How can we restrict access to the monitoring page of Java Melody?

Question

Hello all,

we installed Java Melody for JIRA 6.1.6 and we are really happy about the monitoring it supplies. The problem is, that everyone has access to the monitoring page even if they are not logged in. I could not find a hint how to restrict the access to the pages when Java Melody is used as a plugin for JIRA. So any help from you would be very much appreciated.

Thanks a lot,
Simone

Henning Tietgens · Answer

Hi, I have the same problem. We're using Apache2 as a reverse proxy (https) which redirects using ajp protocol to JIRA (standalone). Installation was copying the JavaMelody plugin jar to atlassian-jira/WEB-INF/lib as described here. I added the following to the apache sites file Satisfy any Order deny,allow Deny from all Allow from 127.0.0.1 AuthType Basic AuthName "Authorization Required" AuthUserFile /etc/apache2/.htpasswd Require valid-user and restarted apache, but it didn't work. Any suggestions how to restrict access to /monitoring? Thanks Henning

Bernhard Gruenewaldt · Answer

did you install it as a war-file inside the tomcat of a jira installation using the installer?

Which kind of setup did you use for Jira? How did you install Java Melody?

Are you using an apache webser with mod_proxy in front of jira?

If you give me more details I can surely help you.

Bernhard Grünewaldt · Answer

did you install it as a war-file inside the tomcat of a jira installation using the installer?

Which kind of setup did you use for Jira? How did you install Java Melody?

Are you using an apache webser with mod_proxy in front of jira?

If you give me more details I can surely help you.