Tag Info

Hot answers tagged

24

I can't think of any Ubuntu-specific tweaks, but here's a few that apply to all distributions: Uninstall all unnecessary packages Use public-key only authentication in SSH Disable root logins via SSH (doesn't apply to Ubuntu) Use the production settings for PHP (php.ini-recommended) Configure MySQL to use sockets only Of course this list isn't complete, ...


16

One quick thing that I do early on is install DenyHosts. It will regularly look through the /var/log/secure, looking for failed logins, and after a couple of failures, block the IP. I set it to block after the first no-such-user, on the second attempt at root, and after a couple of tries for real users (in case you mess up, but you should be using a SSH ...


10

Ubuntu is based off Debian and I've found the Securing Debian Manual to be very useful in Debian-based distributions in completely walking you through your system and checking every part. It's basically a really, really comprehensive answer to your question.


6

We have studied relative performance of JBoss vs. Glassfish, and found that Glassfish scales much better under high loads.


6

Don't forget to consider Jetty. I like very much: its ease of configuration and deployment (just unzip it and optionally edit one config file) the fact that it's easily embeddable in other applications (with a single jar) its support for continuations a lot before the Servlet 3 spec is ready Check this comparison out, it's done by a Jetty dev, but it's ...


6

Tomcat is definitely an application server, as it will happily process Java server-side code in order to generate dynamic contents, while instead a "pure" web server (like Apache) can only serve static web pages; so your teacher is totally wrong here. What is right is that Tomcat doesn't provide native JSF support; but the more than 4500000 results shown by ...


5

They're often the same, but technically an app server is not limited to HTTP requests, and is often behind a web server and provides "business logic" in the form of web service calls which are used to construct the actual resources requested by the end user. See this for more: http://www.javaworld.com/javaworld/javaqa/2002-08/01-qa-0823-appvswebserver.html ...


5

you may want to try your questions over at stackoverflow.com. At my company the programming teams set up those application servers and then work with production support. We keep JBoss in our repository because of all the configuration changes and each server we deploy needs to be slightly modified. I've enjoyed playing with JBoss and the people in the ...


5

I've just been through this process (literally in the last week) with JIRA+Crowd+Confluence on a WinXP box. (not a 64-bit server OS but probably very similar) It's not hard to set up Apache + the appropriate proxy info so from the outside you are accessing these via HTTP 80, but internally they run on Tomcat 8080 (or whatever your tomcat port is). For most ...


5

Using a domain account requires administration and protection of the account and password. Using the builtin NetworkService or LocalService identities has lower administrative effort and does not require protection of the service account password. The builtin identities have predefined permissions for some objects on the system and may be shared by ...


4

The difference really boils down to how the service will interact with other machines over the network (using Microsoft networking protocols). The "Network Service" is, effectively, an unprivileged user that authenticates as the computer's domain account when accessing remote resources. Assuming that your domain account is just a member of the "Users" group ...


4

Glassfish is an application server as it handles EJB requests (EJB Container) while Tomcat is a Web Container - it can't handle EJB components. So, what are the components of the application you plan to run. If your application uses Servlets and JSPs, then GlassFish is an overkill. If you have EJBs then you can't use Tomcat anyway. So, I think it starts with ...


4

There are several files (two of them look like reliable sources) in your WAS-profile that you can check (I used the paths from my installation, which uses mostly the standard settings): {WAS-Profile-Path}\logs\AboutThisProfile.txt {WAS-Profile-Path}\config\cells{cellname}\nodes{nodename}\serverindex.xml And look for WC_adminhost_secure or WC_adminhost. ...


4

Install logcheck, but tweak so that you never receive messages from regular events, otherwise you'll get in the habit of ignoring the emails. Check which processes are listening using netstat, and make sure nothing's running that doesn't need to run. Many daemons can be configured only to listen on the internal IP (or localhost) instead of all interfaces.


4

I usually install RKHunter, which scans for rootkits and does integrity checks of various important system binaries. It's in the standard repo, and will run daily from cron. It's not perfect, securitywise, but it's a low-effort item to add, and it provides a measure of protection.


4

You should take a look at PHP-FPM. It is a PHP FastCGI implementation that should let you separate the PHP to its own application server.


4

There is no really precise definition of these terms, but very roughly speaking: a web server is a program that serves content (HTML, images, etc) to browsers, i.e. to be read by humans a web service is a service that can be accessed via HTTP (the same protocol a web server uses), typically an API to be used by programs So the difference is the ...


4

Q> What is the correct way for deploying an Java web app on Tomcat via the Admin / Mgmt interface and have it be the root application? A> Look at Tomcat 6: How to change the ROOT application Q> hosted on port 80? A> Change the relevant Connector property in conf/server.xml. Remember, running on port 80 will require root privileges, at least on Unix servers. ...


3

How good is Glassfish at serving static content? Name-based vhosting? Redirects? I'm willing to bet that Apache is better at it all. If you're particularly interested in a small footprint frontend webserver, though, look at nginx instead of Apache.


3

One of the features of the Certificate Authority system is that things change. Roots expire, new roots come into existence, certificates are revoked, roots go bankrupt after compromises. An update mechanism really needs to be in place to handle these changes. There is a third option available, and that is to use a different CA that offers 2K certificates ...


3

There is no cheap answer to this, and nothing appropriate for a 5-PC office. If he thinks that doing this means he only has to buy 1 license for the software, he's incorrect. Any method of doing this is going to expensive, period. Citrix XenApp (formerly presentation server) was made for this, but you have to have good server-class hardware to run it on, ...


3

Do what Can suggests... Nmap the host and disable all non-essential services. Use iptables if necessary.


3

Some firewall suggestions. Learn to use a firewall and the concepts of properly locking a box down. Changing default ports is largely a useless thing; proper application and firewall configuration are much more important. Both are in the Ubuntu repos: FireHOL has terrific documentation and very easy to learn syntax. I was able to set up a ...


3

Use separate partitions for various directories like /tmp or /var and mount them with nosuid, nodev and noexec if possible.


3

I heard that Glassfish is the fastest server if you scale up to a big environment. This does it by grizzly. Here are some performance stats.


3

I think you find that it is very difficult to get a terminal server / VDI setup to perform well for those types of applications (AutoCAD, 3DMax). I suspect you will also find it very costly to get started on a TS/VDI setup for only 6 machines. You need a lot of server infrastructure to support either of those technologies. You can and possibly should ...


3

I wouldn't suggest relying on snapshots for this purpose. Depending on the version of VMware you have installed, you can clone an existing virtual machine or leverage the template functions of vCenter. Outside of that, I would just reinstall onto a new virtual machine if you have the access. If you don't have access to do this, check with the person/group ...


2

The only time in which we're asked to put our DMGR in a seperate box is when my company deployed what IBM calls "stacked" products, like Websphere Process Server. In that case, that setup is quite complicated, to say the least, with the DMGR JVM doing quite a bit of work. One thing NOT to do, however, is put the DMGR in a different box in a different OS. ...


2

Original answer here please give him credit too. http://stackoverflow.com/questions/2970442/running-a-server-in-parallels-virtual-machine-is-it-possible-for-the-host-to-ac You want to put your guest into "bridged" networking mode. This will allow it to obtain an IP address on the same network as your host OS (from your router via DHCP or statically ...


2

Your question is really broad, so I just mention a few aspects: local socket I/O is faster than TCP, but for most applications this should be miniscule compared to all other parts of your turnaround time (load balancer, PHP processing, DB query processing, ...) split systems allow for better caching, e.g. the DB server can keep more indices in RAM. ...



Only top voted, non community-wiki answers of a minimum length are eligible