I have a fresh install of Fedora 23 (Workstation) with fresh installs of Apache 2.4 and Tomcat 8.
I'm attempting a very simple setup: A single instance of Apache will proxy all traffic for a single instance of Tomcat.
httpd.conf I've set
ServerName localhost. It includes the proxy configuration file
conf.modules.d/00-proxy.conf. In that file,
mod_proxy_ajp are enabled with configuration
ProxyRequests Off <Proxy *> Order deny,allow Deny from all Allow from localhost </Proxy> ProxyPass / ajp://localhost:8009/ ProxyPassReverse / ajp://localhost:8009/
According to my understanding, this tells Apache to relay all requests to whatever is listening on local port 8009 via AJP, allowing only requests from
localhost and keeping everything relative to the respective root directories.
/etc/tomcat/server.xml, I have
<!-- Define an AJP 1.3 Connector on port 8009 --> <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
which, according to my understanding, tells Tomcat to listen on port 8009 for anything being sent via AJP. Given the Apache configuration, this should be every request Apache receives.
localhost returns a 403 Forbidden error. If I connect to Tomcat directly with
localhost:8080, the connection is fine and I get
index.jsp. Apache's error log gives
AH01630: client denied by server configuration: proxy:ajp://localhost:8009/favicon.ico
indicating that Apache is disallowing access to Tomcat's
/tomcat/webapps/ROOT/ directory because of a permissions conflict. I tried adding
<Directory "/var/lib/tomcat/webapps/ROOT"> AllowOverride None # Allow open access: Require all granted </Directory>
httpd.conf, but it didn't change the 403 Forbidden error after restarting Apache.
This is a very common setup, and none of the many, many guides I've read indicate needing to change Apache's access permissions or the OS filesystem permissions. This is a clean install, and I've done very little with the installation that I haven't noted here.
What do I not understand?