topic Re: restrict webadaptor services directory access in ArcGIS Enterprise Questions

restrict webadaptor services directory access

DuarteCarreira — Thu, 21 May 2015 17:17:14 GMT

Is there a way to have the services directory accessible through port 6080, and not through the webadaptor?

As far as I can see we can only disable all access. This doesn't make much sense to me... it would be useful to have access "internally" and block "external" access.

Thanks,

Duarte

Re: restrict webadaptor services directory access

JayantaPoddar — Thu, 21 May 2015 18:45:18 GMT

Hi Duarte,

Do not use the web-adaptor. Access the rest services directory through http, like

http://<ServerName/ServerIP>:6080/arcgis/rest

Re: restrict webadaptor services directory access

RebeccaStrauch__GISP — Thu, 21 May 2015 18:58:11 GMT

Jayanta, that doesn't work if you have the rest end point disabled, you get the error

you can add ?f=pjson to the end to get a listing, e.g. http://<servername>:6080/arcgis/rest/?f=pjson

But it's not the nice formatting that you would like and you can't access the javascript view direct. We have our public services directory disabled for external use (per esri recommended steps for security). The other option is just looking at it in catalog, but the services directory is a very handy too. I too would like to be able to shut it off externally (i.e. web adapter) but keep it open with the <server:6080>.. I haven't looked to see if anyone has this in the ideas page yet. Have you Duarte?

Edit: fixed typo. added sample link. formatted.

Re: restrict webadaptor services directory access

AndyOmmen — Fri, 22 May 2015 14:52:18 GMT

Hi Rebecca,

Although the AGS help states to disable the services directory to prevent someone from finding and accessing your services, however if you have services intended for public use disabling the directory may not be the route you want to take. Instead, I would recommend securing the applicable services and/or folders via ArcGIS Server Manager which in turn prevents them from appearing in the services directory. I hope this helps

Thank you

Andy

Re: restrict webadaptor services directory access

RebeccaStrauch__GISP — Sat, 23 May 2015 00:36:42 GMT

Hi Andy,

Thanks for the insight. I agree, but working with our network services a while back and trying to convince them we needed the SSL cert and port, they kind of got stuck on us needing to everything that was recommended in the various documents. At the time it was easier to do this than to argue that it was a maybe overkill. But having it disabled is of course an inconvenience for us too, not just the public. So I will probably also rethink this although sometimes I still want the rest endpoint to not be viewable even if it is a public (not secure) service.

So, for me, I would still like to have the fine tuning of having the web adapter version being blocked, but the internal machinename:6080 be viewable. There is a case for both. I think that is what Duarte is asking for too. That would be the best of both worlds/environments.

Re: restrict webadaptor services directory access

DuarteCarreira — Sat, 23 May 2015 21:14:28 GMT

Rebecca that's exactly what i'm looking for. It seems that disabling the rest dir may have been an afterthought. It doesn't make much sense as it is. Maybe there is a way to block the rest dir in the web.config of the webadaptor...

Re: restrict webadaptor services directory access

RebeccaStrauch__GISP — Sat, 23 May 2015 23:17:43 GMT

Duarte,

so, it seems the "answer" to your question is "no", currently there isn't a way to do this. I did some searching on the ideas page and found what I think we want. Please go and promote it.

ArcGIS Idea - Disable REST Services Directory through Web Adaptor

You will need to log in to promote it (should be same login as geonet). Maybe others will see this thread and do the same.....Or if it just takes some tweaks somewhere, maybe someone at esri can give us info.

There are other interesting ideas in regards to the rest service directory.....a search

http://ideas.arcgis.com/apex/ideaSearchResults?s=rest+service+directory&searchButton=search

Some good ideas that I can get behind.

BTW, I have not installed 10.3.1 yet....so don't know if this has been added or not.

Re: restrict webadaptor services directory access

DuarteCarreira — Mon, 25 May 2015 16:54:24 GMT

Rebecca, it seems so... but I still have hopes that asp.net configuration could provide a solution...

