[Zope3-Users] binding z3 to localhost only (security) / xmlrpc via https

[Igor Stroh]

Andreas Reuleaux wrote:
> If have successfully setup zope3 behind a ssl-enabled apache2 (apache
> and zope3 both running on the same host mousehouse) using ProxyPass and
> ProxyPassReverse directives as described in Philipps book in chapter 17,
> example 17.3.1, i. e. I can reach zope with https://mousehouse/...
> 
> Now I want to bind zope3 to localhost only, in order to make sure
> it can *only* be reached with https://mousehouse/...,
> *not* with http://mousehouse:8080 any more.
> This should be possible (and is mentioned in Philipps book on page
> 303, "Only binding it to localhost ensures that noone from the outside
> gains access to Zope directly"). I just haven't figured out how
> to do this, maybe I have overlooked something. How do I bind
> it to localhost only?

Adjust the <server> section of your zope.conf accordigly:
<server>
  type HTTP
  address 127.0.0.1:8080
</server>

Cheers,
Igor