[wildfly-dev] Using Wildfly as a load balancer

[Jason Greene]

Sure, that should work, but would require some hacking if you are using domain mode, since it launches JVMs for server process. You would probably need to create a fake “java” which was a script which called authbind on the real java.

> On Jan 17, 2015, at 8:27 AM, Jorge Solórzano <jorsol at gmail.com> wrote:
> 
> Is authbind or privbind a good alternative? it probably has the same effect of setcap but with a little more security.
> 
> It seems the best choice is iptables.
> 
> 
> 
> Jorge Solórzano
> http://www.jorsol.com
> 
> On Fri, Jan 16, 2015 at 9:31 PM, Jason T. Greene <jason.greene at redhat.com> wrote:
> 
> > On Jan 16, 2015, at 5:37 PM, denstar <valliantster at gmail.com> wrote:
> >
> > On 01/16/2015 04:19 PM, Jason Greene wrote:
> > ...
> > [snip helpful example rules]
> >>
> >> B. Using setcap to grant perms for java to bind lower ports:
> >
> > FWIW, this would open things up for Java in general, so while it should
> > perform better, it'll also be a little more risky, which may or may not
> > be a concern.
> 
> Right all Java code using this JVM would have access to binding *all ports* (e.g a Java program could bind say the ssh port (assuming it's not running) and sniff passwords). So it would be a good idea to have a dedicated JVM just for WildFly and to limit the execution permission to just a dedicated WildFly user. That way you ensure only the wildfly process can bind these ports.
> 
> Alternatively, you could use something like docker which automates capability assignment and provides some extra isolation. It's overkill though if the only thing running on a box is a wildfly process.
> 
> Just a note that you will still get fantastic performance with iptables port forwarding since the particular rule is completely stateless, and the action is just to modify the packet in memory. It's only extreme scenarios where that overhead is worth avoiding.
> 
> -Jason
> 
> 
> 
> 

--
Jason T. Greene
WildFly Lead / JBoss EAP Platform Architect
JBoss, a division of Red Hat