I found a working solution:
sudo touch /etc/authbind/byport/80
sudo chmod 500 /etc/authbind/byport/80
sudo chown tomcat7 /etc/authbind/byport/80
It depends on what kill signal you are using:
If you use TERM (the numeric equivalent is kill -15), theoretically you are letting the java process signal its children and exit in a correct way.
If you use KILL (kill -9), you don't, and you left all sorts of temporary files,
sockets, etc... behind.
That said, tomcat has its own mechanism to shutdown ...
The OOTB configuration is typically 150 – 200 total accept threads for each connector. This default is intended for medium load / complexity applications on “average” hardware.
As a general rule of thumb, a lightweight, high performance application should look at using a maximum of 150 (accept) threads per CPU core (so a total of 600 on a 4 core box). A ...
It looks like you have an extra semicolon at the end of the CATALINA_HOME variable (and others). Try with:
To debug the situation you can use the command line tools of openssl, especially openssl s_client. By adding the options -tls1, -tls1_1 and -tls1_2 you can test compatibility for the protocols, and with -cipher [cipherlist] for ciphers. For example
openssl s_client -connect example.com:443 -tls1
You will get detailed information and possibly warnings about ...
As it is defined in the documentation, the redirect port will come into picture when SSL request will come to the server and since http connector port cannot handle SSL requests it will redirect to the port defined. But their must be another section defined in server.xml file in which the defined redirect port will act as a connector port to handle SSL ...
Over the years there have been a number of connectors developed to enable Apache httpd to communicate with Tomcat that have used a variety of protocols. When searching the web for information on how to do this, it isn't unusual to stumble across some really bad, out of date advice. So first of all the only options you should consider for this are:
There's a problem initializing the shared memory that is needed by the workers.
Check whether the directory /etc/httpd/logs/ exists and is writable by the user that's running the tomcat instance. If it isn't, either change the permissions on the directory, or create a separate directory to keep the shm files in. (I'd recommend the latter, simply because it'...
There is no difference in behaviour if you use Tomcat's shutdown script or use kill -15. The end result is exactly the same - a clean shutdown. The only difference is a slight difference in the code path that starts the shutdown process.
Tomcat 8 and 7 uses the Jasper 2 JSP Engine. One of changes was made in this version is:
Background JSP compilation
If you make a change to a JSP page which had already been compiled Jasper 2 can recompile that page in
the background. The previously compiled JSP page will still be
available to serve requests. Once the new page has been compiled
Your Tomcat is using 22GB of memory because your -Xmx (JVM Heap Size) value is absolutely massive.
If possible, you should start by reducing this value to 2048, 4096 or 8192, depending on your application memory requirements and see what the sweet spot is.
It isn't exactly the solution I prefer, but I created the /usr/share/tomcat7/bin/setenv.sh script as described in catalina.sh.
And of course gave it execute permissions with chmod ugo+x setenv.sh.
Per default CentOS has an iptables firewall running. For a quick check you can turn it off using "service iptables stop".
Another place to have a look at is the server.conf from your Tomcat. Maybe it's only listening on your localhost interface.
I got it fixed by removing a blank line at the top of solr.xml file. But now a different error appear, although Solr seems to be running now.
This helped me to figure out the issue:
Trailing slash must be added to path, it's necessary to handle web socket requests as GET requests (httpd.apache.org/docs/2.4/mod/mod_proxy.html#proxypass)
ProxyPass /my_app/BasicWebsocketServlet/ ws://1X.X.X.1:8080/my_app/BasicWebsocketServlet/ retry=0
ProxyPassReverse /my_app/BasicWebsocketServlet/ ws://1X.X.X.1:8080/web_pmr/...
Please set the value of the deployOnStartup attribute to false in the Host element (the default is true).
Recommend to keep the autoDeploy attribute true in case you will update wars
<Host name="localhost" deployOnStartup ="false"
unpackWARs="true" autoDeploy="true" ...>
See for details: http://tomcat.apache.org/tomcat-7....
You can't in any way stop anybody else from pointing to your webserver. What you can do is to server up a web site that will inform people that the domain is not hosted by you. There's some information about how virtualhosts work at the Tomcat documentation site.
If we assume that you have two domains that you want to host, and anything that doesn't match ...
mod_proxy is the Apache HTTP server module, not an Apache Tomcat module.
What this page is saying is that Tomcat supports either JK1.2 or the AJP protocol provided by the mod_proxy module within Apache HTTP.
Historically what you had to do was use mod_jk to provide AJP1.3 support to the Apache HTTP server, as of Apache HTTP 2.2 this is now provided within ...
I will answer your first question:
How do I act now to ensure the server is secure?
Don't even try to clean it up if you can help it. Just reinstall the OS and this time setup firewall rules that block access to the Tomcat manager except from your current IP address. Even better just block everything except SSH and tunnel into the server then access the ...
This means that after requesting http://192.168.10.11:7070/path/dosomething.json nginx hanged reading for proxy_read_timeout seconds on the socket used to communicate with your tomcat server and didn't receive any data. Investigate on tomcat's side to understand why it doesn't respond in time.
You should either set the -Xdebug -Xrunjdwp... switches in the JAVA_OPTS environment variable, or pass the jpda arguments to catalina.sh, but not both. If you do both, it will try to load the agent twice and give you an error.
Edit: Personally I prefer to use the JAVA_OPTS switches because they give more control (e.g. to set the port number). Once you have ...
SSL_RSA_WITH_RC4_128_SHA should work - the reason for this is just a difference in terminology, the ciphers in Java 6 that required TLS were the only ones that have the TLS on the name. This particular cipher spec works under TLS as well as SSL despite the name.
This configuration should allow connections from IE8 on XP while still rejecting SSLv3 ...
As explained here you may have to set the ciphers list like this :
sslProtocols = "TLS"
I've run into a problem with identical symptoms.
$ sudo service tomcat7 start
* Starting Tomcat servlet engine tomcat7
Nothing in catalina.out and nothing any sys logs. Finding the problem was simplified by going to /usr/share/tomcat./bin and running the startup.sh file from the command line, this displayed the error. In my case, it was a ...
According systemd documentation you should create directory /lib/systemd/system/tomcat.service.d and put there file with .conf extension, then add to that file required changes for User and Group:
After this your changes to service would be permanent, because they stored in separate location, which not change after update....
If you want to label /var/websvr/certs/keyfile.jks with tomcat_sys_content_t then you can create a customer file context
semanage fcontext -a /var/websvr/certs/keyfile.jks -t tomcat_sys_content_t
If that doesn't work because tomcat_sys_content_t doesn't exist then substitute tomcat_t or possibly pki_tomcat_cert_t ...