Tag Info

Hot answers tagged

10

Well, after quick testing over some random servers holding Server: Apache-Coyotte header signature in their HTTP replies, it seems you are right as sending get / HTTP/1.1\r\nHost: <target_IP>\r\n\r\n with a simple netcat connection worked every time while a 400 HTTP code should have been received. For instance : $ { echo -en "get / HTTP/1.1\r\nHost: ...


8

Regardless of Tomcat's incorrect behaviour with regards to the HTTP standard, you should be using a whitelist to allow specific methods rather than a blacklist. For example, the following whitelist will block all methods except the case-sensitive GET and HEAD. <security-constraint> <web-resource-collection> ...


3

Definitely consider using SSL for everything. Many of our clients are going this direction and I recommend it fully. If you mix HTTP/HTTPS and want to maintain session state, you'll have to circumvent some of the mechanisms in Tomcat that try to prevent this (secure-only cookies for JSESSIONID). Once you successfully do that, then somebody could possibly ...


3

The simplest configuration for your needs could be: Set your tomcat to listen on port 8080 as HTTP Upload your SSL certificate to ELB and set your ELB to terminate the SSL. Forward port 443 on ELB to port 8080 on your instance. Configure your EC2 security group to only accept connections from the ELB's security group on port 8080. This way, no one can ...


2

Usually your load balancer will handle negotiating https connections to your clients, then it will connect back to the origin tomcat server(s) to get the content over plain http (since there's not too much need to encrypt for that short hop, and presumably you can trust the local network). You should set your load balancer to redirect any http requests it ...


2

This a long saga. The main problem, that the java community and the linux community created a lot of quasi-standards, practices and conventions, and these are somehow contradicting eachother in every viewpoint. You can integrate java and linux easily, but you must learn both of them, and you will have to break many of them on both sides. If you know only ...


2

I have tomcat8 running onopenjdk-8-jdk in a Jessie LXC, and I get the same WARNINGs to no ill effect. I don't get the SEVERE. But my ps line reads ...-Dcatalina.base=/var/lib/tomcat8 -Dcatalina.home=/usr/share/tomcat8 -Djava.io.tmpdir=/tmp/tomcat8-tomcat8-tmp....


2

It occurred to me that you see this only when you run configtest.sh, and there's an obvious reason: CATALINA_BASE et al. only get set in /etc/init.d/tomcat8. When I run configtest.sh as you did, I get the same output. If you want to run configtest the same way as the daemon, you'd probably want to hack /etc/init.d/tomcat8 to accept that argument. For some ...


1

First of all, you need to reconsider, whether your app really needs to "phone home" every 15 minutes! This puts burdon not only onto your server, but also on the mobile network, on people's phones and on their data bills. In particular, if this is a location update, the app might be programmed to not send an update of the location, if the change in GPS ...


1

Default JIRA is running on port 8080. So you have to type the port after your URL and open the ports in your security groups (Firewall). http://ec2-xxxxx.xxxxx.amazonaws.com:8080 If you want JIRA under a specific domain you have to install a proxy to redirect it from port 80 to 8080. ...


1

I am using setenv.sh bash script, which is located in $TOMCAT_HOME/bin directory. catalina.sh script is referring to it by default. Forgot to mention, that this script is not there by default. You need to create it and give tomcat user (or whatever user you use to run tomcat) to be able to execute it.


1

It's common to place a more fully featured webserver in front of an application server, particularly for serving static content and defining redirects/rewrites. As a general rule, it's a good idea to minimize the number of dependencies you have on your application server backend. The AJP connector is more optimized for this particular use case as it ...


1

The most likely answer is environment variables, i.e. an interactive shell has a lot (including a rather complete $PATH), whereas for programs run from cron they are typically heavily limited (including an abbreviated path).


1

I ran it manually as ETL suggested, and the problem turned out to be that the jmxremote.password file needs to have its permissions set to only be readable by its owner, which should be set to whichever user the service runs as.



Only top voted, non community-wiki answers of a minimum length are eligible