Didn't have time yet to test but maybe there's a way:

security - How to restrict folder access in asp.net - Stack Overflow

Use Request Filtering : The Official Microsoft IIS Site

But I'm afraid these block everything under the directory level, so all requests to all mapservices will be cut off... not sure though.

Re: restrict webadaptor services directory access

RebeccaStrauch__GISP — Mon, 25 May 2015 17:07:17 GMT

For me, I would rather have a direct solution thru AGS. I don't think our network services folks would be happy with tweaking iis outside of their standard, so probably won't mess with either suggestion, .but if you find a solution, I'll be interested in what you figure out.

Re: restrict webadaptor services directory access

RebeccaStrauch__GISP — Tue, 26 May 2015 15:45:07 GMT

Duarte,

It don't know that we talked about this yet, but, although you can'tt see the (javascript) map, etc, you can see most of the folder/service info if you have admin rights thru

https://<servername>:6443/arcgis/admin/services

http://<servername>:6080/arcgis/admin/services

Depending on whether you have https, even if you have the rest service directory disabled. You would have to be able to log in with admin privileges to see anything, but it will also list the secure folders and services. I had forgot about that option until I needed it this morning. .

Re: restrict webadaptor services directory access

DuarteCarreira — Wed, 27 May 2015 09:10:06 GMT

Hi Rebbeca. I had already tried that option. The problema is you don’t see the layers list, fields, etc. like you do in the rest directory service. At least I couldn’t find a way to get this info.

The rest dir is most useful for us while developing our webapps. Without it we are flying blind…

De: Rebecca Strauch

Enviada: terça-feira, 26 de Maio de 2015 16:46

Para: Duarte Carreira

Assunto: Re: - restrict webadaptor services directory access

GeoNet <http://jiveon.jivesoftware.com/mpss/c/mAA/PDcDAA/t.1nc/q7uqwW_HSkaYQGAj6aWV0g/h0/WXYIqorVIGQuIDJ2G2ju5AEeIPykSY57g2VIWA8pAkF2-2BlveMrdQT1t2nJlEgcli>

restrict webadaptor services directory access

reply from Rebecca Strauch<http://jiveon.jivesoftware.com/mpss/c/mAA/PDcDAA/t.1nc/q7uqwW_HSkaYQGAj6aWV0g/h1/WXYIqorVIGQuIDJ2G2ju5Cq78MLQmxOA6AjDKPN5-2B-2BTzsfUHV3Jhvjd7G1Djg26BqvFrRvVo1Cfqsi3ajEIRDg-3D-3D> in ArcGIS for Server - View the full discussion<http://jiveon.jivesoftware.com/mpss/c/mAA/PDcDAA/t.1nc/q7uqwW_HSkaYQGAj6aWV0g/h2/WXYIqorVIGQuIDJ2G2ju5BgYGKlxCJXzUFxsSjPkR7gsMkrFqlzxzkcUrAQ-2BL2oVgA2hfhgsl1GN41AmxTupifIvjsJPKICYcVBq7UM1AME-3D>

Re: restrict webadaptor services directory access

RebeccaStrauch__GISP — Wed, 27 May 2015 16:24:05 GMT

yes, I would agree that is still a problem.

Did you promote the idea yet? Looks like there is still only 90 points....getting this voted up may be our best best to get this added to future releases anyway.

https://c.na9.visual.force.com/apex/ideaView?id=087E00000005ArlIAE if logged in

ArcGIS Idea - Disable REST Services Directory through Web Adaptor if not.

I had posted this above....but never hurts to do it again so others may see it.

Re: restrict webadaptor services directory access

DuarteCarreira — Wed, 27 May 2015 18:01:03 GMT

Reporting back... no luck... I could only block the entire rest access. That's even worse...

So back to disabling the rest directory only for webadaptor and leaving it on for "direct" access through port 6080. esri please hear us...

I already voted the idea up... but the ratio of ideas that get implemented really does not motivate voting...

Rebecca I'l mark your answer as correct: no is the answer...