Tomcat & Mercury Access

[cdelorm]

Hi again! I am working through learning XAMPP. I have an update for you, plus a few new issues.

The original post was about accessing xampp from a remote computer. One update for you...one needs to add additional code in two places to be able to access localhost and the security window from a remote computer. The two areas are (last time we updated the latter section only - to access the security screen remotely, the first must also be updated):

#
# New XAMPP security concept
#

# Close XAMPP security section here
<LocationMatch "^/(?i:(?:security))">
Order deny,allow
Deny from all
Allow from ::1 127.0.0.0/8 xxx.xxx.x.xxx yyy.yyy.y.yyy
ErrorDocument 403 /error/HTTP_XAMPP_FORBIDDEN.html.var
</LocationMatch>

# Close XAMPP sites here
<LocationMatch "^/(?i:(?:xampp|licenses|phpmyadmin|webalizer|server-status|server-info))">
Order deny,allow
Deny from all
Allow from ::1 127.0.0.0/8 xxx.xxx.x.xxx yyy.yyy.y.yyy
ErrorDocument 403 /error/HTTP_XAMPP_FORBIDDEN.html.var
</LocationMatch>

Now my new issues! When I test the various areas from localhost (the areas listed on the left), I notice two issues. I am not sure if these are anything to be concerned about if I am using XAMPP for WordPress and Joomla applications.

1) The Tomcast examples do not open from either the local or remote computers. When I click on that item, I get a page that states "Service unavailable!". I think this might be okay ... I think Tomcat is not needed for WordPress or Joomla, however, I wanted to check just in case. Should I be able to access the examples, are they needed for the applications, and if yes, what do I need to do to implement a fix?

2) Mercury mail does not open on the remote computer. I get a message that states "FORBIDDEN FOR CLIENT YYY.YYY.Y.YYY". Again, I am not sure I need to be concerned, but checking to be sure and be educated. Should I be able to access the examples, are they needed for the applications, and if yes, what do I need to do to implement a fix?

Thank you for your continued support!

Caprice

[Sharley]

Why did you not edit the second part of the New security concept like I suggested in your last topic to allow access from all known lan IP addresses?

Adding the same suggested lan addresses to the first section will also be useful.

Doing both sections will be helpful if your lan IP addresses change for what ever reason that Microsoft Windows can drum up.

1. Did you start Tomcat using the new Control Panel 3 xampp-control-3-beta.exe file in the xampp folder after first exiting the older 2.5 version CP?

2. Likewise is Mercury started.

Have you read the \xampp\apache\logs\error.log file for clues about your issues?

[cdelorm]

Thank you for your response Sharley. I apologize for my delay in responding back.

I had thought that, if updating like you suggested, it might make things more vulnerable. If you think that this is the best approach, I will implement it. You have more experience in this arena that I, thank goodness!

What I had from you before to add (which I believe I do in both sections) is:

Order deny,allow
Deny from all


Allow from ::1 127.0.0.0/8 \
fc00::/7 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 \
fe80::/10 169.254.0.0/16

Regarding your other questions:

1. Did you start Tomcat using the new Control Panel 3 xampp-control-3-beta.exe file in the xampp folder after first exiting the older 2.5 version CP? Answer: No, I did not. Should I be using the beta...and if so, just click on it and go from there? I am not sure the purpose of Tomcat and if it is needed for what I want to do. When I click on Tomcat in the current control panel, it states that it started but it does not show that it is running.

2. Likewise is Mercury started. Answer: When I click to start Mercury, I get a "Windows Security Alert" that the firewall is blocking it. Shall I allow it, and do I need this for building a local WordPress or Joomla environment? Interestingly enough, the Control Panel states that Mercury is running even though the warning message appeared. For the time being, I chose to unblock the program from the Windows Security Alert message - is this what I should do? P.S. When it is running, I still get the same "Forbidden" error on the remote computer. Maybe adding the code as you suggested will take care of this issue?

Regarding the error log, I have a copy of the log from 11/2 and today. I can send it to you if you would like to check it out and perhaps continue to educate me. I am not sure how to read the information in total...I do see some error messages about failure to make connection to the backend...and the target machine actively refusing it.

Thank you for your continued support. Again, I am not sure if these components are needed for creating a local testing environment for Joomla and WordPress, so any insights you have are greatly appreciated.

~ Caprice

[Sharley]

Hello Caprice,

The items you show in red (no blank lines between) will allow access from your LAN only or the computer that XAMPP is installed on and that I believe is what you are looking to do.

If you add the above to the second section then you and only the LAN users will be able to access the XAMPP system files and folders but not the XAMPP security folders (LAN user trust is up to you here).

If you add the above to both sections then you and your trusted LAN users will have full access to all your XAMPP system files and folder.


1. Use the new CP3 beta instead of the older buggy 2.5 version, an updated version 3.0.7 can be found here, the whole topic is worth a read so you can see that this is a beta only in name and will be included in the next XAMPP release as a full version.

2. No need for Tomcat at all especially knowing that you know little about it or you don't intend to use it.
(Research Tomcat to get an understanding of what it is and what it does).

3. Mercury mail is a full blown email transport system (SMTP and POP3) and unless you have a need to provide an email service for you LAN users (most small LANs don;t need this only large commercial LANs might use it) then this is also not required.
In the next XAMPP version this will be replaced with a much more user friendly XAMPP Mail component.

So, in conclusion, neither Tomcat or Mercury Mail are needed for your intended use of XAMPP.

Best wishes.

[hackattack142]

To specifically answer the "Forbidden client" message and for future reference to anyone getting the same error, it is caused by this

Code: Select all

$host = "127.0.0.1";
   $timeout = "1";

   if ($REMOTE_ADDR) {
      if ($REMOTE_ADDR != $host) {
         echo "<p><h2> FORBIDDEN FOR CLIENT $REMOTE_ADDR <h2></p>";
         exit;
      }
   }

in "/xampp/htdocs/xampp/mailform.php" which is the file called from accessing the MercuryMail link from the main XAMPP page.

[cdelorm]

Thank you both for your replies. I appreciate the ability to progress with the projects and learn at the same time. It appears that the "forbidden client" message can be "fixed" by updating the code, if in fact access is needed or desired.

I will continue on with the reading as recommended so that I can be more fully aware of the offerings, uses, and capabilities.

~ Caprice

[Sharley]

Thanks for the feedback,

I will close this topic now and if you have any more XAMPP For Windows related issues then please feel free to start another topic.

Best wishes.