Running the Product

• The Management Console uses the default HTTP-NIO transport, which is configured in the catalina-server.xml file in the <IS_HOME>/repository/conf/tomcat directory. This transport must be properly configured in this file for the Management Console to be accessible.
• The config-validation.xml file in the <PRODUCT_HOME>/repository/conf/etc directory contains a list of recommended system parameters, which are validated against your system when the server starts. See Configuring config-validation.xml for details on modifying these parameters before starting the server.

To start and stop the server in the background mode of Linux, run wso2server.sh start and wso2server.sh stop commands. 

If you are starting the product in service/nohup mode in Solaris, do the following:

1. Update the <PRODUCT_HOME>/bin/wso2server.sh file as follows:

   1. Search for the following occurrences: nohup sh "$CARBON_HOME"/bin/wso2server.sh $args > /dev/null 2>&1 &

   2. Replace those occurrences with the following:  nohup bash "$CARBON_HOME"/bin/wso2server.sh $args > /dev/null 2>&1 &
      

      The only change is replacing sh with bash. This is required only for Solaris.

2. Update your PATH variable to have /usr/xpg4/bin/sh as the first element. This is because /usr/xpg4/bin/sh contains an sh shell that is newer than the default sh shell. You can set this variable as a system property in the wso2server.sh script or you can run the following command on a terminal:

   export PATH=/usr/xpg4/bin/sh:$PATH

3. Start the product by following the above instructions.

When the Management Console Sign-in page appears, the web browser will typically display an "insecure connection" message, which requires your confirmation before you can continue.

The Management Console is based on HTTPS protocol, which is a combination of HTTP and SSL protocols. This protocol is generally used to encrypt the traffic from the client to server for security reasons. The certificate it works with is used for encryption only, and does not prove the server identity, so when you try to access the Management Console, a warning of untrusted connection is usually displayed. To continue working with this certificate, some steps should be taken to "accept" the certificate before access to the site is permitted. If you are using the Mozilla Firefox browser, this usually occurs only on the first access to the server, after which the certificate is stored in the browser database and marked as trusted. With other browsers, the insecure connection warning might be displayed every time you access the server.

This scenario is suitable for testing purposes, or for running the program on the company's internal networks. If you want to make the Management Console available to external users, your organization should obtain a certificate signed by a well-known certificate authority, which verifies that the server actually has the name it is accessed by and that this server belongs to the given organization.

You can restrict access to the management console of your product by binding the management console with selected IP addresses. Note that you can either restrict access to the management console only, or you can restrict access to all web applications in your server as explained below.

• To control access only to the management console, add the IP addresses to the <PRODUCT_HOME>/repository/conf/tomcat/carbon/META-INF/context.xml file as follows:
  

  <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="<IP-address-01>|<IP-address-02>|<IP-address-03>"/>

  The RemoteAddrValve Tomcat valve defined in this file will only apply to the Carbon management console, and thereby all outside requests to the management console will be blocked. 

• To control access to all web applications deployed in your server, add the IP addresses to the <PRODUCT_HOME>/repository/conf/context.xml file as follows:
  

  <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="<IP-address-01>|<IP-address-02>|<IP-address-03>"/>

  The RemoteAddrValve Tomcat valve defined in this file will apply to each web application hosted on the Carbon server. Therefore, all outside requests to any web application will be blocked.
  

• You can also restrict access to particular servlets in a web application by adding a Remote Address Filter to the web.xml file (stored in the <PRODUCT_HOME>/repository/conf/tomcat/ directory), and by mapping that filter to the servlet url. In the Remote Address Filter that you add, you can specify the IP addresses that should be allowed to access the servlet.

  
  The following example from a web.xml file illustrates how access to the management page (/carbon/admin/login.jsp) is granted only to one IP address:
  

  <filter>
      <filter-name>Remote Address Filter</filter-name>
      <filter-class>org.apache.catalina.filters.RemoteAddrFilter</filter-class>
          <init-param>
              <param-name>allow</param-name>
              <param-value>127.0.01</param-value>
          </init-param>
  </filter>
  
  <filter-mapping>
      <filter-name>Remote Address Filter</filter-name>
      <url-pattern>/carbon/admin/login.jsp</url-pattern>
  </filter-mapping>