Apache，Tomcat和mod代理http设置

Question

I am running a web application on Tomcat (port 8080) with Apache (port 80) in front (on Ubuntu) using mod-proxy_http as the connector. The app is available through port 80 but also through port 8080. This is actually quite useful (when deploying/testing).

Are there are any particular disadvantages/vulnerabilities with keeping port 8080 open in this way?

Answer 1

My opinion is that you should close 8080 port, or at least allow it for certain host/IP. Less open ports, less problems. Opening port 8080 could let attacker to have more entry points (80 and 8080, using different technologies) and exploit different techniques. Also HTTPd server has much better security modules.

Have you consider using mod_ajp_proxy?

Hope this helps.