Tag Info

Hot answers tagged

11

Well, after quick testing over some random servers holding Server: Apache-Coyotte header signature in their HTTP replies, it seems you are right as sending get / HTTP/1.1\r\nHost: <target_IP>\r\n\r\n with a simple netcat connection worked every time while a 400 HTTP code should have been received. For instance : $ { echo -en "get / HTTP/1.1\r\nHost: ...


8

Regardless of Tomcat's incorrect behaviour with regards to the HTTP standard, you should be using a whitelist to allow specific methods rather than a blacklist. For example, the following whitelist will block all methods except the case-sensitive GET and HEAD. <security-constraint> <web-resource-collection> ...


7

I found a working solution: sudo touch /etc/authbind/byport/80 sudo chmod 500 /etc/authbind/byport/80 sudo chown tomcat7 /etc/authbind/byport/80 http://stackoverflow.com/questions/23272666/tomcat7-bind-to-port-80-fails-in-ubuntu-14-04lts


7

This is the logrotate software (that, as the name says, "rotate" logs) complaining about a non-existent user configured to rotate your tomcat logs. Try searching the /etc/logrotate.d/ directory for something like "tomcat" or "tomcat6" and remove the file if you find it, it's useless now that tomcat is not installed anymore.


6

I think the technology you are looking for is a reverse proxy. Configure your tomcat to listen on 8080 and have apache act as a proxy for it using mod_proxy_ajp or similar.


5

Depending on the version of Tomcat 5 and Version 6 the SSLEnabled="true" might not work as it was added mid-release. To get past this you just need to edit the following: sslProtocols = TLS To: sslProtocols = "TLSv1,TLSv1.1,TLSv1.2" Seems strange but even though it says TLS, it contains the SSL 3. This fixed it on our Tomcat 5.5.20 and our Tomcat 6 ...


4

You can launch: ps -o nlwp PID (PID will be the pid of your process) nlwp = number of lightweight process


4

A possible problem is Tomcat waiting for entropy to build up. Take a few thread dump with jstack to see who's waiting on what. Tomcat 7+ heavily relies on SecureRandom class to provide random values for its session ids, and other things. Depending on your JRE, it can cause delays during startup if the entropy source that is used to initialize SecureRandom ...


3

Definitely consider using SSL for everything. Many of our clients are going this direction and I recommend it fully. If you mix HTTP/HTTPS and want to maintain session state, you'll have to circumvent some of the mechanisms in Tomcat that try to prevent this (secure-only cookies for JSESSIONID). Once you successfully do that, then somebody could possibly ...


3

The simplest configuration for your needs could be: Set your tomcat to listen on port 8080 as HTTP Upload your SSL certificate to ELB and set your ELB to terminate the SSL. Forward port 443 on ELB to port 8080 on your instance. Configure your EC2 security group to only accept connections from the ELB's security group on port 8080. This way, no one can ...


3

PSK ciphers are not supported in the JSSE provider provided by Oracle (or any of the other JVM vendors as far as I am aware). You'll have to find a JSSE provider that supports PSK ciphers. That provider should include documentation on how to configure it. Note that while Oracle does list PSK ciphers in the Java standard names, that does not mean that they ...


3

The server computer's OS firewall is probably sufficient to do what you're looking for. You don't mention the OS so I can't say anything specific. On a Linux machine you'd be throwing on some iptables rules on the INPUT chain. On a Windows machine you'd be creating rules in the "Windows Firewall with Advanced Security".


3

You can do this with <Location /dev> RewriteEngine on RewriteRule ^/dev/(.*) /$1 ProxyPass / http://localhost:8080/ nocanon ProxyPassReverse / http://localhost:8080/ </Location> and so on. That will give you different proxies for the different URLs, and remove the leading /dev, /staging, or /prod from the URLs. But ...


2

I finally found out that is was as easy as open the Solr admin panel and go to Logging -> Level in the side navigation. There you can set the logging level to WARNING. This only sets the logging level for the current run of Solr. As soon as Solr is restarted, this is reset to the configured setting. The setting can be configured in file ...


