Member Avatar for Zorrro

I will be hosting a website on windows 7 using Apache and a java based project tracking web application called jira on Tomcat using reverse proxy method. To secure that web application and my PC what steps should I take and from where should I start?

  • 3 Contributors
  • 8 Replies
  • 432 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by Member #46692

Dani AI

Generated

Quick, practical security notes for hosting Jira (Tomcat) behind Apache on a Windows 7 box. Strong priority first: Windows 7 reached end of support on January 14, 2020, so running an internet‑facing server on it is risky — upgrade to a supported OS or isolate the machine completely (or buy Extended Security Updates if you must). ’s list is a solid baseline; is correct that Linux is usually the safer server choice, but the steps below assume Windows 7 must be used. (support.microsoft.com)

Use Apache as the reverse proxy and terminate TLS there; keep Tomcat bound to localhost or an internal NIC and tell Tomcat the external name/port so redirects work. Minimal Apache + Tomcat examples (replace hostnames/paths and use a proper certificate):

<VirtualHost *:443>
  ServerName jira.example.com
  SSLEngine on
  SSLCertificateFile /etc/ssl/certs/jira.crt
  SSLCertificateKeyFile /etc/ssl/private/jira.key
  SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
  SSLCipherSuite HIGH:!aNULL:!MD5

  ProxyPreserveHost On
  ProxyPass        /  http://127.0.0.1:8080/
  ProxyPassReverse /  http://127.0.0.1:8080/
  RequestHeader set X-Forwarded-Proto "https"
</VirtualHost>
<!-- server.xml (Tomcat) -->
<Connector port="8080" protocol="HTTP/1.1"
           proxyName="jira.example.com" proxyPort="443" scheme="https"
           redirectPort="8443" URIEncoding="UTF-8" />

Follow Atlassian’s reverse‑proxy guidance, and use Apache’s proxy directives (ProxyPass/ProxyPassReverse) rather than proxying blindly. Also set Tomcat’s proxyName/proxyPort/scheme so Jira builds correct URLs. (confluence.atlassian.com)

Windows‑specific hardening (practical): rename/disable default admin/guest, remove or disable unused local accounts, run a host firewall that only allows 80/443 (and admin ports from specific IPs), disable RDP or only allow it via VPN + NLA, run reputable AV, remove unneeded services, do not use the server as a daily workstation, run Jira/Tomcat as non‑interactive, least‑privilege service accounts, and keep backups + tested restores.

Protect the app layer: keep Jira and plugins patched; disable unused apps/plugins; enforce HTTPS‑only cookies, HSTS, and relevant security headers; run regular scans (OWASP Top Ten checks, ZAP/DAST) and authenticated vulnerability scans; log and monitor and test restores. If possible, migrate to a supported OS or use a VM/container on a supported host — that reduces lifetime risk and maintenance burden. (owasptopten.org)

Recommended Answers

All 8 Replies

Member Avatar for JorgeM

Here are some of the basics with regards to securing the PC/apps....

  • Rename/Disable the Admin and Guest account
  • Dont have any more local accounts defined on the system that what you actually need.
  • Ensure that all of your accounts have very strong and complex passwords.
  • If possible, change your account passwords routinely (every 90 days).
  • Make sure that you keep your system up to date with the latest security patches from Microsoft as well as other vendors for the products you are running on that system.
  • Dont share you passwords with anyone.
  • If your web application uses an authentication system, use SSL certificates to encrypt the traffic between the web server and web client.
  • Scan your computer and application regulary for known vulnerabilities.
  • Protect your local network with a firewall.
  • Protect your local computer with a local firewall if your local network will be sharing with other partially trusted networks like WiFi.
  • If you are going to be logging onto that computer regularly and using it as a workstation (not a good idea), be careful not to visit sites that could infect you with malware. Be careful not to open email attachments that could infect your system.
  • Ensure that your web application while being developed includes secure coding practices to avoid SQL injection/cross site scripting attacks.
  • Make sure you validate all of your user's input, not just on the client side using javascript, but also server side.
  • parameterize all of your input, do not assume that your input is not dangerous code.
Member Avatar for Zorrro

It is good to know that I am on good track and few new things you have mentioned. To be honest I am little paranoid and it will be great if somebody shares their experince with such hosting on PC.

Member Avatar for Member #46692

Or just use linux.

Member Avatar for Zorrro

I found more detailed tips and methods.

Member Avatar for Zorrro

Comments will help than downvote.

Member Avatar for Member #46692

Yeah see all those reams and reams of information, install service pack 1 blah blah, install anti-virus, install windows defender, uninstall blah, remove admin privileges... blah blah the list is endless.

Linux removes all these headaches, linux is superior as servers and always will be. Take the time to learn it and you'll be much better protected running a faster leaner server which supports tomcat.

But I already know what you think about this.

Member Avatar for Zorrro

Thats not my requirement if you can suggest anything regarding windows that will be nice.

Edited by Zorrro
Member Avatar for Member #46692

Unfortunately, I cannot as I have never used windows as a server. That being said, there are times when I see its need. I.E if you're running an asp.net application. Then there is no alternative.

I've had a look at jira and I see that it has a linux install. Your clients my have other ideas so I guess you have to run with windows.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.