Skip to main content

Configuring Inbound Traffic

HTTP Configuration

The port parameter(s) in the IQ Server config.yml allows you to set the port(s) to access the application and/or operational menu. Each port can be freely changed to other values, as long as it is not used and in the allowed range of values greater than 1024. The following examples show how to set these port parameter(s).

For IQ Server version 1.43 and higher

HTTP Configuration in config.yml

server:
    applicationConnectors:
        - type: http
          port: 8070
    adminConnectors:
        - type: http
          port: 8071

Admin Port (8071) Security

The admin port (8071) exposes operational and administrative functionality such as the Operational Menu, health checks, metrics, and other internal maintenance features. To protect these capabilities, IQ Server now binds the admin connector to localhost (127.0.0.1) by default.

Default Behavior

When using the default configuration, the admin port listens only on the loopback interface (127.0.0.1). This restricts access to the IQ Server host itself and prevents direct access from remote systems.

This secure default is recommended for most installation scenarios.

How to Verify Localhost Binding

Run the following command from the IQ Server host to verify the binding:

curl -I http://localhost:8071

A successful response indicates the admin port is bound and accessible locally. Attempts to access the same port remotely should fail if secure binding is in effect.

Remote Access Options

If remote access to the admin port is required, use one of the following controlled methods:

  • SSH tunneling (recommended)

    ssh -L 8071:localhost:8071 user@iq-server-host

    After establishing the tunnel, access the administrative endpoints using http://localhost:8071 on the local workstation.

  • Firewall rules – Allow inbound access to port 8071 only from trusted networks or specific IP addresses.

  • Reverse proxy – Use authentication or IP allowlists to securely expose the admin port through a proxy layer.

Overriding the Bind Host

The bind host can be changed using the following environment variable:

export SERVER_ADMIN_CONNECTOR_BIND_HOST=0.0.0.0

This override allows the admin connector to listen on external interfaces. It should only be used when combined with strict firewall or network restrictions to avoid exposing administrative functionality publicly.

For additional guidance, refer to the System Requirements → Admin Port Security section.

For IQ Server version 1.42 and lower

HTTP Configuration in config.yml

http:
    port: 8070
    adminPort: 8071
    adminUsername: user1234
    adminPassword: pass5678

Access to the operational services available on the adminPort can optionally be restricted with HTTP basic authentication by specifying adminUsername and adminPassword.

Warning

Note that adminUsername and adminPassword are only available in IQ Server version 1.42 and lower. Additionally, the credentials are vulnerable to a timing attack, see CVE-2017-9735 for details. In environments where this risk is not tolerable, please use a reverse proxy instead to shield and authenticate access to the operational services.

HTTPS/SSL Configuration

One option to expose the IQ Server via HTTPS is to use an external server like Apache HTTPD or nginx and configure it for reverse proxying the external connections via HTTPS to the internal HTTP connection. This reverse proxy can be installed on the same server as the IQ Server or a different server and numerous tutorials for this setup are available on the internet.

A second option is to directly configure SSL support for Dropwizard by modifying the relevant segment in the config.yml file. The following examples show how to do this. Note that the keystore file can be generated and managed with the keytool.

For IQ Server version 1.43 and higher

HTTPS Configuration in config.yml

server:
    applicationConnectors:
        - type: https
          port: 8443
          keyStorePath: /path/to/your/keystore/file
          keyStorePassword: yourpassword
    adminConnectors:
        - type: https
          port: 8471
          keyStorePath: /path/to/your/keystore/file
          keyStorePassword: yourpassword

Documentation is available in the Dropwizard manual and reference.

For IQ Server version 1.42 and lower

HTTPS Configuration in config.yml

http:
  port: 8443
  adminPort: 8471
 
  connectorType: nonblocking+ssl
 
  ssl:
    keyStore: /path/to/your/keystore/file
    keyStorePassword: yourpassword

HSTS Configuration:

From IQ Server 136 onwards, HSTS is enabled by default.

It can be enabled/disabled by editing the following sections of the config.yml

HSTS Configuration in config.yml

# HTTP Strict Transport Security (HSTS) is supported using dropwizard-web configuration
# HSTS headers are enabled by default, uncomment web: section below and set enabled: false to disable
# Refer to https://github.com/dropwizard/dropwizard-web#supports for detailed configuration guide
#web:
#  hsts:
#    enabled: true
#    maxAge: 365 days
#    includeSubDomains: true

Web Application Context Path

For IQ Server 1.43 and newer the context path at which the web application is accessible can be customized using the option shown below:

server:
    # The context path for the application. Note that this must have a leading slash.
    applicationContextPath: /

While the application context path does control the base path the IQ server web application is served at, the value is not appended to whatever baseUrl config value you may already have set. When customizing the applicationContextPath, be sure to check if the Base URL value also needs adjustment.

CSRF Protection

Attacks on the IQ Server could occur via a cross-site request forgery (CSRF). To protect against this, a configuration item CSRF protection has been provided. This option is set to true by default and is updated through the Configuration REST API.

For IQ Server release 1.41 and prior

# Enables/disables cross-site request forgery protection. Defaults to true for increased security.
#csrfProtection: true

Note

In cases where the HTTP headers are stripped (e.g. a proxy configuration), this protection would block usage of the UI. To address this, you can disable this protection by setting the configuration item to false.