Tag Info

Hot answers tagged

11

Well, after quick testing over some random servers holding Server: Apache-Coyotte header signature in their HTTP replies, it seems you are right as sending get / HTTP/1.1\r\nHost: <target_IP>\r\n\r\n with a simple netcat connection worked every time while a 400 HTTP code should have been received. For instance : $ { echo -en "get / HTTP/1.1\r\nHost: ...


8

Regardless of Tomcat's incorrect behaviour with regards to the HTTP standard, you should be using a whitelist to allow specific methods rather than a blacklist. For example, the following whitelist will block all methods except the case-sensitive GET and HEAD. <security-constraint> <web-resource-collection> ...


7

I found a working solution: sudo touch /etc/authbind/byport/80 sudo chmod 500 /etc/authbind/byport/80 sudo chown tomcat7 /etc/authbind/byport/80 http://stackoverflow.com/questions/23272666/tomcat7-bind-to-port-80-fails-in-ubuntu-14-04lts


7

This is the logrotate software (that, as the name says, "rotate" logs) complaining about a non-existent user configured to rotate your tomcat logs. Try searching the /etc/logrotate.d/ directory for something like "tomcat" or "tomcat6" and remove the file if you find it, it's useless now that tomcat is not installed anymore.


5

Depending on the version of Tomcat 5 and Version 6 the SSLEnabled="true" might not work as it was added mid-release. To get past this you just need to edit the following: sslProtocols = TLS To: sslProtocols = "TLSv1,TLSv1.1,TLSv1.2" Seems strange but even though it says TLS, it contains the SSL 3. This fixed it on our Tomcat 5.5.20 and our Tomcat 6 ...


3

PSK ciphers are not supported in the JSSE provider provided by Oracle (or any of the other JVM vendors as far as I am aware). You'll have to find a JSSE provider that supports PSK ciphers. That provider should include documentation on how to configure it. Note that while Oracle does list PSK ciphers in the Java standard names, that does not mean that they ...


3

You can do this with <Location /dev> RewriteEngine on RewriteRule ^/dev/(.*) /$1 ProxyPass / http://localhost:8080/ nocanon ProxyPassReverse / http://localhost:8080/ </Location> and so on. That will give you different proxies for the different URLs, and remove the leading /dev, /staging, or /prod from the URLs. But ...


3

You can launch: ps -o nlwp PID (PID will be the pid of your process) nlwp = number of lightweight process


3

Definitely consider using SSL for everything. Many of our clients are going this direction and I recommend it fully. If you mix HTTP/HTTPS and want to maintain session state, you'll have to circumvent some of the mechanisms in Tomcat that try to prevent this (secure-only cookies for JSESSIONID). Once you successfully do that, then somebody could possibly ...


3

The server computer's OS firewall is probably sufficient to do what you're looking for. You don't mention the OS so I can't say anything specific. On a Linux machine you'd be throwing on some iptables rules on the INPUT chain. On a Windows machine you'd be creating rules in the "Windows Firewall with Advanced Security".


3

A possible problem is Tomcat waiting for entropy to build up. Take a few thread dump with jstack to see who's waiting on what. Tomcat 7+ heavily relies on SecureRandom class to provide random values for its session ids, and other things. Depending on your JRE, it can cause delays during startup if the entropy source that is used to initialize SecureRandom ...


3

The simplest configuration for your needs could be: Set your tomcat to listen on port 8080 as HTTP Upload your SSL certificate to ELB and set your ELB to terminate the SSL. Forward port 443 on ELB to port 8080 on your instance. Configure your EC2 security group to only accept connections from the ELB's security group on port 8080. This way, no one can ...


2

You'll need to run Tomcat as root for it to be able to bind to port 80. All ports below 1024 require superuser permissions for binding. This is also what the last exception in the stacktrace tries to tell you: Caused by: java.net.SocketException: Permission denied at sun.nio.ch.Net.bind0(Native Method) at sun.nio.ch.Net.bind(Net.java:444) at ...


2

For Centos 7 you can enable the port 8080 with the following commands: firewall-cmd --zone=public --add-port=8080/tcp --permanent firewall-cmd --reload


2

Tomcat 8 and 7 uses the Jasper 2 JSP Engine. One of changes was made in this version is: Background JSP compilation If you make a change to a JSP page which had already been compiled Jasper 2 can recompile that page in the background. The previously compiled JSP page will still be available to serve requests. Once the new page has been compiled ...


2

I see these in catalina.out for Tomcat 8; might be a matter of parsing this file for the right strings: 12-Mar-2015 11:20:11.411 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Java Home: /app/java/jdk1.7.0_75/jre 12-Mar-2015 11:20:11.412 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Version: ...


2

You're doing nothing wrong. "Cached" memory in Linux is the kernel using available RAM to cache files from disk, for speedy access( no need to go to slow disk for commonly accessed files). This is by design, and a good thing.


2

Such behaviour is often caused by high heap memory usage and/or excessive garbage collection. When Tomcat gets tight on memory it will start to respond slowly and timeout intermittently. Situation usually deteriorates slowly until it becomes unresponsive. In such situations you may or may not see high CPU usage. Try to analyse memory usage (JMX may help ...


2

Usually your load balancer will handle negotiating https connections to your clients, then it will connect back to the origin tomcat server(s) to get the content over plain http (since there's not too much need to encrypt for that short hop, and presumably you can trust the local network). You should set your load balancer to redirect any http requests it ...


2

I've figured that out using mod_proxy instead of mod_jk and adding these lines : ProxyPass / http:// SERVER_IP:8080/ ProxyPass /myapp/ http:// SERVER_IP:8080/myapp And this line for cookies : ProxyPassReverseCookiePath /myapp /"


2

I think you added something / extra in your config settings... Look at this line: proxy_pass http://IP_ADD_TOMCAT_SERVER:8080/; you need to remove the trailing slash and it should work fine. like this: proxy_pass http://IP_ADD_TOMCAT_SERVER:8080; try it out and see if things go fine!! Update#1 I just noticed that you have another mistake "same typo" ...


2

I had a similar problem with Tomcat 6 and Java 6, but my /etc/security/limits.conf looks like tomcat soft nproc 2047 tomcat hard nproc 16384 tomcat soft nofile 1024 tomcat hard nofile 65536 Where tomcat is the user tomcat service run as.


2

I think the technology you are looking for is a reverse proxy. Configure your tomcat to listen on 8080 and have apache act as a proxy for it using mod_proxy_ajp or similar.


2

Yes! Above the ProxyPass /, add: ProxyPass /broken/page.html ! That'll force the proxypass to not act on the page that you're trying to redirect.


2

<Proxy> blocks are also useful as the context is always understood to be applying to proxied traffic. In this fashion you don't need to exclude specific paths. <Proxy *> Redirect permanent /broken/page.html https://www.example.com/correct/page.html RedirectMatch ^/deadstuff.+ http://www.example.com/correct/page.html </Proxy> ...


2

Add connectionTimeout and keepAliveTimeout to your AJP connector found in /etc/tomcat7/server.xml. <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" connectionTimeout="10000" keepAliveTimeout="10000" /> Info about the AJP connector at https://tomcat.apache.org/tomcat-7.0-doc/config/ajp.html connectionTimeout = The number ...


2

If you're seeing this error, but you're in an environment where other webapps already exist, you can simply create a ROOT directory, then create a zero byte index.html inside of it. A 200 will be readily returned upon successful curl.


2

Easy enough to do: ps -eLf | grep java Might have to adjust (grep can be refined to get what you're looking for).



Only top voted, non community-wiki answers of a minimum length are eligible