Overview | WSGI servers | FastCGI/SCGI/AJP (deprecated) | Deploying static files | Tracking code errors by email 1.8 The admin Find all you support is deprecated and will be removed in Django 1.9. 4.7.3 How to use Django with FastCGI, SCGI, or AJP Deprecated since version 1.7: FastCGI support is deprecated and will be removed in Django 1.9. Although which protocols such as FastCGI, SCGI or AJP are the only viable options. Note This document primarily focuses on FastCGI. Other protocols, such as SCGI and AJP, are also supported, through the flup Python

open postgresql 5900/tcp open vnc 6000/tcp open X11 6667/tcp open irc 8009/tcp open ajp13 8180/tcp open unknown MAC Address: 00:0C:29:31:02:17 (VMware) Nmap done: 1 IP address (1 host