Article

thsundel's picture
article
Reads:

3926

Score:
5
5
1
 
Comments:

3

Restrict Access to ZENworks Control Center

(View Disclaimer)

Under the following directory you will find a file named context.xml:

/opt/novell/zenworks/share/tomcat/tomcat/conf/

Edit the file with your favorite text editor and add the following line between "<context>" and "</context>" tags:

<Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="192.168.0.*"/>

Then only hosts in the 192.168.0.0/24 network would get access to ZCC.

After saving the edited file you need to restart ZENworks before the changes take effect.


Disclaimer: As with everything else at Cool Solutions, this content is definitely not supported by Novell (so don't even think of calling Support if you try something and it blows up).

It was contributed by a community member and is published "as is." It seems to have worked for at least one person, and might work for you. But please be sure to test, test, test before you do anything drastic with it.




User Comments

dwu2001's picture

It is an issue I concern

Submitted by dwu2001 on 21 March 2011 - 1:51pm.

It is an issue I concern while testing ZCM. zcc is accessible from the world,
and I do not find it is mentioned in the documents.
Thank you for the tip. I run ZCM on SLES, so I find it is easier to set up a rule
in iptables firewall. The context.xml file maybe overwritten during update.

I also notice that 127.0.0.1 is also needed in the allow list, otherwise zman return error 13.

strada-ch's picture

No solution for ZCM 11 SP2

Submitted by strada-ch on 19 June 2012 - 5:54am.

At least with ZCM 11 SP2 I tested with, this setting prevents also clients from communicating with this primary (such as downloading bundles). Therefore unfortunately not only effective for ZCC and not usable.

reni's picture

This block to much?

Submitted by reni on 12 April 2013 - 2:35am.

Hi all, this blocks access to other zenworks services which the agent uses
like:
zenworks-useradmin
zenworks-coreadmin
zenworks-ping

I'm looking for something to just block zcc ./zenworks access.

© 2013 Novell