2

Add ProxyPass /xyz/ http://www.example.com:8080/xyz/ above the first ProxyPass line and you should be fine.


2

Looks like a better choice over mod_proxy would be mod_jk. See Working with mod_jk.


2

Here is the cause: Jul 23 01:19:31 myservername kernel: [<ffffffff81122df2>] ? oom_kill_process+0x82/0x2a0 There is not enough ram. oom_kill_process is the kernel function which kills some processes if there is no ram enough. Something seems leaking, or you have very few memory. Is your swap really enabled and working? (cat /proc/swaps). Extension: ...


2

It seems that there is no more memory available to use on your system. Please check if you have swap memory on your system with below command free -m output should be as below if you have swap enabled. total used free shared buffers cached Mem: 1876 1798 77 0 119 1440 -/+ ...


2

It is a question that requires a detailed answer and there are many resources on the web that will be elaborate. I would be succinct. If there are static resources such as js, css then nginx / apache can take care of it. If SSL termination / compression is required then nginx / apache can offload that. Also, nginx / apache provide for more bells and ...


2

Ok, first of all, you can't specify the port for HTTP in your DNS* You want two different hostnames to be handled by two different contexts in to tomcat. This is called virtual hosting. Tomcat supports it, no port forwarding fanciness required. Per Tomcat's documentation, you probably want something like this: <Engine name="Catalina" ...


2

The remote port number is available to your application in the environment variable JK_REMOTE_PORT. There's no corresponding JkRequestLogFormat string to log the remote port, but it can be logged in a standard Apache mod_log_config request log with %{remote}p in LogFormat.


2

/usr/sbin/httpd and httpd.conf are for Apache httpd, which is a completely different program from Tomcat. Tomcat is generally configured with a file called context.xml. It sounds like you're configuring the wrong program. If you have both Tomcat and httpd installed on the same machine, note that httpd runs on port 80 by default, so Tomcat won't be able to ...


2

webConfigurator is sitting on port 443, and so is your NAT. You can't have it both ways. You mentioned that moving webConfigurator still doesn't allow this to work; my guess is that pfSense has some special magic applied to port 443 to restrict admin access. You can either disable this magic, or do the much easier option and either run the NAT against a ...


2

You should either set the -Xdebug -Xrunjdwp... switches in the JAVA_OPTS environment variable, or pass the jpda arguments to catalina.sh, but not both. If you do both, it will try to load the agent twice and give you an error. Edit: Personally I prefer to use the JAVA_OPTS switches because they give more control (e.g. to set the port number). Once you have ...


2

I had a similar problem with Tomcat 6 and Java 6, but my /etc/security/limits.conf looks like tomcat soft nproc 2047 tomcat hard nproc 16384 tomcat soft nofile 1024 tomcat hard nofile 65536 Where tomcat is the user tomcat service run as.


2

Yes! Above the ProxyPass /, add: ProxyPass /broken/page.html ! That'll force the proxypass to not act on the page that you're trying to redirect.


2

<Proxy> blocks are also useful as the context is always understood to be applying to proxied traffic. In this fashion you don't need to exclude specific paths. <Proxy *> Redirect permanent /broken/page.html https://www.example.com/correct/page.html RedirectMatch ^/deadstuff.+ http://www.example.com/correct/page.html </Proxy> ...


2

Your ciphers should be listed in order of preference. But you listed TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA before TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA. Try reversing their order in the list. You may also wish to reorder the entire list so that all the 256-bit ciphers appear before all the 128-bit ciphers. You also need to have SSLHonorCipherOrder="true" set ...


2

Add connectionTimeout and keepAliveTimeout to your AJP connector found in /etc/tomcat7/server.xml. <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" connectionTimeout="10000" keepAliveTimeout="10000" /> Info about the AJP connector at https://tomcat.apache.org/tomcat-7.0-doc/config/ajp.html connectionTimeout = The number ...



Only top voted, non community-wiki answers of a minimum length are eligible