Security

We are implementing captive protal and have found that if we allow preauthenticated guest users to hit the ClearPass server via http/https they can get to any website on the server.  I am hoping to restrict access, via ACL on the controller, to a nonstandard port.  Can we configure Apache to listen on a nonstandard port for a website?  Thanks.

You can restrict access to other elements of Clearpass under the Server Administration configuration for the clearpass server. Go to the Network tab and apply ACL's to the other areas i.e. the /tips access.

You can also add allow and deny ACLs on each Clearpass Guest web login page to only allow access from specific hosts or subnets.

This should give you the ability to restrict what particular subnets can see on Clearpass and therefore you shouldn't need to change the port of the web server.

So, I like that potential option but I would rather listen on a non
standard port. I am not a Clearpass admin. Is the apache backend
configurable/reachable?

No, there is currently no option to change the web server port.

 

Thanks,

 

Zach

10-4. Thanks.